Proxy traffic encryption system, method and device

Abstract

The embodiment of the invention discloses a proxy traffic encryption system, method and device. In the embodiment of the invention, the proxy traffic encryption system comprises a proxy client, a content distribution network server and a proxy server, wherein the proxy client is used for acquiring a public key of an ECH handshake key from the DOH server through a proxy domain name, encrypting a domain name in a TLS handshake data packet by using the public key, and sending the encrypted TLS handshake data packet to the content distribution network server; the content distribution network server is used for receiving the encrypted TLS handshake data packet and a private key of the ECH handshake key sent by the DOH server, and decrypting the TLS handshake data packet by using the private key of the ECH handshake key; and the proxy server is used for receiving the random value sent by the client and the encrypted target information, and decrypting the encrypted target information according to the random value to obtain the target information. Through the system, the proxy traffic can be effectively encrypted, and the communication security is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and more particularly, to a system, method and device for encrypting proxy traffic. Background Art

[0002] In the Internet environment, network security threats are becoming increasingly severe. Privacy protection and data security have become one of the most concerned issues for users and enterprises. When users or enterprises use proxy services, they hope to enhance the privacy and security of communications to protect personal information and business data from being leaked or tampered with.

[0003] In the existing technology, when using traditional SOCKS5 proxy technology, the initial handshake process uses plain text transmission, which is easy to be identified and analyzed, which will increase the risk of data leakage. Moreover, during the data transmission process after a successful handshake, the distinguishing characteristics between SOCKS5 proxy traffic and business traffic are also more obvious. As a result, SOCKS5 proxy traffic is easily identified by network devices and intercepted, tampered with or blocked by middlemen, resulting in poor communication security.

[0004] To sum up, how to effectively encrypt proxy traffic and improve communication security is a problem that needs to be solved at present. Summary of the Invention

[0005] In view of this, an embodiment of the present invention provides a system, method and device for proxy traffic encryption. The proxy traffic encryption system composed of a proxy client, a content distribution network server and a proxy server can effectively encrypt the proxy traffic and improve the security of communication.

[0006] In a first aspect, an embodiment of the present invention provides a system for encrypting proxy traffic, the system comprising: a proxy client, a content distribution network server and a proxy server; wherein the proxy client is used to obtain the public key of the encrypted client greeting ECH handshake key from the DOH server through the proxy domain name, use the public key in the ECH handshake key to encrypt the domain name in the transport layer security TLS handshake data packet, and send the encrypted TLS handshake data packet to the content distribution network server, the proxy client is also used to generate a random value and send it to the proxy server, encrypt the target information by the random value, send the encrypted target information to the proxy server, and send the encrypted traffic data generated after encryption to the proxy server; the content distribution network server is used to receive the The encrypted TLS handshake data packet and the private key of the ECH handshake key sent by the DOH server are used to decrypt the TLS handshake data packet using the private key of the ECH handshake key to obtain the target domain name. In response to the target domain name being a proxy domain name, a TLS handshake is established with the proxy server, and a two-way link is established with the proxy server. The proxy server is used to receive the random value and the encrypted target information sent by the client, decrypt the encrypted target information according to the random value, obtain the target information, and shake hands with the target server corresponding to the target information. In response to a successful handshake, the proxy server receives the encrypted traffic data sent by the proxy client through the content distribution network server, wherein the encrypted traffic data is doubly encrypted by TLS and the random value.

[0007] In a second aspect, an embodiment of the present invention provides a method for encrypting proxy traffic, the method comprising: obtaining a public key of an encrypted client greeting ECH handshake key; using the public key of the ECH handshake key to encrypt a domain name in a transport layer security TLS handshake data packet to generate an encrypted TLS handshake data packet; and sending the encrypted TLS handshake data packet, wherein the encrypted TLS handshake data packet is used to perform a handshake with a content distribution network server.

[0008] Optionally, the method further includes: generating a random value, wherein the random value is used for data encryption; and sending the random value.

[0009] Optionally, the method further includes: encrypting the target information according to the random value to generate encrypted target information, wherein the target information represents information corresponding to the target server to be accessed by the proxy client; and sending the encrypted target information.

[0010] Optionally, the method further includes: acquiring traffic data; encrypting the traffic data according to the random value to generate encrypted traffic data; and sending the encrypted traffic data.

[0011] Optionally, the method further includes: obtaining a proxy request, wherein the proxy request includes target information; and performing an initial handshake and authentication with the user terminal according to a set proxy protocol.

[0012] In a third aspect, an embodiment of the present invention provides a method for encrypting proxy traffic, the method comprising: receiving a private key of an encrypted client greeting ECH handshake key, and an encrypted TLS handshake data packet; decrypting the TLS handshake data packet using the private key of the ECH handshake key to obtain a decrypted TLS handshake data packet; determining a target domain name based on the decrypted TLS handshake data packet; in response to the target domain name being a proxy domain name, establishing a TLS handshake with a proxy server corresponding to the proxy domain name, and establishing a two-way link with the proxy server.

[0013] Optionally, the method further includes: in response to the target domain name being a business domain name, establishing a TLS handshake with a business server according to the business domain name, and establishing a bidirectional link with the business server.

