Http proxy method, device and equipment based on dynamic certificate and medium

Abstract

Embodiments of the present application provide a dynamic certificate-based HTTP proxy method, device, equipment and medium. The method is applied to a proxy server storing self-signed certificate information of a plurality of website servers; the method comprises: in response to a first connection request initiated by a client to a target website server, determining whether the certificate information of the target website server matches the self-signed certificate information of any website server; if so, establishing a first cipher communication channel with the target website server and a second cipher communication channel with the client according to the self-signed certificate information of the website server; forwarding an access request initiated by the client to the target website server to the target website server through the first cipher communication channel, and forwarding an access response returned by the target website server to the client through the second cipher communication channel. Embodiments of the present application can monitor the access behavior of the target website server in a scenario where the private key of the target website server cannot be obtained.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, apparatus, device and medium for HTTP proxy based on dynamic certificates. Background Art

[0002] Currently, HTTP (Hypertext Transfer Protocol) / HTTPS (Hypertext Transfer Protocol Secure) protocols are widely used to ensure data transmission security. Considering enterprise network security, enterprises often choose to deploy proxy servers, such as Nginx (engine x, a high-performance HTTP and reverse proxy web server), to audit and control access to external websites by internal terminals.

[0003] However, in actual applications, it was found that when proxy servers such as Nginx monitor the behavior of internal terminals accessing external websites, they cannot obtain the private key of the external website server, so they cannot decrypt the access response returned by the external website server, and cannot monitor the access behavior of the external website server. Summary of the Invention

[0004] The purpose of the embodiments of the present application is to provide an HTTP proxy method, apparatus, device and medium based on dynamic certificates, so as to achieve the technical effect of monitoring the access behavior of the destination website server in a scenario where the private key of the destination website server cannot be obtained.

[0005] In a first aspect, an embodiment of the present application provides an HTTP proxy method based on a dynamic certificate, which is applied to a proxy server, wherein the proxy server stores self-signed certificate information of multiple website servers;

[0006] The method comprises:

[0007] In response to a first connection request initiated by a client to a destination website server, determining whether certificate information of the destination website server matches self-signed certificate information of any website server among the plurality of website servers;

[0008] If they match, establishing a first encrypted communication channel with the destination website server and a second encrypted communication channel with the client according to the self-signed certificate information of the website server;

[0009] forwarding, by the proxy server, the access request initiated by the client to the destination website server through the first cipher communication channel and forwarding, by the proxy server, the access response returned by the destination website server to the client through the second cipher communication channel.

[0010] In the implementation process, by pre-storing the self-signed certificate information of the plurality of website servers in the proxy server, the proxy server determines whether the certificate information of the destination website server matches the self-signed certificate information of any website server in response to the first connection request initiated by the client to the destination website server, and if so, establishes the first cipher communication channel with the destination website server according to the self-signed certificate information of the website server, and establishes the second cipher communication channel with the client, forwards the access request initiated by the client to the destination website server to the destination website server through the first cipher communication channel, and forwards the access response returned by the destination website server to the client through the second cipher communication channel. This can flexibly adapt to the access scenarios of the client to different websites, dynamically match the self-signed certificate information of the corresponding website server to establish the first cipher communication channel and the second cipher communication channel, and monitor the access behavior between the client and the external website server based on the first cipher communication channel and the second cipher communication channel. This not only eliminates the need for manual configuration of fixed certificate information, but also enables monitoring of the access behavior of the destination website server in scenarios where the private key of the destination website server cannot be obtained.

[0011] Further, before the determination of whether the certificate information of the destination website server matches the self-signed certificate information of any website server in the plurality of website servers, the method further comprises:

[0012] generating a second connection request according to the client configuration information in the first connection request; wherein the second connection request comprises the client configuration information;

[0013] sending the second connection request to the destination website server and receiving a connection response returned by the destination website server; wherein the connection response comprises the certificate information of the destination website server.

[0014] In the implementation process, by generating a second connection request comprising client configuration information according to the client configuration information in the first connection request by the proxy server, sending the second connection request to the destination website server, and receiving the connection response returned by the destination website server, the certificate information of the destination website server can be obtained from the connection response. This can forward the client configuration information to the destination website server, make the destination website server return its own certificate information in response to the client configuration information, and ensure that the certificate information of the destination website server is effectively obtained.

[0015] Further, the proxy server is configured with a self-signed certificate hash table for storing hash values corresponding to self-signed certificate information of the plurality of website servers.

[0016] The determination of whether the certificate information of the target website server matches the self-signed certificate information of any website server in the plurality of website servers includes:

[0017] querying the self-signed certificate hash table for a hash value identical to the target hash value, wherein the target hash value is a hash value corresponding to the certificate information of the target website server;

[0018] If so, it is determined that the certificate information of the target website server matches the self-signed certificate information of the website server corresponding to the queried hash value.

[0019] Otherwise, it is determined that the certificate information of the target website server does not match the self-signed certificate information of each website server in the plurality of website servers.

[0020] In the above implementation process, by pre-storing hash values corresponding to self-signed certificate information of a plurality of website servers in a self-signed certificate hash table configured by a proxy server, the proxy server uses hash lookup to query whether there is a hash value identical to a target hash value corresponding to the certificate information of a target website server in the self-signed certificate hash table, and determines whether the certificate information of the target website server matches the self-signed certificate information of any website server in the plurality of website servers according to the query result, which can quickly and accurately determine whether the certificate information of the target website server matches the self-signed certificate information of any website server in the plurality of website servers.

[0021] Further, the access request is encrypted by the client;

[0022] The forwarding of the access request initiated by the client to the target website server via the first ciphertext communication channel includes:

[0023] receiving the access request;

[0024] decrypting the access request according to a second session key corresponding to the second ciphertext communication channel;

[0025] auditing the decrypted access request according to a predefined request auditing rule;

[0026] re-encrypting the audited access request according to a first session key corresponding to the first ciphertext communication channel;

[0027] sending the re-encrypted access request to the destination website server.

