A method for obtaining a network quintuple from an ssl object

Abstract

The application relates to a method for obtaining a network five-tuple from an SSL object, belonging to the field of computer network communication, which comprises the following steps: when a client initiates an SSL connection request, hijacking a read system call function, an SSL_read function, an SSL_write function and an SSL_accept function, obtaining a PID, a TGID and an FD in the hijacked read system call; performing address matching operation on the return address of a function call stack in a user state context and the address of the SSL_accept function, judging whether the SSL_accept is called in the current user state context; if yes, indicating that the current read call is a handshake operation in communication; matching the PID and the TGID obtained from the read system call with information in the SSL_accept; creating a relationship mapping table to store the corresponding relationship between the PID, the TGID, an FD and an SSL object; hijacking an SSL_read function call; hijacking an SSL_write function call; obtaining a corresponding socket structure body by using the FD; and extracting network five-tuple information.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer network communication, in particular to a method for obtaining network quintuple from SSL object. BACKGROUND

[0002] Obtaining the corresponding network quintuple information in HTTPS encrypted traffic and HTTP plaintext traffic is important data support for traffic monitoring and analysis.

[0003] Network quintuple is a professional term in computer network communication, which includes source IP address, source port number, destination IP address, destination port number and transport layer protocol (for example, TCP protocol and UDP protocol). HTTP protocol is an unencrypted traffic in network communication. HTTP becomes HTTPS, an encrypted traffic, after being encrypted by SSL / TLS encryption toolkit. SSL / TLS is a standardized data encryption protocol that protects the confidentiality and integrity of data. OpenSSL is an encryption communication suite that is implemented and widely used to comply with the SSL / TLS protocol standard. SSL object is a structure created by OpenSSL toolkit during runtime, which stores relevant information during encrypted communication, including but not limited to encryption data key, file descriptor FD (identifier for read-write operation) and BIO object. BIO object is a collection of input and output operations for processing underlying data stream in OpenSSL encryption communication suite. If encryption function in OpenSSL is used, the data stream input and output by BIO is encrypted, otherwise, the data stream input and output by BIO is unencrypted. BIO is an important component of SSL / TLS communication.

[0004] In order to obtain the corresponding network quintuple information in HTTPS encrypted traffic for monitoring and analysis, the following two methods are used in the prior art:

[0005] (1) Obtaining quintuple information based on network layer and transport layer to parse data packet

[0006] Based on network layer and transport layer to parse data packet, source address and destination address in IP header, source port, destination port and protocol number in TCP header are extracted according to TCP / IP protocol, so as to obtain network quintuple information, as shown in Figure 1

[0007] ​The method has the following defects: although the network quintuple information can be obtained, the plaintext data of the HTTPS encrypted traffic cannot be obtained. Specifically, the network quintuple information in the IP header and the TCP header is extracted according to the TCP / IP protocol, but the HTTP plaintext data before HTTPS encryption and the HTTP plaintext data after HTTPS decryption cannot be obtained. Although the network quintuple information can be obtained and has a certain monitoring capability, the HTTP plaintext data cannot be obtained, and the security monitoring and analysis of the traffic cannot be completely satisfied.

[0008] (2) Obtaining HTTP plaintext data and network quintuple information based on hijacking key functions of OpenSSL encryption communication suite

[0009] The running process of the network service is injected into the running process of the network service, and the SSL object and the HTTP plaintext data stream corresponding to the HTTPS before encryption or after decryption are obtained from the hijacked two function parameters by hijacking the SSL_read / SSL_write two key functions. The BIO object in the SSL object structure, and the NUM field in the BIO object structure stores the value of the file descriptor FD (the identifier of the read-write operation), and whether it is a socket type is judged by type, if it is, the function call is continued, and the network socket information can be obtained from the file descriptor FD, and the network quintuple is obtained by continuing to call the function from the network socket, as shown in the following formula: Figure 2