[0014] Optionally, the bidirectional link includes a TLS link and a websocket link.

[0015] In a fourth aspect, an embodiment of the present invention provides a method for encrypting proxy traffic, the method comprising: receiving a decrypted TLS handshake data packet; shaking hands with a content distribution network server according to the decrypted TLS handshake data packet, and establishing a bidirectional link with the content distribution network server.

[0016] Optionally, the method further includes: receiving a random value sent by the client and encrypted target information, wherein the target information represents information corresponding to the target server to be accessed by the proxy client; decrypting the encrypted target information according to the random value to obtain the target information; and shaking hands with the target server corresponding to the target information according to the target information.

[0017] Optionally, the method further includes: in response to a successful handshake, receiving encrypted traffic data, wherein the encrypted traffic data is doubly encrypted by TLS and the random value.

[0018] In a fifth aspect, an embodiment of the present invention provides a device for encrypting proxy traffic, the device comprising:

[0019] A first obtaining unit is configured to obtain a public key for encrypting a client hello ECH handshake key;

[0020] A generating unit, configured to encrypt the domain name in a transport layer security (TLS) handshake data packet using the public key of the ECH handshake key to generate an encrypted TLS handshake data packet;

[0021] The sending unit is configured to send the encrypted TLS handshake data packet, wherein the encrypted TLS handshake data packet is used to perform a handshake with a content distribution network server.

[0022] Optionally, the generating unit is further used to: generate a random value, wherein the random value is used for data encryption; the sending unit is further used to: send the random value.

[0023] Optionally, the generating unit is further used to: encrypt the target information according to the random value to generate encrypted target information, wherein the target information represents the information corresponding to the target server to be accessed by the proxy client; the sending unit is further used to: send the encrypted target information.

[0024] Optionally, the first acquisition unit is further used to acquire traffic data; the generation unit is further used to encrypt the traffic data according to the random value to generate encrypted traffic data; and the sending unit is further used to send the encrypted traffic data.

[0025] Optionally, the first acquisition unit is further configured to acquire a proxy request, wherein the proxy request includes target information; the apparatus further comprises a processing unit configured to perform an initial handshake and authentication with the user terminal according to a set proxy protocol.

[0026] In a sixth aspect, an embodiment of the present invention provides a device for encrypting proxy traffic, the device comprising: a first receiving unit, for receiving a private key of an encrypted client greeting ECH handshake key, and an encrypted TLS handshake data packet; a second acquisition unit, for decrypting the TLS handshake data packet using the private key of the ECH handshake key to obtain a target domain name; a first processing unit, in response to the target domain name being a proxy domain name, for establishing a TLS handshake with a proxy server based on the proxy domain name, and establishing a two-way link with the proxy server.

[0027] Optionally, the first processing unit is further configured to: in response to the target domain name being a business domain name, establish a TLS handshake with a business server according to the business domain name, and establish a bidirectional link with the business server.

[0028] Optionally, the bidirectional link includes a TLS link and a websocket link.

[0029] In a seventh aspect, an embodiment of the present invention provides a device for encrypting proxy traffic, the device comprising:

[0030] A second receiving unit is used to receive the decrypted TLS handshake data packet;

[0031] The second processing unit is configured to shake hands with a content delivery network server according to the decrypted TLS handshake data packet and establish a bidirectional link with the content delivery network server.

[0032] Optionally, the second receiving unit is also used to: receive a random value sent by the client, and encrypted target information, wherein the target information represents information corresponding to the target server to be accessed by the proxy client; the device also includes a third acquisition unit, used to decrypt the encrypted target information according to the random value to obtain the target information; the second processing unit is also used to shake hands with the corresponding target server based on the target information.

[0033] Optionally, the second receiving unit is further used to: receive encrypted traffic data in response to a successful handshake, wherein the encrypted traffic data is doubly encrypted by TLS and the random value.

[0034] In the eighth aspect, an embodiment of the present invention provides an electronic device, comprising a memory and a processor, the memory being used to store one or more computer program instructions, wherein the one or more computer program instructions are executed by the processor to implement a method as described in any one of the second aspect, any possibility of the second aspect, the third aspect, any possibility of the third aspect, the fourth aspect, and any possibility of the fourth aspect.

[0035] In the ninth aspect, an embodiment of the present invention provides a computer-readable storage medium on which computer program instructions are stored, and when the computer program instructions are executed by a processor, they implement a method as described in any one of the second aspect, any possibility of the second aspect, the third aspect, any possibility of the third aspect, the fourth aspect, and any possibility of the fourth aspect.