[0028] In the implementation process, the proxy server decrypts the access request encrypted by the client according to the second session key corresponding to the second ciphertext communication channel, audits the decrypted access request according to the predefined request auditing rule, re-encrypts the audited access request according to the first session key corresponding to the first ciphertext communication channel, and sends the re-encrypted access request to the destination website server, thereby ensuring that the access request is securely and transparently transmitted through the second ciphertext communication channel and the first ciphertext communication channel.

[0029] Further, the access response is encrypted by the destination website server, and the forwarding of the access response returned by the destination website server to the client through the second ciphertext communication channel comprises:

[0030] receiving the access response;

[0031] decrypting the access response according to the first session key corresponding to the first ciphertext communication channel;

[0032] auditing the decrypted access response according to the predefined response auditing rule;

[0033] re-encrypting the audited access response according to the second session key corresponding to the second ciphertext communication channel;

[0034] sending the re-encrypted access response to the client.

[0035] In the implementation process, the proxy server decrypts the access response encrypted by the destination website server according to the first session key corresponding to the first ciphertext communication channel, audits the decrypted access response according to the predefined response auditing rule, re-encrypts the audited access response according to the second session key corresponding to the second ciphertext communication channel, and sends the re-encrypted access response to the client, thereby ensuring that the access response is securely and transparently transmitted through the first ciphertext communication channel and the second ciphertext communication channel.

[0036] Further, before determining whether the certificate information of the destination website server matches the self-signed certificate information of any website server in the plurality of website servers, the method further comprises:

[0037] determining that the certificate information of the destination website server does not match the self-signed certificate information of each target website server in the plurality of website servers; wherein the self-signed certificate of each target website server does not support data encryption and decryption.

[0038] In the implementation process, by matching the certificate information of the target website server with the stored self-signed certificate information of each target website server that does not support data encryption and decryption by the proxy server first, and then matching the certificate information of the target website server with the stored self-signed certificate information of each target website server in the case where the certificate information of the target website server does not match the self-signed certificate information of each target website server, the certificate information of the target website server is matched with the self-signed certificate information of all website servers only when the certificate of the target website server supports data encryption and decryption, thereby ensuring the establishment of the first and second cipher communication channels.

[0039] Further, the method further comprises:

[0040] In the case where the certificate information of the target website server matches the self-signed certificate information of any target website server in the plurality of website servers, or the certificate information of the target website server does not match the self-signed certificate information of each target website server in the plurality of website servers, a first plaintext communication channel with the target website server is established, and a second plaintext communication channel with the client is established;

[0041] The access request is forwarded to the target website server through the first plaintext communication channel, and the access response is forwarded to the client through the second plaintext communication channel.

[0042] In the implementation process, by matching the certificate information of the target website server with the stored self-signed certificate information of each target website server that does not support data encryption and decryption by the proxy server first, and then matching the certificate information of the target website server with the stored self-signed certificate information of each target website server in the case where the certificate information of the target website server does not match the self-signed certificate information of each target website server, the certificate information of the target website server is matched with the self-signed certificate information of all website servers only when the certificate of the target website server supports data encryption and decryption, thereby ensuring the establishment of the first and second cipher communication channels.

[0043] In a second aspect, the embodiments of the present application provide an HTTP proxy device based on dynamic certificate, applied to a proxy server, wherein the proxy server stores self-signed certificate information of a plurality of website servers;

[0044] The device comprises:

[0045] The self-signed certificate matching module is configured to determine whether the certificate information of the target website server matches the self-signed certificate information of any target website server in the plurality of website servers in response to a first connection request initiated by the client to the target website server;

[0046] a communication connection module, configured to, if matched, establish a first cipher communication channel with the target website server according to the self-signed certificate information of the website server, and establish a second cipher communication channel with the client;

[0047] a cipher communication module, configured to forward, to the target website server through the first cipher communication channel, an access request initiated by the client to the target website server, and forward, to the client through the second cipher communication channel, an access response returned by the target website server.

[0048] In a third aspect, an electronic device is provided, which includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; the processor implements the method as described above when executing the computer program.

[0049] In a fourth aspect, a computer readable storage medium is provided, which includes a stored computer program; wherein the computer readable storage medium controls a device where the computer readable storage medium is located to execute the method as described above when the computer program runs. BRIEF DESCRIPTION OF DRAWINGS

[0050] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0051] Figure 1 a flowchart of a HTTP proxy method based on dynamic certificate provided by the first embodiment of the present application;

[0052] Figure 2 a structural diagram of a HTTP proxy device based on dynamic certificate provided by the second embodiment of the present application;

[0053] Figure 3 a structural diagram of an electronic device provided by the third embodiment of the present application. DETAILED DESCRIPTION

[0054] The technical solutions in the embodiments of the present application will be described below in combination with the drawings in the embodiments of the present application.

[0055] It should be noted that in the description of the present application, the terms "first", "second", etc. are only used for differentiation and cannot be understood as indicating or implying relative importance. At the same time, the step numbers in the text are only for the convenience of explaining the embodiments of the present application, and do not serve as the function of limiting the execution sequence of the steps.

[0056] At present, HTTP (Hypertext Transfer Protocol, HyperText Transfer Protocol) / HTTPS (Hypertext Transfer Protocol Secure, HyperText Transfer Protocol Secure) protocol is widely used to ensure data transmission security. Considering the problem of enterprise network security, enterprises usually choose to deploy proxy servers, such as Nginx (engine x, which is a high-performance HTTP and reverse proxy web server) to audit and access control the behavior of internal terminals accessing external websites.