[0010] The method has the following defects: the method can be applied to the Ngnix open source application, but cannot be applied to the Apache2 widely used open source application. Specifically, the method of obtaining HTTP plaintext data and network quintuple information based on hijacking key functions of OpenSSL encryption communication suite can be applied to part of the open source application. For example, in Apache2, the SSL object is obtained from the two hijacked function parameters by hijacking the SSL_read / SSL_write two key functions in the OpenSSL encryption communication suite, the BIO object is obtained from the structure of the SSL object, and the NUM field (storing the identifier of the read-write operation of the file descriptor) is obtained from the BIO object. The value of NUM is always 0, and it does not belong to the network socket type, so the network quintuple information cannot be obtained. SUMMARY

[0011] The purpose of the present application is to solve at least one of the above technical defects.

[0012] To this end, the purpose of the present application is to provide a method for obtaining network quintuple from SSL object, which can indirectly obtain the correct file descriptor FD from the SSL object, and can be applied to Nginx application and Apache2 open source application.​

[0013] To achieve the above object, the embodiment of one aspect of the present application provides a method for obtaining network quintuple from SSL object, comprising the following steps:

[0014] S1, when the client initiates an SSL connection request is monitored, the read system call function of operating system, SSL_read function, SSL_write function, SSL_accept function in OpenSSL encryption communication suite are function hijacked, when the Apache2 service and the client initiating connection have network connection, the current thread PID, process TGID, file descriptor FD are obtained in the hijacked read system call;

[0015] S2, the return address of function call stack in user state context and the address matching operation to SSL_accept function address are traced back, whether the current user state context has called to SSL_accept function is judged, if yes, step S3 is executed;

[0016] S3, if there is a call to SSL_accept function, it indicates that the current read call is a handshake operation in a communication, and the current thread PID, process TGID and SSL object in SSL_accept function in user state context are recorded;

[0017] S4, the current thread PID and process TGID obtained from read system call are matched with the information recorded in SSL_accept before, to ensure that the information is consistent, belonging to the same session context;

[0018] S5, the corresponding relationship between current thread PID and process TGID and file descriptor FD, SSL object is stored in the relationship mapping table;

[0019] S6, the SSL_read function call is hijacked, the current PID, TGID and SSL object information are recorded, and the HTTP plaintext stream of read operation is obtained;

[0020] S7, the SSL_write function call is hijacked, the current PID, TGID and SSL object information are recorded, and the HTTP plaintext stream before write operation is obtained;

[0021] S8, according to the relationship mapping table, the corresponding socket structure is obtained by using file descriptor FD, and the information of socket connection is extracted from socket structure;

[0022] S9, the network quintuple information is extracted from socket structure, and the network quintuple information includes source IP, source port, target IP, target port and protocol type.

[0023] Further, in the S1, the SSL_accept function is hijacked, including: hijacking at the SSL_accept entry to obtain the PID of the current process, the thread TGID and the memory address of the SSL object.

[0024] Further, in the S1, the read system call function of the operating system is hijacked, including: hijacking at the kernel read system call entry to obtain the PID of the current process, the thread TGID and the file descriptor FD.

[0025] Further, in the S4, if the current thread PID and the process TGID obtained in the hijacked SSL_accept function and the hijacked read system call in the same call stack are consistent, the current thread PID, the process TGID, the file descriptor FD and the SSL object are bound and associated, the file descriptor FD and the SSL object are associated through the current thread PID and the process TGID, and the association of the SSL object and the correct file descriptor FD is realized.

[0026] Further, in the S5, the relationship mapping table is used to find related information in SSL read and write operations.

[0027] Further, in the S7, the uprobe tool is used to hijack the SSL_write function call.

[0028] Further, the method is suitable for Nginx application programs and Apache2 application programs.

[0029] Compared with the prior art, the method has the advantages and beneficial effects that:

[0030] 1. The method can indirectly obtain the correct file descriptor FD from the SSL object by stack backtracking and stack matching.

[0031] 2. The method can be applied to Nginx but cannot be applied to Apache2 based on the method of obtaining HTTP plaintext data and network quintuple information by hijacking the key function of the OpenSSL encryption communication suite, and the method can be applied to both Nginx and Apache2.