[0036] In an embodiment of the present invention, a system for proxy traffic encryption includes: a proxy client, a content distribution network server, and a proxy server; wherein the proxy client is used to obtain a public key of an encrypted client hello ECH handshake key from a DOH server through a proxy domain name, encrypt a domain name in a transport layer security TLS handshake data packet using the public key in the ECH handshake key, and send the encrypted TLS handshake data packet to the content distribution network server; the proxy client is further used to generate a random value and send it to the proxy server, encrypt target information using the random value, send the encrypted target information to the proxy server, and send the encrypted traffic data generated after encryption to the proxy server; the content distribution network server is used to receive the encrypted TLS The TLS handshake packet and the private key of the ECH handshake key sent by the DOH server are used to decrypt the TLS handshake packet, obtain the target domain name, and in response to the target domain name being a proxy domain name, establish a TLS handshake with the proxy server and establish a two-way link with the proxy server; the proxy server is used to receive the random value and the encrypted target information sent by the client, decrypt the encrypted target information according to the random value, obtain the target information, and handshake with the target server corresponding to the target information. In response to a successful handshake, the encrypted traffic data sent by the proxy client through the content distribution network server is received, wherein the encrypted traffic data is doubly encrypted by TLS and the random value. Through the above system, proxy traffic can be effectively encrypted to improve the security of communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The above and other objects, features and advantages of the present invention will become more apparent through the following description of the embodiments of the present invention with reference to the accompanying drawings, in which:

[0038] Figure 1 This is a schematic diagram of a system for proxy traffic encryption according to an embodiment of the present invention;

[0039] Figure 2 This is a schematic diagram of another complete communication system for proxy traffic encryption according to an embodiment of the present invention;

[0040] Figure 3 This is a flow chart of a method for encrypting proxy traffic in an embodiment of the present invention;

[0041] Figure 4 This is a flow chart of another method for encrypting proxy traffic in an embodiment of the present invention;

[0042] Figure 5 This is a flow chart of another method for encrypting proxy traffic in an embodiment of the present invention;

[0043] Figure 6 This is a flow chart of another method for encrypting proxy traffic in an embodiment of the present invention;

[0044] Figure 7 This is a flow chart of a method for encrypting proxy traffic in an embodiment of the present invention;

[0045] Figure 8 This is a flow chart of another method for encrypting proxy traffic in an embodiment of the present invention;

[0046] Figure 9 This is a flow chart of another method for encrypting proxy traffic in an embodiment of the present invention;

[0047] Figure 10 This is a flow chart of another method for encrypting proxy traffic in an embodiment of the present invention;

[0048] Figure 11 This is a flow chart of a method for encrypting proxy traffic in an embodiment of the present invention;

[0049] Figure 12 Schematic diagram of a proxy traffic encryption device according to an embodiment of the present invention;

[0050] Figure 13 is a schematic diagram of another device for proxy traffic encryption according to an embodiment of the present invention;

[0051] Figure 14 Schematic diagram of another device for encrypting proxy traffic according to an embodiment of the present invention;

[0052] Figure 15 is a schematic diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0053] The present application is described below based on the following embodiments, but the present application is not limited to these embodiments. In the detailed description of the present application below, certain specific details are described in detail. Those skilled in the art can fully understand the present application without the description of these details. To avoid obscuring the essence of the present application, well-known methods, processes, procedures, components, and circuits are not described in detail.

[0054] Furthermore, persons of ordinary skill in the art will appreciate that the figures provided herein are for illustration purposes only and are not necessarily drawn to scale.

[0055] Unless the context clearly requires otherwise, words like “include”, “comprising” and the like throughout this application should be interpreted as including rather than exclusive or exhaustive; that is, as meaning “including but not limited to”.

[0056] In the description of this application, it should be understood that the terms "first", "second", etc. are used for descriptive purposes only and should not be understood to indicate or imply relative importance. In addition, in the description of this application, unless otherwise specified, "plurality" means two or more.

[0057] In the prior art, SOCKS5 proxy technology is a specific implementation of the SOCKS5 proxy protocol. The SOCKS5 proxy protocol provides standards and specifications for SOCKS5 proxy technology. The SOCKS5 proxy protocol, referred to as SOCKS5 proxy for short, is a universal proxy protocol that supports multiple network protocols and authentication methods. It is used for clients to communicate with target servers through SOCKS5 proxy servers, wherein the SOCKS5 proxy server is the specific carrier of the SOCKS5 proxy protocol. When using traditional SOCKS5 proxy technology, the initial handshake process uses plain text transmission, which is easy to be identified and analyzed, which will increase the risk of data leakage. Moreover, during the data transmission process after a successful handshake, the difference between the data packet structure of SOCKS5 proxy traffic and business traffic is also more obvious. As a result, SOCKS5 proxy traffic is easily identified by network devices and subjected to man-in-the-middle attacks (MIMT), specifically including interception, tampering or blocking, that is, the attacker inserts himself between the two communicating parties, intercepts and may tamper with or block the communication content, resulting in poor communication security.

[0058] For example, in the scenario of remote office in enterprises, more and more enterprises support remote office for employees. At this time, they need to access the internal network of the enterprise through a proxy server. The SOCKS5 proxy used in the existing technology adopts plain text transmission in the initial handshake process. The employee's login credentials and sensitive data are transmitted in the form of SOCKS5 proxy traffic during the transmission process. The SOCKS5 proxy traffic is quite different from other normal business traffic and is easy to be distinguished, which increases the risk of being identified and analyzed. In addition, scenarios such as confidential access across network segments also have higher security requirements. In the existing technology, commonly used proxy protocols such as Cisco AnyConnect and IPsec also have the problem that proxy traffic is easy to be identified, resulting in low communication security. Therefore, how to effectively encrypt proxy traffic and improve communication security is a problem that needs to be solved at present.

