TLS message detection method

Abstract

A TLS message detection method can provide transparent mode deployment and avoid configuration dependence on upstream and downstream devices and systems. The method comprises the following steps of: establishing an address translation layer module at the lower layer of a host protocol stack, directly receiving and transmitting a message to a network card, performing NAT address translation on a request message by using an NAT mechanism, transmitting the message to a host KNI virtual interface, and realizing transparent message receiving and transmitting on a customized protocol stack; the TLS Server module is used for receiving a message and sending a plaintext message to the plaintext arrangement module and the TLS Client module; the plaintext arrangement module assembles a source address and a destination address of the message, and sends the message received by the TLS Client module to an external security detection device; establishing a customized protocol stack, establishing TCP (Transmission Control Protocol) connection, and fixing a filling source and a target MAC (Media Access Control) according to system configuration; the TLS Client module establishes a client socket, sets a source IP address and a destination IP address of the socket, calls a customized protocol stack interface and communicates with the service server on the basis of the customized protocol stack, and the TLS Client module sends a message received by the TLS Client module to the service server.

Description

Technical Field

[0001] The present invention relates to the technical field of electric power communication, and in particular to a method for detecting TLS messages. Background Art

[0002] Currently, there are two main methods for security detection of TLS messages in the field of power communications. One is to analyze the DNS domain name, certificate information and IP address of the connection based on the TLS protocol negotiation message, and then combine the length characteristics of the message, the timing characteristics of the packet transmission, etc., to record the characteristics based on the virus behavior statistics of the virus library, and use the machine learning model for identification. The other is to use the TLS middleman proxy mode to decrypt the TLS message, extract the plaintext content, and use the traditional content detection method for the plaintext content to complete deep filtering and detection.

[0003] In the above two methods, TLS decryption is used to redirect the decrypted plain text to the traditional security device, so that the traditional attack detection methods and equipment can be reused to perform more comprehensive message detection.

[0004] The current typical TLS decryption method is to establish a TLS Server module, a TLS Client module, and a plaintext forwarding orchestration module on the same host protocol stack. All modules can share the same operating system protocol stack. Through openssl programming, the TLS Server is established to decrypt the message and extract the plaintext information; the plaintext orchestration module is used to send the plaintext from the redirection interface of the machine, and the external detection device receives the message and then performs security detection on the message content. The plaintext message is passed to the TLS Client module through the queue mechanism. The TLS Client establishes a connection request, encrypts the message, and sends it to the real business server.

[0005] In the above solution, both TLS Server and TLS Client are implemented through the local host protocol stack. It is necessary to configure the IP address of the host interface for host communication, so the decryption device works in gateway mode. The TLS Server is the IP published by the business. The customer accesses this address instead of the original business address. This requires modifying the upstream and downstream related equipment and gateway configuration of the business, which is complex to deploy and has a large impact. For the real business server, the source IP address of the message it receives is the TLS Client address of the decryption orchestrator. To obtain the IP address of the real client in the business, it cannot be obtained based on the socket connection attributes or from the message IP layer. It is necessary to obtain the IP address based on X-Forwarded-For at the business layer, which also has a certain impact on the business. When the TLS Client initiates a connection request to the real business server, the communication between the TLS Client and the server will also be limited by the number of local client ports 65535. At the same time, the connection request limit of the business server for the same IP cannot take effect. Summary of the invention

[0006] The present invention aims to solve the above-mentioned deficiencies in the background technology and provide a method for TLS message detection, which can provide transparent mode deployment and avoid configuration dependence on upstream and downstream devices and systems. For the real business server, the message it receives maintains the source IP address, source port and destination IP address and destination port of the original requesting user, and has no impact on the business system.

[0007] The technical solution of the present invention is: a method for TLS message detection, the steps of which are:

[0008] Step 1: Establish an address translation layer module at the lower layer of the host protocol stack. This module directly sends and receives messages to the network card, uses the NAT mechanism to perform NAT address conversion on the request message and sends it to the host KNI virtual interface, so as to realize transparent message sending and receiving for the customized protocol stack.

[0009] Step 2: Use the TLS Server module to receive the message. The module copies a copy of the plaintext message and sends it to the plaintext arrangement module, and at the same time sends the plaintext to the TLS Client module;

[0010] Step 3: The plaintext orchestration module assembles the source address and destination address of the message, and sends the message received by the TLS Client module to the external security detection device;

[0011] Step 4: Establish a custom protocol stack. The custom protocol stack supports setting the source and source port, establishing a TCP connection, and filling in the source and destination MACs according to the system configuration to send the message to the network card.

[0012] Step 5. The TLS Client module establishes a client socket based on the customized protocol stack, sets the source IP and destination IP addresses of the socket, calls the customized protocol stack interface, and communicates with the business server. The TLS Client module sends the message received by the business server, and sends the message returned by the business server to the plaintext orchestration module and the TLS Server module through the message mechanism.

[0013] Further, in step 1, the address translation layer module takes over the physical interface of the TLS Server through the DPDK software library, establishes a polling thread for sending and receiving messages, and establishes a KNI virtual interface in the Linux kernel; after receiving the message through DPDK, the destination address of the message is modified to the KNI virtual interface IP address, and then sent to the KNI receiving message queue; the address translation layer module polls the physical network card on the service server side and sends it to the customized protocol stack;

[0014] Further, in step 4, the customized protocol stack is based on the open source LwIP, and the data structures of the socket interface, TCP control block and IP control block in the customized protocol stack are extended. The LwIP protocol stack is constructed with the capability of large-scale dynamic source IP by extending the IPStack hash table and TCPBlock hash table. It supports TCP connections with specified source addresses and source ports, fills in the source MAC and destination MAC addresses, and directly sends packets to the physical network card.