[0032] 3. The method can obtain network quintuple information while obtaining HTTP plaintext data in encrypted communication in the widely used open source Apache2 application program, and can be used for security monitoring and analysis of traffic, and plays a crucial role in network service stability and data security of enterprises.

[0033] Additional aspects and advantages of the application will be set forth in part in the description which follows, and in part will become apparent to those skilled in the art upon examination of the following and the attendant drawings or can be learned by practice of the application. BRIEF DESCRIPTION OF DRAWINGS

[0034] The foregoing and / or additional aspects and advantages of the application are achieved by providing what is described below.

[0035] Figure 1 Architecture diagram of the prior art method for obtaining five-tuple information based on network layer and transport layer parsing data packets;

[0036] Figure 2 Architecture diagram of the prior art method for obtaining HTTP plaintext data and network five-tuple information based on hijacking OpenSSL encryption communication suite key functions;

[0037] Figure 3 Flow chart of the method for obtaining network five-tuple from SSL objects according to the embodiment of the application;

[0038] Figure 4 Architecture diagram of the method for obtaining HTTP plaintext data and network five-tuple information based on hijacking two key functions in OpenSSL encryption communication suite and stack backtracking and stack matching according to the embodiment of the application;

[0039] Figure 5 Specific implementation diagram of the method for obtaining HTTP plaintext data and network five-tuple information based on hijacking two key functions in OpenSSL encryption communication suite and stack backtracking and stack matching according to the embodiment of the application. DETAILED DESCRIPTION

[0040] Embodiments of the present application are described in detail below with reference to the attached drawings. The embodiments of the present application are shown in the drawings as follows, in which the same or similar components are denoted by the same or similar reference numerals throughout. The embodiments described below are exemplary and are intended to explain the present application, and should not be understood as limiting the present application.

[0041] The application provides a method for obtaining network quintuple from an SSL object, and relates to a method for obtaining network quintuple from encrypted communication on a terminal. The application is improved on the basis of a method for obtaining HTTP plaintext data and network quintuple information based on hijacking two key functions in an OpenSSL encrypted communication suite, and the improvement point is that a method for obtaining HTTP plaintext data and network quintuple information based on hijacking key functions in the OpenSSL encrypted communication suite and stack backtracking and stack matching is proposed by reverse engineering, i.e. a method for obtaining HTTP plaintext data and network quintuple information based on hijacking key functions in the OpenSSL encrypted communication suite and stack backtracking and stack matching. The method of the application can realize obtaining the value of a real file descriptor FD from an SSL object, thereby obtaining network quintuple information, solves the problem that the value of a correct file descriptor FD cannot be directly obtained from an SSL object in a traditional Apache2, and overcomes the deficiency of a traditional method that cannot simultaneously obtain HTTP plaintext data and associated network quintuple information in HTTPS encrypted traffic from the Apache2 application. The method of the application can be applied not only to the Nginx application program, but also to the widely used Apache2 open source application program.

[0042] As shown in Figure 3 The method for obtaining network quintuple from an SSL object provided by the application embodiment comprises the following steps:

[0043] S1, when a client initiates an SSL connection request, the read system call function of an operating system, the SSL_read function, the SSL_write function and the SSL_accept function in the OpenSSL encrypted communication suite are hijacked, and the current thread PID, process TGID and file descriptor FD are obtained in the hijacked read system call when the Apache2 service has a network connection with the client initiating the connection.

[0044] Specifically, referring to Figure 5 , first, a client connection request is listened to. After the server program is started, a client connection request is listened to on a specified port, and the client initiates an SSL connection. This is the starting point of the entire SSL communication, and it is necessary to ensure that the port is correctly opened and has appropriate permissions.

[0045] When a client initiates an SSL connection request, the read system call function of an operating system, the SSL_read function, the SSL_write function and the SSL_accept function in the OpenSSL encrypted communication suite are hijacked.