[0059] In order to solve the above problems, in the embodiment of the present invention, a proxy traffic encryption system is proposed to effectively encrypt the proxy traffic. Figure 1As shown, the system includes: a proxy client 101, a content distribution network server 102 and a proxy server 103; specifically, the proxy client 101 is used to obtain the public key of the encrypted client hello ECH handshake key from the DOH server through the proxy domain name, use the public key in the ECH handshake key to encrypt the domain name in the transport layer security TLS handshake data packet, and send the encrypted TLS handshake data packet to the content distribution network server. The proxy client is also used to generate a random value and send it to the proxy server, encrypt the target information with the random value, send the encrypted target information to the proxy server, and send the encrypted traffic data generated after encryption to the proxy server; the content distribution network server 102 is used to receive the encrypted T The LS handshake data packet and the private key of the ECH handshake key sent by the DOH server are used to decrypt the TLS handshake data packet using the private key of the ECH handshake key to obtain the target domain name, and in response to the target domain name being a proxy domain name, a TLS handshake is established with the proxy server, and a two-way link is established with the proxy server; the proxy server 103 is used to receive the random value and the encrypted target information sent by the client, decrypt the encrypted target information according to the random value, obtain the target information, and shake hands with the target server corresponding to the target information. In response to a successful handshake, the encrypted traffic data sent by the proxy client through the content distribution network server is received, wherein the encrypted traffic data is doubly encrypted by TLS and the random value.

[0060] In a possible implementation, in the Figure 1 Based on this, a whole communication system with proxy traffic encryption is proposed. Figure 2 As shown, the system includes: a user terminal 201, a proxy traffic encryption system 202 and a target server 203, wherein the proxy traffic encryption system 202 includes a proxy client, a content distribution network server and a proxy server 103; the user terminal 201 sends a proxy request to the proxy traffic encryption system 202, which is encrypted by the proxy traffic encryption system 202 and then forwarded to the target server 203 for access.

[0061] The proxy client, the content distribution network server and the proxy server are described in detail below through three specific embodiments. Specific embodiment 1:

[0063] The proxy client is an important part of the proxy traffic encryption system. When the proxy traffic encryption system is used as the execution subject, the flowchart of the method for proxy traffic encryption is as follows: Figure 3 As shown, including the following:

[0064] Step S301: Obtain the public key for encrypting the client hello ECH handshake key.

[0065] Specifically, the proxy client is a Socks5 proxy client with a corresponding proxy domain name. The proxy client uses HTTPS-based DNS (DNS-over-HTTPS, DOH) information of the proxy domain name, where the DNS represents the Domain Name System (Domain Name System). Specifically, the DOH is a network protocol that encrypts DNS queries through HTTPS to enhance privacy and security and prevent DNS queries from being intercepted or tampered with.

[0066] In one possible implementation, the proxy client sends the DOH information to the DOH server to request or update the public key of the Encrypted Client Hello (ECH) handshake key, where the ECH is an extension of the Transport Layer Security (TLS) protocol designed to enhance privacy protection of Internet connections.

[0067] Step S302: Encrypt the domain name in the transport layer security (TLS) handshake data packet using the public key of the ECH handshake key to generate an encrypted TLS handshake data packet.

[0068] Specifically, the proxy client uses the public key of the ECH handshake key to encrypt the domain name in the TLS handshake data packet, puts the encrypted domain name into the extension field of the TLS handshake data packet, and generates an encrypted TLS handshake data packet, thereby protecting the domain name from being spied on by middlemen.

[0069] Step S303: Send the encrypted TLS handshake data packet.

[0070] Specifically, the encrypted TLS handshake data packet is used to perform a handshake with a content delivery network server, wherein the handshake refers to establishing a secure connection between the proxy client and the CDN server to confirm identity and negotiate communication parameters.

[0071] In a possible implementation, the proxy client sends the encrypted TLS handshake data packet to a content delivery network (CDN) server, and establishes a TLS handshake with the CDN server through the encrypted TLS handshake data packet to enhance the security of the link.

[0072] In the embodiment of the present invention, after step S303, other steps are also included, specifically as follows: Figure 4 As shown, the method further includes:

[0073] Step S304: Generate a random value.

[0074] Specifically, the random value is used for data encryption.

[0075] In one possible implementation, the proxy client generates a string of random values and generates an encryption key based on the random values to encrypt the subsequently transmitted data. After the data is encrypted with the encryption key, even if the CDN server is successfully attacked by a man-in-the-middle attack, the real proxy traffic cannot be obtained.

[0076] Step S305: Send the random value.

[0077] Specifically, the proxy client sends the random value to the proxy server.

[0078] Step S306: Encrypt the target information according to the random value to generate encrypted target information.

[0079] Specifically, the target information represents information corresponding to the target server that the proxy client wants to access.

[0080] Specifically, the proxy client obtains the target information by parsing the Socks5 protocol, encrypts the target information by using the encryption key generated by the random value, and generates the encrypted target information.

[0081] Step S307: Send the encrypted target information.

[0082] Specifically, the proxy client sends the encrypted target information to the proxy server, and performs a Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) handshake with the proxy server through the target information.