[0057] In the related art, the stream module of Nginx is configured as follows:

[0058] stream{

[0059] server{

[0060] Listen 443; / / Nginx listens to the 443 port to receive HTTPS requests sent by the client;

[0061] proxy_pass backend_server_ip:443; / / Used to specify the IP address of the external website server and the 443 port of the external website server to forward the HTTPS request;

[0062] proxy_ssl on; / / Open the proxy SSL (Secure Socket Layer, Secure Socket Layer) function;

[0063] proxy_ssl certificate / path / to / nginx / certificate.crt; / / Configure the certificate file path for SSL encryption and decryption;

[0064] proxy_ssl_certificate_key / path / to / nginx / private.key; / / Configure the private key file path for SSL decryption;

[0065] }

[0066] }。

[0067] The Nginx HTTP proxy needs to manually configure fixed certificates and private keys. In actual application, in the process of monitoring the behavior of the internal terminal accessing the external website, the Nginx cannot obtain the private key of the external website server, cannot decrypt the access response returned by the external website server, and cannot monitor the access behavior of the external website server.

[0068] To this end, the application provides an HTTP proxy method based on dynamic certificates. The self-signed certificate information of a plurality of website servers is stored in advance in a proxy server. The proxy server responds to a first connection request initiated by a client to a target website server, determines whether the certificate information of the target website server matches the self-signed certificate information of any website server, and if so, establishes a first ciphertext communication channel with the target website server according to the self-signed certificate information of the website server, and establishes a second ciphertext communication channel with the client. The access request initiated by the client to the target website server is forwarded to the target website server through the first ciphertext communication channel, and the access response returned by the target website server is forwarded to the client through the second ciphertext communication channel. The method can flexibly adapt to different website access scenarios of the client, dynamically match the self-signed certificate information of the corresponding website server to establish the first ciphertext communication channel and the second ciphertext communication channel, and monitor the access behavior between the client and the external website server based on the first ciphertext communication channel and the second ciphertext communication channel. The method does not need to manually configure fixed certificate information, and can also monitor the access behavior of the target website server in a scenario where the private key of the target website server cannot be obtained.

[0069] The technical solutions in the embodiments of the application will be described below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, not all embodiments.

[0070] The method provided by the embodiments of the application can be executed by a related terminal device, and the following will be described by taking a proxy server as an execution subject.

[0071] Please refer to Figure 1 , Figure 1 A flowchart of an HTTP proxy method based on dynamic certificates provided by the first embodiment of the application. The first embodiment of the application provides an HTTP proxy method based on dynamic certificates, applied to a proxy server, and the proxy server stores self-signed certificate information of a plurality of website servers.

[0072] The method includes steps S101-S103:

[0073] S101, in response to a first connection request initiated by the client to the destination website server, determine whether the certificate information of the destination website server matches the self-signed certificate information of any website server in the plurality of website servers.

[0074] As an example, according to the actual application scenario, the self-signed certificate information of the plurality of website servers is collected in advance, such as the self-signed certificate information of the website server corresponding to each of the plurality of commonly used websites, and the self-signed certificate information of the plurality of website servers is stored in the proxy server.

[0075] In actual application, the self-signed certificate information of each website server includes the self-signed certificate public key of each website server and the domain name of each website server.

[0076] When the client needs to access any website, i.e., the destination website, the client inputs the instruction to connect the destination website server on the client, at which time the client generates a first connection request to the destination website server according to the instruction input by the client, and sends the first connection request to the proxy server.

[0077] After the proxy server receives the first connection request initiated by the client to the destination website server, the proxy server responds to the first connection request, obtains the certificate information of the destination website server, and matches the certificate information of the destination website server with the stored self-signed certificate information of each website server, to determine whether the certificate information of the destination website server matches the self-signed certificate information of any website server.

[0078] S102, if matched, establish a first ciphertext communication channel with the destination website server according to the self-signed certificate information of the website server, and establish a second ciphertext communication channel with the client.

[0079] As an example, when the proxy server determines that the certificate information of the destination website server matches the self-signed certificate information of any website server, it considers that the destination website is the same as the website corresponding to this website server, and since the self-signed certificate information of this website server is pre-stored, it directly establishes a first ciphertext communication channel with the destination website server according to the self-signed certificate information of this website server, and establishes a second ciphertext communication channel with the client.

[0080] In actual application, the proxy server first generates a first session key with the destination website server according to the self-signed certificate information of this website server, completes the establishment of the first ciphertext communication channel with the destination website server, and then sends the self-signed certificate information of this website server to the client, generates a second session key with the client, and completes the establishment of the second ciphertext communication channel with the client.

[0081] S103, forwarding the access request initiated by the client to the destination website server through the first cipher communication channel, and forwarding the access response returned by the destination website server to the client through the second cipher communication channel.

[0082] As an example, after the proxy server establishes the first cipher communication channel and the second cipher communication channel, the client can operate the instruction of accessing the destination website on the client, at this time, the client generates an access request according to the instruction input by the client, and sends the access request to the proxy server.

[0083] After receiving the access request initiated by the client to the destination website server, the proxy server forwards the access request to the destination website server through the first cipher communication channel, so that the destination website server can receive and process the access request, and return an access response to the proxy server.

[0084] After receiving the access response returned by the destination website server, the proxy server forwards the access response to the client through the second cipher communication channel, so that the client can determine whether to allow access to the destination website.

[0085] The embodiment of the application can pre-store the self-signed certificate information of a plurality of website servers in the proxy server, determine whether the certificate information of the destination website server matches the self-signed certificate information of any website server in response to the first connection request initiated by the client to the destination website server, if matched, establish the first cipher communication channel with the destination website server according to the self-signed certificate information of the website server, and establish the second cipher communication channel with the client, forward the access request initiated by the client to the destination website server to the destination website server through the first cipher communication channel, and forward the access response returned by the destination website server to the client through the second cipher communication channel, which can flexibly adapt to the access scenario of the client to different websites, dynamically match the self-signed certificate information of the corresponding website server to establish the first cipher communication channel and the second cipher communication channel, and monitor the access behavior between the client and the external website server based on the first cipher communication channel and the second cipher communication channel, which not only does not need to manually configure fixed certificate information, but also can realize monitoring the access behavior of the destination website server in the scenario where the private key of the destination website server cannot be obtained.