[0046] The SSL_accept function is hijacked, including: hijacking at the SSL_accept entrance, thereby obtaining the PID of the current process, the thread TGID and the memory address of the SSL object.

[0047] Hijack the read system call function of the operating system, including hijacking at the kernel read system call entry, obtaining the current process PID, thread TGID and file descriptor FD. The system call is a key point in the SSL_accept process.

[0048] When the Apache2 service has a network connection with the client initiating the connection, obtain the current thread PID, process TGID, and file descriptor FD in the hijacked read system call.

[0049] S2, backtracking the return address of the function call stack in the user mode context and address matching operation to the SSL_accept function address, to determine whether there is a call to the SSL_accept function in the current user mode context, if so, execute step S3.

[0050] S3, if there is a call to the SSL_accept function, it indicates that the current read call is a handshake operation in a communication, and records the current thread PID, process TGID and SSL object obtained in the SSL_accept function in the user mode context.

[0051] This step performs stack backtracking check: obtain the complete call stack information at the read system call, and analyze whether it contains SSL_accept call. This step is used to verify and ensure that the current read call indeed comes from the SSL handshake process.

[0052] S4, verify PID / TGID information: match the current thread PID and process TGID obtained from the read system call with the information recorded in SSL_accept previously, to ensure that they belong to the same session context.

[0053] This step performs stack matching: if the current thread PID and process TGID obtained in the hijacked SSL_accept function and the hijacked read system call in the same call stack are consistent, bind and associate the current thread PID, process TGID, file descriptor FD and SSL object, to achieve the purpose of associating file descriptor FD and SSL object through current thread PID and process TGID, and further realize the association of SSL object and correct file descriptor FD, and finally correctly obtain the network five tuple information.

[0054] Reference Figure 4, and address matching is performed between the return address of the function call stack in the user mode context (i.e. stack backtracking) and the address of the SSL_accept function (i.e. stack matching) to determine whether the SSL_accept function is called in the current user mode context, and if the SSL_accept function is called, it is indicated that the current read call is a handshake operation in a communication, and the three elements of the current thread PID, process TGID and SSL object in the SSL_accept function in the user mode context are recorded.

[0055] S5, a relationship mapping table is created to store the correspondence between the current thread PID and process TGID and the file descriptor FD and SSL object. The relationship mapping table is used for quickly searching for related information in SSL read and write operations.

[0056] S6, hijacking the SSL_read function: hijacking the SSL_read function call, recording the current PID, TGID and SSL object information, and obtaining the HTTP plaintext stream of the read operation.

[0057] S7, hijacking the SSL_write function: hijacking the SSL_write function call, recording the current PID, TGID and SSL object information, and obtaining the HTTP plaintext stream before the write operation.

[0058] In this step, the uprobe tool is used to hijack the SSL_write function call.

[0059] S8, obtaining socket connection information: according to the relationship mapping table, the file descriptor FD is used to obtain the corresponding socket structure, and the detailed information of the socket connection is extracted from the socket structure.

[0060] S9, collecting network five-tuple: extracting network five-tuple information from the socket structure. The network five-tuple information includes source IP, source port, target IP, target port and protocol type. The above information completely describes the network characteristics of the SSL connection.

[0061] In summary, the application associates the SSL object and the correct file descriptor FD by the method of stack backtracking and stack matching, in the Nginx process, the file descriptor FD can be directly obtained through the BIO object in the SSL object structure, the file descriptor FD in the BIO object structure, and then it is judged whether the file descriptor FD is the network socket type, if yes, the network quintuple information can be obtained through the file descriptor FD. However, in the Apache2, the value of the file descriptor FD obtained directly through the SSL object is 0, and it is not the network socket type, so the network quintuple cannot be obtained. In order to solve the above problems, the method of the application realizes the association of the SSL object and the file descriptor FD in the read system call through the stack backtracking and stack matching technology, and finally the network quintuple information is correctly obtained.