[0083] In a possible implementation, after step S307, after the handshake between the proxy client and the proxy server is completed, other steps are further included, specifically as follows: Figure 5 As shown, including the following:

[0084] Step S308: Obtain traffic data.

[0085] Specifically, the proxy client obtains the traffic data to be transmitted from the user terminal. The traffic data may also be referred to as a traffic data packet or a proxy data packet, which is determined according to actual conditions.

[0086] Step S309: Encrypt the traffic data according to the random value to generate encrypted traffic data.

[0087] Specifically, the proxy client encrypts the traffic data using an encryption key generated by the random value to generate encrypted traffic data.

[0088] Step S310: Send the encrypted traffic data.

[0089] Specifically, the proxy client sends encrypted traffic data to the proxy server through the CDN server. After completing the transmission of the encrypted traffic data, the proxy client is disconnected from the proxy server.

[0090] In a possible implementation, before step S301, other steps are included, specifically: Figure 6 As shown, including the following:

[0091] Step S311: Obtain a proxy request.

[0092] Specifically, the proxy request includes target information.

[0093] In a possible implementation, the listening TCP port of the proxy client receives a proxy request sent by the user terminal.

[0094] Step S312: Perform initial handshake and authentication with the client according to the set proxy protocol.

[0095] Specifically, the proxy client performs an initial handshake and authentication with the user terminal according to the Socks5 protocol to ensure the legitimacy of the proxy request. Specific embodiment 2:

[0097] The content delivery network CDN server is a transit in the proxy traffic encryption system. When the content delivery network server is used as the execution subject, the flowchart of the method for proxy traffic encryption is as follows: Figure 7 As shown, including the following:

[0098] Step S701: Receive the private key of the encrypted client hello ECH handshake key and the encrypted TLS handshake data packet.

[0099] Specifically, after the CDN server establishes a TLS handshake with the proxy client, the CDN server receives an encrypted TLS handshake data packet.

[0100] Step S702: Decrypt the TLS handshake data packet using the private key of the ECH handshake key to obtain a decrypted TLS handshake data packet.

[0101] Step S703: Determine the target domain name according to the decrypted TLS handshake data packet.

[0102] Specifically, the target domain name may be an agent domain name or a business domain name.

[0103] Step S704: In response to the target domain name being a proxy domain name, establish a TLS handshake with a proxy server corresponding to the proxy domain name, and establish a bidirectional link with the proxy server.

[0104] Specifically, the bidirectional link includes a TLS link and a websocket link.

[0105] In a possible implementation, the proxy domain name is pre-bound in the proxy server, the domain name certificate is configured, and the CDN server that supports ECH is connected.

[0106] In a possible implementation, after step S703, other steps are further included, specifically as follows: Figure 8 As shown, including the following:

[0107] Step S705: In response to the target domain name being a business domain name, establish a TLS handshake with the business server according to the business domain name, and establish a bidirectional link with the business server.

[0108] In an embodiment of the present invention, a business domain name is pre-bound in a business server, a domain name certificate is configured, and a CDN server that supports ECH is connected. Since the domain name in the TLS extension in the TLS handshake data packet is encrypted by the public key of the ECH handshake key, only the CDN server that knows the private key of the ECH handshake key can decrypt it and obtain the domain name. The middleman cannot identify the domain name in the TLS extension, and subsequently cannot determine whether the traffic is business traffic or proxy traffic, thereby ensuring the security of communication. Specific embodiment three,

[0110] When the proxy server is the execution subject, the flowchart of the method for encrypting proxy traffic is as follows: Figure 9 As shown, including the following:

[0111] Step S901: Receive the decrypted TLS handshake data packet.

[0112] Specifically, the proxy server receives the decrypted TLS handshake data packet sent by the CDN server.

[0113] Step S902: Shake hands with the content delivery network server according to the decrypted TLS handshake data packet, and establish a bidirectional link with the content delivery network server.

[0114] In a possible implementation, after step S902, other steps are further included, specifically as follows: Figure 10 As shown, including the following:

[0115] Step S903: Receive the random value sent by the client and the encrypted target information.

[0116] Specifically, the target information represents information corresponding to a target server to be accessed by the proxy client, wherein the target server may also be referred to as an intranet server.

[0117] Step S904: decrypt the encrypted target information according to the random value to obtain the target information.

[0118] Step S905: Handshake with the corresponding target server according to the target information.

[0119] Step S906: In response to the handshake being successful, receiving encrypted traffic data.

[0120] The encrypted traffic data is doubly encrypted using TLS and the random value.

[0121] In a possible implementation, after completing data transmission, the proxy server disconnects from the proxy client.

[0122] In the embodiment of the present invention, the overall processing flow is described in detail below through a complete embodiment. The overall processing flow includes a user end, a proxy client, a CDN server, a proxy server and a target server. Figure 11 The details are as follows:

[0123] Step S1101: Send a Socks5 proxy request.

[0124] Step S1102: Receive the Socks5 proxy request.

[0125] Step S1103: perform initial handshake and authentication with the user terminal according to the Socks5 protocol, and obtain target information.

[0126] Step S1104: In response to compliance with the Socks5 protocol and passing authentication, the public key of the ECH handshake key is obtained or updated through the DOH of the proxy domain name.