[0086] In an optional embodiment, before determining whether the certificate information of the destination website server matches the self-signed certificate information of any website server among the multiple website servers, the method further includes: generating a second connection request based on the client configuration information in the first connection request; wherein the second connection request includes the client configuration information; sending the second connection request to the destination website server, and receiving a connection response returned by the destination website server; wherein the connection response includes the certificate information of the destination website server.

[0087] As an example, after receiving a first connection request initiated by a client to a destination website server, the proxy server responds to the first connection request, extracts the client configuration information from the first connection request, and generates a second connection request including the client configuration information.

[0088] In actual applications, the client configuration information includes: the SSL / TLS (Transport Layer Security) version supported by the client, such as TLS1.0 and TLS1.2; the random number generated by the client; and the encryption suite supported by the client.

[0089] After generating the second connection request, the proxy server sends the second connection request to the destination website server, so that the destination website server can receive and process the second connection request and return a connection response to the proxy server, wherein the connection response includes the certificate information of the destination website server.

[0090] In actual applications, the certificate information of the destination website server includes the certificate public key of the destination website server, the domain name of the destination website server, and information of the certificate authority (CA).

[0091] In actual applications, the connection response also includes the destination website server configuration information, including: the SSL / TLS version supported by the destination website server; and a random number generated by the destination website server.

[0092] After receiving the connection response, the proxy server extracts the certificate information of the destination website server from the connection response, matches the certificate information of the destination website server with the self-signed certificate information of each stored website server, and determines whether the certificate information of the destination website server matches the self-signed certificate information of any website server.

[0093] The embodiment of the application can forward the client configuration information to the target website server, so that the target website server returns the certificate information of the target website server according to the client configuration information, and the certificate information of the target website server is ensured to be effectively obtained.

[0094] In an optional embodiment, the proxy server is configured with a self-signed certificate hash table, and the self-signed certificate hash table is used to store hash values corresponding to self-signed certificate information of a plurality of website servers; the determining whether the certificate information of the target website server matches the self-signed certificate information of any website server in the plurality of website servers comprises: querying whether there is a hash value identical to the target hash value in the self-signed certificate hash table; wherein the target hash value is a hash value corresponding to the certificate information of the target website server; if yes, it is determined that the certificate information of the target website server matches the self-signed certificate information of the website server corresponding to the queried hash value; otherwise, it is determined that the certificate information of the target website server does not match the self-signed certificate information of each website server in the plurality of website servers.

[0095] As an example, the self-signed certificate hash table is configured in the proxy server in advance, and the hash values corresponding to the self-signed certificate information of the plurality of website servers are stored in the self-signed certificate hash table, so that the self-signed certificate information of the plurality of website servers is stored in the proxy server.

[0096] Under this premise, after obtaining the certificate information of the target website server, the proxy server calculates a hash value corresponding to the certificate information of the target website server, i.e. a target hash value, and calls the self-signed certificate hash table to query whether there is a hash value identical to the target hash value in the self-signed certificate hash table; if yes, it is determined that the certificate information of the target website server matches the self-signed certificate information of the website server corresponding to the queried hash value; otherwise, it is determined that the certificate information of the target website server does not match the self-signed certificate information of each website server in the plurality of website servers.

[0097] The embodiment of the present application stores the hash values ​​corresponding to the self-signed certificate information of multiple website servers in a self-signed certificate hash table configured by the proxy server in advance, and the proxy server uses a hash search method to query whether there is a hash value corresponding to the certificate information of the target website server in the self-signed certificate hash table, that is, a hash value that is the same as the target hash value. According to the query result, it is determined whether the certificate information of the target website server matches the self-signed certificate information of any website server among the multiple website servers, and it can quickly and accurately determine whether the certificate information of the target website server matches the self-signed certificate information of any website server among the multiple website servers.

[0098] In an optional embodiment, the access request is encrypted by the client; the access request initiated by the client to the destination website server is forwarded to the destination website server through the first ciphertext communication channel, including: receiving the access request; decrypting the access request according to the second session key corresponding to the second ciphertext communication channel; auditing the decrypted access request according to predefined request audit rules; re-encrypting the audited access request according to the first session key corresponding to the first ciphertext communication channel; and sending the re-encrypted access request to the destination website server.

[0099] As an example, request audit rules may be predefined according to actual access monitoring requirements.

[0100] In actual applications, request audit rules include audit rules for verifying whether the identity and permissions of the requester are correct, and audit rules for auditing whether the request parameters of the request contain malicious input and sensitive data.

[0101] After monitoring the access request initiated by the client to the destination website server, the proxy server receives the access request. Since the access request is encrypted by the client according to the second session key corresponding to the second ciphertext communication channel, the proxy server decrypts the access request according to the second session key to obtain the decrypted access request.

[0102] After receiving the decrypted access request, the proxy server audits the decrypted access request according to predefined request audit rules to obtain an audited access request.

[0103] After receiving the audited access request, the proxy server re-encrypts the audited access request according to the first session key corresponding to the first ciphertext communication channel, obtains the re-encrypted access request, and sends the re-encrypted access request to the destination website server. After the destination website server receives the re-encrypted access request, it can decrypt and process the re-encrypted access request according to the first session key, and return an access response to the proxy server.

[0104] The embodiment of the application can ensure that the access request is transmitted securely and transparently through the second cipher communication channel and the first cipher communication channel.