[0062] The method of the application improves the method of obtaining the HTTP plaintext data and the network quintuple information based on hijacking the key function of the OpenSSL encryption communication suite, proposes the technology method of stack backtracking and stack matching, realizes the indirect obtaining of the correct file descriptor FD when the file descriptor obtained directly from the SSL object is 0, and finally the network quintuple information is obtained. The method of the application is suitable for Nginx application programs and Apache2 application programs

[0063] In the description of the present specification, the description of the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" and the like means that the specific features, structures, materials or characteristics described in combination with the embodiment or example are included in at least one embodiment or example of the present application. In the present specification, the illustrative description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0064] It is not difficult for those skilled in the art to understand that the present application includes any combination of the above description of the summary and the specific embodiment part and the parts shown in the drawings, and the schemes formed by these combinations are not described one by one due to the length and to make the specification brief. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

[0065] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present application, and those skilled in the art can make changes, modifications, replacements and variations to the above embodiments without departing from the principles and purposes of the present application within the scope of the present application. The scope of the present application is defined by the appended claims and their equivalents.

Claims

1. A method for obtaining a network quintuple from an SSL object, characterized in that, Includes the following steps: S1. When a client initiates an SSL connection request, the system hijacks the operating system's read system call function, the SSL_read function, the SSL_write function, and the SSL_accept function in the OpenSSL encryption communication suite. When the Apache2 service has a network connection with the client initiating the connection, the hijacked read system call obtains the current thread PID, process TGID, and file descriptor FD. S2, backtrack the return address of the function call stack in the user-mode context and perform an address matching operation to the address of the SSL_accept function to determine whether the SSL_accept function has been called in the current user-mode context. If so, proceed to step S3. S3, if the SSL_accept function is called, it means that the current read call is a handshake operation in a communication, and the current thread PID, process TGID and SSL object obtained in the SSL_accept function in the user-mode context are recorded; S4, the current thread PID and process TGID obtained from the read system call are matched with the information previously recorded in SSL_accept to ensure that the information is consistent and belongs to the same session context; S5, create a relational mapping table to store the correspondence between the current thread PID and process TGID and file descriptors FD and SSL objects; S6, hijack the SSL_read function call, record the current PID, TGID and SSL object information, and obtain the HTTP plaintext stream of the read operation; S7, hijacks the SSL_write function call, records the current PID, TGID and SSL object information, and obtains the HTTP plaintext stream before the write operation; S8. According to the relationship mapping table, the corresponding socket structure is obtained by using the file descriptor FD, and the socket connection information is extracted from the socket structure. S9. Extract network 5-tuple information from the socket structure. The network 5-tuple information includes: source IP, source port, destination IP, destination port, and protocol type.

2. The method for obtaining a network quintuple from an SSL object according to claim 1, characterized in that, In S1, hijacking the SSL_accept function includes: hijacking the SSL_accept entry point to obtain the current process's PID, thread TGID, and the memory address of the SSL object.

3. The method for obtaining a network quintuple from an SSL object according to claim 1, characterized in that, In S1, the operating system's read system call function is hijacked, including hijacking at the kernel read system call entry point to obtain the current process's PID, thread TGID, and file descriptor FD.

4. The method for obtaining a network quintuple from an SSL object according to claim 1, characterized in that, In S4, if the current thread PID and process TGID are the same in the hijacked SSL_accept function and the hijacked read system call, which are in the same call stack, then the four elements of the current thread PID, process TGID, file descriptor FD and SSL object are bound and associated. This achieves the purpose of associating the file descriptor FD and SSL object through the current thread PID and process TGID, and thus achieves the association between the SSL object and the correct file descriptor FD.

5. The method for obtaining a network quintuple from an SSL object according to claim 1, characterized in that, In step S5, the relationship mapping table is used to look up relevant information during SSL read and write operations.

6. The method for obtaining a network quintuple from an SSL object according to claim 1, characterized in that, In S7, the uprobe tool is used to hijack the SSL_write function call.

7. The method for obtaining a network quintuple from an SSL object according to claim 1, characterized in that, The method is applicable to both Nginx and Apache2 applications.

Images