[0127] In a possible implementation, if the Socks5 protocol is not complied with or the authentication fails, the proxy client is disconnected from the user terminal.

[0128] Step S1105: Encrypt the real domain name of the TLS handshake packet using the public key of the ECH handshake key and put it into the TLS extension field.

[0129] Step S1106: Send the encrypted TLS handshake packet.

[0130] Step S1107: Perform a TLS handshake with the proxy client using ECH.

[0131] Step S1108: In response to the handshake being successful, the TLS extension field is decrypted using the private key of the ECH handshake key to determine that the domain name in the TLS extension is a proxy domain name.

[0132] In one possible implementation, in response to a handshake failure, step S1105 is re-executed. If the handshake failure exceeds a set number, for example, the handshake failure exceeds 10 times or more, the CDN server disconnects the proxy client.

[0133] Step S1109: Send the decrypted TLS handshake packet.

[0134] Step S1110: Establish a TLS handshake with the CDN server, and establish a TLS and websocket bidirectional connection.

[0135] Step S1111: Generate a random value.

[0136] Step S1112: forward the random value to the proxy server via the CDN server.

[0137] Step S1113: Determine whether the random value complies with the set rules and generate a unique encryption key through the set algorithm.

[0138] In a possible implementation, if the proxy server determines that the random value does not comply with a set rule, the proxy server disconnects the connection.

[0139] Step S1114: Generate a unique encryption key by setting an algorithm, and encrypt the target information obtained by parsing the Socks5 protocol using the encryption key to generate encrypted target information.

[0140] Step S1115: forward the encrypted target information to the proxy server via the CDN server.

[0141] Step S1116: decrypt the encrypted target information to determine the target information.

[0142] Step S1117: Send a TCP / UDP handshake data packet.

[0143] Step S1118: Handshake successful.

[0144] In a possible implementation, in response to a handshake failure or a decryption failure, the proxy server disconnects the connection.

[0145] Step S1119: Send traffic data packet.

[0146] Step S1120: Generate a proxy traffic data packet and perform double encryption using TLS and a unique encryption key.

[0147] Step S1121: forward the proxy traffic data packet to the proxy server through the CDN server.

[0148] Step S1122: decrypt the proxy traffic data packet to obtain proxy traffic data.

[0149] Step S1123: Send proxy traffic data.

[0150] Step S1124: Receive proxy traffic data.

[0151] Step S1125: Send a disconnect instruction.

[0152] Specifically, the disconnect instruction is used to disconnect the connection between the proxy client and the proxy server.

[0153] In the embodiment of the present invention, by introducing ECH, the public key encryption is performed on the initial handshake between the proxy client and the CDN server, so that the real domain name is not exposed in the traffic data packet. The traffic data packet cannot be distinguished from the proxy traffic and business traffic by the middleman during the transmission process. In addition, a randomly generated dynamic key mechanism is adopted when transmitting the proxy traffic data, and a new encryption key is generated at each connection, which improves the security of data transmission. Even if the CDN server is controlled by a malicious middleman, the real proxy traffic data cannot be obtained, and the middleman cannot identify and attack the proxy traffic.

[0154] In an embodiment of the present invention, a device for encrypting proxy traffic is provided, such as Figure 12 As shown, it specifically includes: a first acquisition unit 1201, a generation unit 1202 and a sending unit 1203; wherein, the first acquisition unit 1201 is used to obtain the public key of the encrypted client greeting ECH handshake key; the generation unit 1202 is used to use the public key of the ECH handshake key to encrypt the domain name in the transport layer security TLS handshake data packet to generate an encrypted TLS handshake data packet; the sending unit 1203 is used to send the encrypted TLS handshake data packet, wherein the encrypted TLS handshake data packet is used to shake hands with the content distribution network server.

[0155] Furthermore, the generating unit is further configured to generate a random value, wherein the random value is used for data encryption; and the sending unit is further configured to send the random value.

[0156] Furthermore, the generating unit is further used to: encrypt the target information according to the random value to generate encrypted target information, wherein the target information represents the information corresponding to the target server to be accessed by the proxy client; and the sending unit is further used to: send the encrypted target information.

[0157] Furthermore, the first acquisition unit is further used to acquire traffic data; the generation unit is further used to encrypt the traffic data according to the random value to generate encrypted traffic data; and the sending unit is further used to send the encrypted traffic data.

[0158] Furthermore, the first acquisition unit is further configured to acquire a proxy request, wherein the proxy request includes target information; the apparatus further comprises a processing unit configured to perform an initial handshake and authentication with the user terminal according to a set proxy protocol.

[0159] In an embodiment of the present invention, a device for encrypting proxy traffic is provided, such as Figure 13 As shown, it specifically includes: a first receiving unit 1301, a second obtaining unit 1302 and a first processing unit 1303, wherein the first receiving unit 1301 is used to receive the private key of the encrypted client greeting ECH handshake key and the encrypted TLS handshake data packet; the second obtaining unit 1302 is used to use the private key of the ECH handshake key to decrypt the TLS handshake data packet to obtain the target domain name; the first processing unit 1303, in response to the target domain name being a proxy domain name, is used to establish a TLS handshake with the proxy server according to the proxy domain name, and establish a two-way link with the proxy server.