[0105] In the optional embodiment, the access response is encrypted by the destination website server, and the forwarding of the access response returned by the destination website server to the client through the second cipher communication channel comprises: receiving the access response; decrypting the access response according to the first session key corresponding to the first cipher communication channel; auditing the decrypted access response according to the predefined response auditing rule; re-encrypting the audited access response according to the second session key corresponding to the second cipher communication channel; and sending the re-encrypted access response to the client.

[0106] For example, the response auditing rule can be predefined according to actual access monitoring requirements.

[0107] In practical applications, the response auditing rule includes an auditing rule for verifying whether the identity and authority of the response party are correct, and an auditing rule for auditing whether the return parameters of the response contain malicious input and sensitive data.

[0108] After the proxy server listens to the access response returned by the destination website server, the access response is received. Since the access response is encrypted by the destination website server according to the first session key corresponding to the first cipher communication channel, the access response is decrypted according to the first session key to obtain the decrypted access response.

[0109] After the proxy server obtains the decrypted access response, the decrypted access response is audited according to the predefined response auditing rule to obtain the audited access response.

[0110] After the proxy server obtains the audited access response, the audited access response is re-encrypted according to the second session key corresponding to the second cipher communication channel to obtain the re-encrypted access response, and the re-encrypted access response is sent to the client. Subsequently, the client receives the re-encrypted access response, and can decrypt the re-encrypted access response according to the second session key to determine whether to allow access to the destination website.

[0111] The embodiment of the application can ensure that the access response is transmitted securely and transparently through the first and second cipher communication channels by the proxy server decrypting the access response encrypted by the destination website server according to the first session key corresponding to the first cipher communication channel, auditing the decrypted access response according to the pre-defined response auditing rule, re-encrypting the audited access response according to the second session key corresponding to the second cipher communication channel, and sending the re-encrypted access response to the client.

[0112] In optional embodiments, before the step of determining whether the certificate information of the destination website server matches the self-signed certificate information of any website server in the plurality of website servers, the method further comprises the step of: determining that the certificate information of the destination website server does not match the self-signed certificate information of each target website server in the plurality of website servers; wherein the self-signed certificate of each target website server does not support data encryption and decryption.

[0113] For example, the self-signed certificate information of the plurality of website servers is collected in advance, and the website servers in the plurality of website servers whose self-signed certificates do not support data encryption and decryption are marked as target website servers.

[0114] After the proxy server obtains the certificate information of the destination website server, the proxy server matches the certificate information of the destination website server with the self-signed certificate information of each target website server, and then matches the certificate information of the destination website server with the self-signed certificate information of each website server when it is determined that the certificate information of the destination website server does not match the self-signed certificate information of each target website server, to determine whether the certificate information of the destination website server matches the self-signed certificate information of any website server.

[0115] The embodiment of the application can ensure that the first and second cipher communication channels are effectively established by the proxy server matching the certificate information of the destination website server with the stored self-signed certificate information of each target website server whose self-signed certificate does not support data encryption and decryption, and then matching the certificate information of the destination website server with the stored self-signed certificate information of each website server when it is determined that the certificate information of the destination website server does not match the self-signed certificate information of each target website server, on the premise that the certificate of the destination website server supports data encryption and decryption.

[0116] In optional embodiments, the proxy server is configured with a whitelist hash table for storing hash values corresponding to the self-signed certificate information of each target website server; and the method further comprises steps S104-S106:

[0117] S104, querying whether there is a hash value same as the target hash value in the white list hash table; wherein the target hash value is a hash value corresponding to the certificate information of the target website server;

[0118] S105, if yes, determining that the certificate information of the target website server matches the self-signed certificate information of the target website server corresponding to the queried hash value;

[0119] S106, otherwise, determining that the certificate information of the target website server does not match the self-signed certificate information of each target website server.

[0120] As an example, the white list hash table is configured in the proxy server in advance, and the hash value corresponding to the self-signed certificate information of each target website server in the plurality of website servers is stored in the white list hash table, so that the self-signed certificate information of each target website server is stored in the proxy server in a classified manner.

[0121] Under this premise, after obtaining the certificate information of the target website server, the proxy server calculates the hash value corresponding to the certificate information of the target website server, i.e. the target hash value, and calls the white list hash table to query whether there is a hash value same as the target hash value in the white list hash table. If yes, it is determined that the certificate information of the target website server matches the self-signed certificate information of the target website server corresponding to the queried hash value, otherwise it is determined that the certificate information of the target website server does not match the self-signed certificate information of each target website server, so as to continue to match the certificate information of the target website server with the self-signed certificate information of each website server to determine whether the certificate information of the target website server matches the self-signed certificate information of any website server.

[0122] The embodiment of the application can store the hash value corresponding to the self-signed certificate information of each target website server in the white list hash table configured in the proxy server in advance, and the proxy server uses the hash lookup method to query whether there is a hash value same as the target hash value corresponding to the certificate information of the target website server in the white list hash table. According to the query result, it is determined whether the certificate information of the target website server matches the self-signed certificate information of any target website server in the plurality of website servers, which can quickly and accurately determine whether the certificate information of the target website server matches the self-signed certificate information of any target website server in the plurality of website servers.

[0123] In an optional embodiment, the method further comprises steps S107-S108:

[0124] S107, in a case where it is determined that the certificate information of the destination website server matches the self-signed certificate information of any target website server in the plurality of website servers, or the certificate information of the destination website server does not match the self-signed certificate information of each website server in the plurality of website servers, establishing a first plaintext communication channel with the destination website server, and establishing a second plaintext communication channel with the client;

[0125] S108, forwarding the access request to the destination website server through the first plaintext communication channel, and forwarding the access response to the client through the second plaintext communication channel.