[0015] The beneficial effects of the present invention are:

[0016] 1. Establish an address translation layer module and a custom protocol stack at the lower layer of the host protocol stack, separate the host protocol stack and the custom protocol stack, and ensure that the decryption device can work in transparent mode through the address translation and custom protocol stack mechanism, so as to achieve transparent network deployment, simple networking, and no need to change the configuration of upstream and downstream devices;

[0017] 2. Directly drive the physical interface to send and receive messages at the address translation layer, and use the NAT mechanism to convert the destination address on the client side into the IP address of the TLS Server KNI interface. The TLS Server program remains unchanged, and while completing the transparent mode deployment, for the real business server, the decrypted and forwarded messages will not change the original source IP address, source port, destination IP address, and destination port of the message, and will have no impact on the real business server. The portability of the TLS Server program is maintained, reducing the workload and complexity;

[0018] 3. Modified based on open source LwIP, the business system has a dual protocol stack mechanism, with a simple structure and a reliable system. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 is a system architecture diagram of the present invention;

[0020] Figure 2 It is a flow chart of the invention. DETAILED DESCRIPTION

[0021] A TLS message detection method, such as Figure 1 and Figure 2 As shown, the steps are:

[0022] Step 1. Establish an address translation layer module at the lower layer of the host protocol stack. The address translation layer module works above the physical interface and below the host forwarding protocol stack. The address translation layer takes over the hardware network card through the DPDK library. After the message enters the network card, the address translation layer first receives the message, converts the destination address into the local TLS server IP address through the NAT module, and then sends the message to the host's KNI virtual interface through the queue mechanism. The address translation layer provides an API to support customized protocol stacks to send and receive messages to physical interfaces.

[0023] Step 2: The TLS Server module is a general application monitoring service based on OpenSSL. This module is used to receive messages sent by the client and interact with the client as a proxy. At the same time, it sends plaintext to the plaintext orchestration module and the TLS Client module through the message mechanism.

[0024] Step 3: The plaintext orchestration module fills in the source IP, source port, destination IP and destination port of the message through the socket mechanism, establishes TCP's ACK and SEQ data and FLAG data, and sends the message to an external security device (external security device refers to an external firewall or IDS device).

[0025] Step 4. Establish a customized protocol stack. This protocol stack is based on the LwIP protocol stack extension. The socket interface is extended. Through the setsockopt function, a function call is added to set the source address and source port of the socket communication. In the TCP layer of the customized protocol stack, the TCP Block structure is extended. Through the HASH table, a TCP Block pool is constructed according to the source address and source port, the destination address, and the destination port. In the IP layer, the hash structure of the IP Stack is constructed using the source address as the key. The protocol stack is configured with the MAC address of the next hop of the destination service. When the protocol stack sends a message, the destination MAC and source MAC are directly filled in, and the message is sent to the physical interface (network card). The destination MAC is the interface MAC of the service server, and the source MAC is the MAC of the original service server gateway interface.

[0026] Step 5. TLS Client establishes a client socket based on the customized protocol stack, calls the extended interface of the customized protocol stack, sets the source IP, destination IP address and source port of the socket, communicates with the business server, and sends the message returned by the business server to the plaintext orchestration module and TLS Server module through the message mechanism.

[0027] The above are only specific embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for TLS message detection, characterized in that: Step 1: Establish an address translation layer module at the lower layer of the host protocol stack. This module directly sends and receives messages to the network card, uses the NAT mechanism to perform NAT address conversion on the request message and sends it to the host KNI virtual interface, so as to realize transparent message sending and receiving for the customized protocol stack. Step 2: Use the TLS Server module to receive the message. The module copies a copy of the plaintext message and sends it to the plaintext arrangement module, and at the same time sends the plaintext to the TLS Client module; Step 3: The plaintext orchestration module assembles the source address and destination address of the message, and sends the message received by the TLS Client module to the external security detection device; Step 4: Establish a custom protocol stack. The custom protocol stack supports setting the source and source port, establishing a TCP connection, and filling in the source and destination MACs according to the system configuration to send the message to the network card. Step 5. The TLS Client module establishes a client socket based on the customized protocol stack, sets the source IP and destination IP addresses of the socket, calls the customized protocol stack interface, communicates with the business server, sends the message received by the TLS Client module to the business server, and sends the message returned by the business server to the plaintext orchestration module and the TLS Server module through the message mechanism.

2. A method for detecting TLS messages according to claim 1, characterized in that: In step 1, the address translation layer module takes over the physical interface of the TLS Server through the DPDK software library, establishes a polling thread for sending and receiving messages, and establishes a KNI virtual interface in the Linux kernel; after receiving the message through DPDK, the destination address of the message is modified to the KNI virtual interface IP address, and then sent to the KNI receiving message queue; The address translation layer module polls the physical network card on the service server side and sends the polled data to the customized protocol stack.

3. A method for TLS message detection according to claim 1, characterized in that: In step 4, the customized protocol stack is based on the open source LwIP, and the data structures of the socket interface, TCP control block and IP control block in the customized protocol stack are extended. The LwIP protocol stack is constructed with the capability of large-scale dynamic source IP by extending the IPStack hash table and TCPBlock hash table. It supports TCP connections with specified source addresses and source ports, fills in the source MAC and destination MAC addresses, and directly sends packets to the physical network card.

Images