[0160] Furthermore, the first processing unit is further configured to: in response to the target domain name being a business domain name, establish a TLS handshake with a business server according to the business domain name, and establish a bidirectional link with the business server.

[0161] Furthermore, the bidirectional link includes a TLS link and a websocket link.

[0162] In an embodiment of the present invention, a device for encrypting proxy traffic is provided, such as Figure 14 As shown, it specifically includes: a second receiving unit 1401 and a second processing unit 1402, wherein the second receiving unit 1401 is used to receive the decrypted TLS handshake data packet; the second processing unit 1402 is used to shake hands with the content distribution network server according to the decrypted TLS handshake data packet, and establish a two-way link with the content distribution network server.

[0163] Furthermore, the second receiving unit is also used to: receive a random value sent by the client and encrypted target information, wherein the target information represents information corresponding to the target server to be accessed by the proxy client; the device also includes a third acquisition unit, used to decrypt the encrypted target information according to the random value to obtain the target information; the second processing unit is also used to shake hands with the corresponding target server based on the target information.

[0164] Furthermore, the second receiving unit is further configured to: in response to a successful handshake, receive encrypted traffic data, wherein the encrypted traffic data is doubly encrypted by TLS and the random value.

[0165] Figure 15 Schematic diagram of the structure of the electronic device in the embodiment of the present invention. Figure 15 As shown, it includes a general computer hardware structure, which includes at least a processor 1501 and a memory 1502. The processor 1501 and the memory 1502 are connected via a bus 1503. The memory 1502 is suitable for storing instructions or programs executable by the processor 1501. The processor 1501 can be a standalone microprocessor or a collection of one or more microprocessors. Thus, the processor 1501 executes the instructions stored in the memory 1502, thereby executing the method flow of the embodiment of the present invention described above to process data and control other devices. The bus 1503 connects the above-mentioned multiple components together, and also connects the above-mentioned components to the display controller 1504 and the display device and the input / output (I / O) device 1505. The input / output (I / O) device 1505 can be a mouse, keyboard, modem, network interface, touch input device, somatosensory input device, printer, and other devices known in the art. Typically, the input / output device 1505 is connected to the system via an input / output (I / O) controller 1506.

[0166] Among them, the instructions stored in the memory 1502 are executed by at least one processor 1501 to implement: obtaining the public key of the encrypted client greeting ECH handshake key; using the public key of the ECH handshake key to encrypt the domain name in the transport layer security TLS handshake data packet to generate an encrypted TLS handshake data packet; sending the encrypted TLS handshake data packet, wherein the encrypted TLS handshake data packet is used to shake hands with the content distribution network server.

[0167] Specifically, the electronic device includes: one or more processors 1501 and a memory 1502, Figure 15 Take a processor 1501 as an example. The processor 1501 and the memory 1502 may be connected via a bus or other means. Figure 15In this example, a bus connection is used. Memory 1502, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer executable programs, and modules. Processor 1501 executes the non-volatile software programs, instructions, and modules stored in memory 1502 to perform various functional applications and data processing of the device, thereby implementing the aforementioned method for determining proxy traffic encryption.

[0168] The memory 1502 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store a list of options, etc. In addition, the memory 1502 may include a high-speed random access memory and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 1502 may optionally include a memory remotely located relative to the processor 1501, and these remote memories may be connected to an external device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0169] One or more modules are stored in the memory 1502 and, when executed by one or more processors 1501 , perform the proxy traffic encryption method in any of the above method embodiments.

[0170] As will be appreciated by those skilled in the art, various aspects of embodiments of the present invention may be implemented as systems, methods, or computer program products. Thus, various aspects of embodiments of the present invention may take the form of a complete hardware implementation, a complete software implementation (including firmware, resident software, microcode, etc.), or an implementation combining software aspects with hardware aspects, which may all be generally referred to herein as a "circuit," "module," or "system." Additionally, various aspects of embodiments of the present invention may take the form of a computer program product implemented in one or more computer-readable media having computer-readable program code implemented thereon.

[0171] Any combination of one or more computer-readable media can be utilized. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or apparatus, or any suitable combination thereof. More specific examples (non-exhaustive enumeration) of computer-readable storage media will include the following: an electrical connection with one or more wires, a portable computer floppy disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the context of an embodiment of the present invention, a computer-readable storage medium can be any tangible medium that can contain or store a program used by an instruction execution system, device, or apparatus, or a program used in conjunction with an instruction execution system, device, or apparatus.

[0172] A computer-readable signal medium may include a propagated digital signal having computer-readable program code embodied therein, such as in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including, but not limited to, electromagnetic, optical, or any suitable combination thereof. A computer-readable signal medium may be any computer-readable medium that is not a computer-readable storage medium and that can communicate, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or apparatus.