[0126] As an example, in a case where it is determined that the certificate information of the destination website server matches the self-signed certificate information of any target website server in the plurality of website servers, or the certificate information of the destination website server does not match the self-signed certificate information of each website server in the plurality of website servers, the proxy server considers that the communication data between the client and the destination website server does not need to be encrypted and decrypted, and at this time, directly establishes a first plaintext communication channel with the destination website server, and establishes a second plaintext communication channel with the client.

[0127] After the proxy server establishes the first plaintext communication channel and the second plaintext communication channel, the client can operate to input an instruction to access the destination website on the client, at which time the client generates an access request for the destination website server according to the instruction input by the client, and sends the access request to the proxy server.

[0128] After the proxy server receives the access request initiated by the client for the destination website server, the proxy server forwards the access request to the destination website server through the first plaintext communication channel, so that the destination website server can receive and process the access request, and return an access response for the access request to the proxy server.

[0129] After the proxy server receives the access response returned by the destination website server, the proxy server forwards the access response to the client through the second plaintext communication channel, so that the client can determine whether to allow access to the destination website.

[0130] The embodiments of the present application can monitor the access behavior between the client and the external website server based on the first plaintext communication channel and the second plaintext communication channel by directly establishing a first plaintext communication channel with the destination website server and establishing a second plaintext communication channel with the client in a case where it is determined that the certificate information of the destination website server matches the self-signed certificate information of any target website server in the plurality of website servers, or the certificate information of the destination website server does not match the self-signed certificate information of each website server in the plurality of website servers, so that the access behavior of the destination website server can be monitored in a scenario without data encryption and decryption.

[0131] To more clearly illustrate the HTTP proxy method based on dynamic certificates provided in the first embodiment of the present application, the specific process of the proxy server applying the method is as follows:

[0132] 1. The system is enabled and initialized to read the self-signed certificate information of multiple website servers, cache the hash value corresponding to the self-signed certificate information of each website server into the self-signed certificate hash table configured by the proxy server, and cache the hash value corresponding to the self-signed certificate information of each target website server in the multiple website servers into the whitelist hash table configured by the proxy server.

[0133] 2. Configure transparent proxy and specify the proxy port.

[0134] 3. The proxy configuration takes effect, the configuration file is changed in the background, and the proxy server reloads the configuration file.

[0135] 4. The proxy server listens on the proxy port. When it receives the first connection request initiated by the client to the destination website server, it extracts the client configuration information from the first connection request, that is, the client hello information. This information includes the SSL / TLS version supported by the client, the random number generated by the client (Client Random), and the cipher suites supported by the client. The proxy server generates a second connection request including this information and sends the second connection request to the destination website server.

[0136] 5. The proxy server listens on the proxy port. When receiving a connection response from the destination website server, it extracts the destination website server configuration information from the connection response. The destination website server configuration information includes the SSL / TLS version supported by the destination website server, a random number generated by the destination website server, and the destination website server's certificate information. The destination website server's certificate information includes the certificate's public key and other related information, such as the destination website server's domain name and information about the certificate authority (CA).

[0137] 6. The proxy server calculates the hash value corresponding to the certificate information of the destination website server, that is, the target hash value, such as the hash value corresponding to the domain name of the destination website server, and queries the whitelist hash table for a hash value identical to the target hash value. If the target hash value is not in the whitelist hash table, the proxy server continues to query the self-signed certificate hash table for a hash value identical to the target hash value. If the target hash value is in the self-signed certificate hash table, the proxy server completes the SSL connection with the destination website server, establishes the first ciphertext communication channel, and sends the matching website server's certificate information to the client, including the certificate, random number, and supported SSL / TLS version, to complete the SSL connection with the client and establish the second ciphertext communication channel.

[0138] 7、The proxy server listens to the proxy port, when receiving the access request initiated by the client to the destination website server, since the access request is encrypted by the second session key corresponding to the second ciphertext communication channel according to the client, the access request is decrypted according to the second session key, the decrypted access request is audited according to the predefined request auditing rule, the audited access request is re-encrypted according to the first session key corresponding to the first ciphertext communication channel, and the re-encrypted access request is sent to the destination website server.

[0139] 8、The proxy server listens to the proxy port, when receiving the access response returned by the destination website server, since the access response is encrypted by the first session key corresponding to the first ciphertext communication channel according to the destination website server, the access response is decrypted according to the first session key corresponding to the first ciphertext communication channel, the decrypted access response is audited according to the predefined response auditing rule, the audited access response is re-encrypted according to the second session key corresponding to the second ciphertext communication channel, and the re-encrypted access response is sent to the client.

[0140] Please refer to Figure 2 , Figure 2 The structure schematic diagram of an HTTP proxy device based on dynamic certificate provided by the second embodiment of the application. The second embodiment of the application provides an HTTP proxy device based on dynamic certificate, applied to a proxy server, and the proxy server stores self-signed certificate information of multiple website servers; the device comprises: a self-signed certificate matching module 201, configured to determine whether the certificate information of a destination website server matches the self-signed certificate information of any website server in the multiple website servers in response to a first connection request initiated by a client to the destination website server; a communication connection module 202, configured to establish a first ciphertext communication channel with the destination website server and a second ciphertext communication channel with the client according to the self-signed certificate information of the website server if the certificate information matches; and a ciphertext communication module 203, configured to forward an access request initiated by the client to the destination website server to the destination website server through the first ciphertext communication channel, and forward an access response returned by the destination website server to the client through the second ciphertext communication channel.

[0141] In an optional embodiment, the self-signed certificate matching module 201 is further configured to generate a second connection request according to the client configuration information in the first connection request before determining whether the certificate information of the destination website server matches the self-signed certificate information of any website server in the plurality of website servers; wherein the second connection request comprises the client configuration information; send the second connection request to the destination website server, and receive a connection response returned by the destination website server; wherein the connection response comprises the certificate information of the destination website server.

[0142] In an optional embodiment, the proxy server is configured with a self-signed certificate hash table for storing hash values corresponding to the self-signed certificate information of the plurality of website servers; and the determination of whether the certificate information of the destination website server matches the self-signed certificate information of any website server in the plurality of website servers comprises: querying the self-signed certificate hash table to determine whether there is a hash value identical to the target hash value; wherein the target hash value is a hash value corresponding to the certificate information of the destination website server; if there is, it is determined that the certificate information of the destination website server matches the self-signed certificate information of the website server corresponding to the queried hash value; otherwise, it is determined that the certificate information of the destination website server does not match the self-signed certificate information of each website server in the plurality of website servers.

[0143] In an optional embodiment, the access request is encrypted by the client; and the forwarding of the access request initiated by the client to the destination website server through the first ciphertext communication channel comprises: receiving the access request; decrypting the access request according to the second session key corresponding to the second ciphertext communication channel; auditing the decrypted access request according to the pre-defined request auditing rule; re-encrypting the audited access request according to the first session key corresponding to the first ciphertext communication channel; and sending the re-encrypted access request to the destination website server.

[0144] In an optional embodiment, the access response is encrypted by the destination website server; and the forwarding of the access response returned by the destination website server to the client through the second ciphertext communication channel comprises: receiving the access response; decrypting the access response according to the first session key corresponding to the first ciphertext communication channel; auditing the decrypted access response according to the pre-defined response auditing rule; re-encrypting the audited access response according to the second session key corresponding to the second ciphertext communication channel; and sending the re-encrypted access response to the client.

[0145] In an optional embodiment, the self-signed certificate matching module 201 is further configured to determine that the certificate information of the target website server does not match the self-signed certificate information of the target website server before determining whether the certificate information of the destination website server matches the self-signed certificate information of any of the plurality of website servers, wherein the self-signed certificate of the target website server does not support data encryption and decryption.

[0146] In an optional embodiment, the apparatus further includes a plaintext communication module, the communication connection module 202 is further configured to, in a case where it is determined that the certificate information of the destination website server matches the self-signed certificate information of the target website server, or the certificate information of the destination website server does not match the self-signed certificate information of each of the plurality of website servers, establish a first plaintext communication channel with the destination website server and a second plaintext communication channel with the client, and the plaintext communication module is configured to forward the access request to the destination website server through the first plaintext communication channel and forward the access response to the client through the second plaintext communication channel.

[0147] The implementation process of the functions and effects of each module in the above apparatus is specifically described in the implementation process of the corresponding steps in the method of the first embodiment of the present application, which will not be described here.

[0148] Please refer to Figure 3 , Figure 3 A structural schematic diagram of an electronic device is provided for the third embodiment of the present application. The third embodiment of the present application provides an electronic device 30, which includes a processor 301, a memory 302, and a computer program stored in the memory 302 and configured to be executed by the processor 301; the processor 301 implements the method described in the first embodiment of the present application when executing the computer program, and can achieve the same beneficial effects.

[0149] The processor 301 can implement the method of any embodiment included in the method described in the first embodiment of the present application by reading the computer program from the memory 302 through the bus 303 and executing the computer program.

[0150] The processor 301 can process digital signals and can include various computing structures. For example, a complex instruction set computer structure, a reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, the processor 301 can be a microprocessor.

[0151] The memory 302 can be used to store instructions executed by the processor 301 or data related to the instructions during execution. The instructions and / or data can include code for implementing some or all of the functions of one or more modules described in the embodiments of the present application. The processor 301 of the embodiments of the present disclosure can be used to execute the instructions in the memory 302 to implement the method as described in the first embodiment of the present application. The memory 302 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory well known to those skilled in the art.

[0152] The fourth embodiment of the present application provides a computer readable storage medium, which includes a stored computer program; wherein the computer readable storage medium controls the device where the computer readable storage medium is located to execute the method as described in the first embodiment of the present application when the computer program runs, and can achieve the same beneficial effects.

[0153] The method described in the first embodiment of the present application can be implemented by software, hardware, firmware or any combination thereof, in whole or in part. When implemented by software, it can be implemented in the form of a computer program product in whole or in part. The computer program product includes one or more computer programs or instructions. When the computer programs or instructions are loaded and executed on a computer, the processes or functions described in the embodiments of the present application are executed in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user equipment, a core network device, an OAM (Open Application Model) or other programmable devices.

[0154] The computer programs or instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another, for example, the computer programs or instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired or wireless manner. The computer readable storage medium can be any available medium accessible by a computer or a data storage device such as a server, data center and the like integrated with one or more available media. The available media can be a magnetic medium, such as a floppy disk, a hard disk, a magnetic tape; an optical medium, such as a digital video disc; a semiconductor medium, such as a solid state disk. The computer readable storage medium can be a volatile or non-volatile storage medium, or can include both volatile and non-volatile storage media.

[0155] To sum up, the embodiment of the present application provides a dynamic certificate-based HTTP proxy method, device, equipment and medium. The dynamic certificate-based HTTP proxy method is applied to a proxy server, and the proxy server stores self-signed certificate information of a plurality of website servers. The method comprises the following steps: in response to a first connection request initiated by a client to a target website server, determining whether the certificate information of the target website server matches the self-signed certificate information of any website server in the plurality of website servers; if the certificate information matches, establishing a first cipher communication channel with the target website server and a second cipher communication channel with the client according to the self-signed certificate information of the website server; forwarding an access request initiated by the client to the target website server to the target website server through the first cipher communication channel, and forwarding an access response returned by the target website server to the client through the second cipher communication channel. The embodiment of the present application can flexibly adapt to the access scenarios of different websites by the client, dynamically match the self-signed certificate information of the corresponding website server to establish the first cipher communication channel and the second cipher communication channel, and monitor the access behavior between the client and the external website server based on the first cipher communication channel and the second cipher communication channel. Therefore, it is not necessary to manually configure fixed certificate information, and the access behavior of the target website server can be monitored even in the scenario where the private key of the target website server cannot be obtained.

[0156] In several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can also be implemented by other manners. The apparatus embodiments described above are merely illustrative, for example, the flowcharts and block diagrams in the drawings show the possible implementation architecture, function and operation of the apparatus, method and computer program product according to the embodiments of the present application. In this regard, each block in the flowchart or block diagram can represent a module, a program segment or a part of code, which contains one or more executable instructions for implementing the specified logic function. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in different orders from those described in the drawings. For example, two consecutive blocks can actually be executed substantially in parallel, and they can also be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and the combination of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system for executing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0157] In addition, the functional modules in the embodiments of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0158] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application can be embodied in the form of a software product, and the computer software product is stored in a storage medium, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0159] The above merely provides specific implementation manners of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical range disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A dynamic certificate based Hyper Text Transfer Protocol (HTTP) proxy method, comprising: The application is applied to a proxy server which stores self-signed certificate information of multiple website servers; The method comprises: In response to a first connection request initiated by a client to a target website server, requesting the target website server to return certificate information of the target website server; Determining whether the certificate information matches the self-signed certificate information of any target website server in the multiple website servers, and in the case that the certificate information does not match the self-signed certificate information of each target website server in the multiple website servers, determining whether the certificate information matches the self-signed certificate information of any website server in the multiple website servers; wherein the self-signed certificate of each target website server does not support data encryption and decryption; If the certificate information matches the self-signed certificate information of the website server, a first cipher communication channel with the target website server is established according to the self-signed certificate information of the website server, and a second cipher communication channel with the client is established; According to the second session key corresponding to the second cipher communication channel, the access request initiated by the client to the target website server is decrypted; wherein the access request is encrypted by the client; According to the first session key corresponding to the first cipher communication channel, the decrypted access request is re-encrypted, and the re-encrypted access request is sent to the target website server; According to the first session key, the access response returned by the target website server is decrypted; wherein the access response is encrypted by the target website server; According to the second session key, the decrypted access response is re-encrypted, and the re-encrypted access response is sent to the client; If the certificate information matches the self-signed certificate information of the target website server, or the certificate information does not match the self-signed certificate information of each website server, a first plaintext communication channel with the target website server is established, and a second plaintext communication channel with the client is established; The access request is forwarded to the target website server through the first plaintext communication channel, and the access response is forwarded to the client through the second plaintext communication channel.

2. The method of claim 1, wherein, The request for the target website server to return the certificate information of the target website server comprises: According to the client configuration information in the first connection request, a second connection request is generated; wherein the second connection request comprises the client configuration information; The second connection request is sent to the target website server, and a connection response returned by the target website server is received; wherein the connection response comprises the certificate information of the target website server.

3. The method of claim 1, wherein, The proxy server is configured with a self-signed certificate hash table for storing hash values corresponding to the self-signed certificate information of the multiple website servers; The determination of whether the certificate information of the target website server matches the self-signed certificate information of any website server in the multiple website servers comprises: querying whether there is a same hash value as the target hash value in the self-signed certificate hash table; wherein the target hash value is a hash value corresponding to certificate information of the destination website server; if there is, determining that the certificate information of the destination website server matches the self-signed certificate information of the website server corresponding to the queried hash value; otherwise, determining that the certificate information of the destination website server does not match the self-signed certificate information of each website server in the plurality of website servers.

4. The method of claim 1, wherein, Before re-encrypting the decrypted access request according to the first session key corresponding to the first ciphertext communication channel, the method further comprises: auditing the decrypted access request according to a predefined request auditing rule.

5. The method of claim 1, wherein, Before re-encrypting the decrypted access response according to the second session key, the method further comprises: auditing the decrypted access response according to a predefined response auditing rule.

6. A dynamic certificate-based HTTP proxy apparatus characterized by comprising: The application is applied to a proxy server, and the proxy server stores self-signed certificate information of a plurality of website servers. The device comprises: a self-signed certificate matching module configured to, in response to a first connection request initiated by a client to a destination website server, request the destination website server to return certificate information of the destination website server; determine whether the certificate information matches self-signed certificate information of any target website server in the plurality of website servers, and in a case where it is determined that the certificate information does not match the self-signed certificate information of each target website server in the plurality of website servers, determine whether the certificate information matches self-signed certificate information of any website server in the plurality of website servers; wherein the self-signed certificate of each target website server does not support data encryption and decryption; a communication connection module configured to, if the certificate information matches the self-signed certificate information of the website server, establish a first ciphertext communication channel with the destination website server according to the self-signed certificate information of the website server, and establish a second ciphertext communication channel with the client; a ciphertext communication module configured to, according to a second session key corresponding to the second ciphertext communication channel, decrypt an access request initiated by the client to the destination website server; wherein the access request is encrypted by the client; re-encrypt the decrypted access request according to a first session key corresponding to the first ciphertext communication channel, and send the re-encrypted access request to the destination website server; decrypt an access response returned by the destination website server according to the first session key; wherein the access response is encrypted by the destination website server; re-encrypt the decrypted access response according to the second session key, and send the re-encrypted access response to the client; The communication connection module is further configured to, if the certificate information matches the self-signed certificate information of the target website server or the certificate information does not match the self-signed certificate information of each website server, establish a first plain text communication channel with the target website server and a second plain text communication channel with the client. The plain text communication module is configured to forward the access request to the target website server through the first plain text communication channel and forward the access response to the client through the second plain text communication channel.

7. An electronic device, comprising: A computer program product comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; the processor executes the computer program to implement the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium comprises a stored computer program; wherein the computer readable storage medium controls the device where the computer readable storage medium is located to execute the method according to any one of claims 1 to 5 when the computer program runs.

Images