[0173] Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0174] The computer program code for performing the operations for various aspects of the embodiments of the present invention can be written in any combination of one or more programming languages, including object-oriented programming languages such as Java, Smalltalk, C++, etc., and conventional procedural programming languages such as "C" programming language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer as a stand-alone software package; partially on the user's computer and partially on a remote computer; or entirely on a remote computer or server. In the latter case, the remote computer can be connected to the user's computer through any type of network including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0175] The flowchart legends and / or block diagrams of the methods, devices (systems) and computer program products according to embodiments of the present invention described above describe various aspects of embodiments of the present invention. It will be understood that each block of the flowchart legends and / or block diagrams and the combination of blocks in the flowchart legends and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a machine so that the instructions (executed by the processor of the computer or other programmable data processing device) create a device for implementing the function / action specified in the flowchart and / or block diagram block or block.

[0176] These computer program instructions may also be stored in a computer-readable medium that can direct a computer, other programmable data processing device, or other apparatus to operate in a particular manner, so that the instructions stored in the computer-readable medium produce an article of manufacture that includes instructions for implementing the functions / actions specified in the flowchart and / or block diagram blocks or blocks.

[0177] The computer program instructions may also be loaded onto a computer, other programmable data processing device or other apparatus to cause a series of operable steps to be performed on the computer, other programmable device or other apparatus to produce a computer-implemented process, such that the instructions executed on the computer or other programmable device provide a process for implementing the functions / actions specified in the flowchart and / or block diagram block or blocks.

[0178] The foregoing is merely a preferred embodiment of the present application and is not intended to limit the present application. Persons skilled in the art will readily appreciate that various modifications and variations are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present application are intended to be within the scope of protection of the present application.

[0179] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation portals for users to choose to authorize or refuse. The user's refusal to process personal information other than the necessary information for basic functions will not affect the user's use of basic functions.

Claims

1. A system for encrypting proxy traffic, characterized in that: The system comprises: Proxy clients, content delivery network servers, and proxy servers; The proxy client is used to obtain the public key of the encrypted client hello ECH handshake key from the DOH server through the proxy domain name, use the public key in the ECH handshake key to encrypt the domain name in the transport layer security TLS handshake data packet, and send the encrypted TLS handshake data packet to the content distribution network server. The proxy client is also used to generate a random value and send it to the proxy server, encrypt the target information using the random value, send the encrypted target information to the proxy server, and send the encrypted traffic data generated after encryption to the proxy server; The content delivery network server is configured to receive the encrypted TLS handshake data packet and the private key of the ECH handshake key sent by the DOH server, decrypt the TLS handshake data packet using the private key of the ECH handshake key, obtain the target domain name, and in response to the target domain name being a proxy domain name, establish a TLS handshake with the proxy server and establish a bidirectional link with the proxy server; The proxy server is used to receive the random value and the encrypted target information sent by the client, decrypt the encrypted target information according to the random value, obtain the target information, and shake hands with the target server corresponding to the target information. In response to a successful handshake, the proxy server receives the encrypted traffic data sent by the proxy client through the content distribution network server, wherein the encrypted traffic data is doubly encrypted by TLS and the random value.

2. A method for encrypting proxy traffic, characterized in that: The method comprises: Get the public key for encrypting the client hello ECH handshake key; Encrypting the domain name in a transport layer security (TLS) handshake data packet using the public key of the ECH handshake key to generate an encrypted TLS handshake data packet; The encrypted TLS handshake data packet is sent, wherein the encrypted TLS handshake data packet is used to perform a handshake with a content delivery network server.

3. The method according to claim 2, characterized in that The method further comprises: generating a random value, wherein the random value is used for data encryption; The random value is sent.

4. The method according to claim 3, characterized in that The method further comprises: Encrypting the target information according to the random value to generate encrypted target information, wherein the target information represents information corresponding to the target server to be accessed by the proxy client; The encrypted target information is sent.

5. The method according to claim 3, characterized in that The method further comprises: Get traffic data; Encrypting the traffic data according to the random value to generate encrypted traffic data; The encrypted traffic data is sent.

6. The method according to claim 2, characterized in that The method further comprises: Obtaining a proxy request, wherein the proxy request includes target information; Perform initial handshake and authentication with the client according to the set proxy protocol.

7. A method for encrypting proxy traffic, characterized in that: The method comprises: Receive the private key for the encrypted client hello ECH handshake key and the encrypted TLS handshake packet; Decrypting the TLS handshake data packet using the private key of the ECH handshake key to obtain a decrypted TLS handshake data packet; Determine the target domain name according to the decrypted TLS handshake data packet; In response to the target domain name being a proxy domain name, a TLS handshake is established with a proxy server corresponding to the proxy domain name, and a bidirectional link is established with the proxy server.

8. The method according to claim 7, characterized in that The method further comprises: In response to the target domain name being a business domain name, a TLS handshake is established with the business server according to the business domain name, and a bidirectional link is established with the business server.

9. The method according to claim 7, characterized in that The bidirectional link includes a TLS link and a websocket link.

10. A method for encrypting proxy traffic, characterized in that: The method comprises: Receive the decrypted TLS handshake packet; Handshake with the content distribution network server according to the decrypted TLS handshake data packet, and establish a bidirectional link with the content distribution network server.

11. The method according to claim 10, characterized in that The method further comprises: Receiving a random value and encrypted target information sent by the client, wherein the target information represents information corresponding to a target server to be accessed by the proxy client; decrypting the encrypted target information according to the random value to obtain the target information; Handshake is performed with the corresponding target server according to the target information.

12. The method according to claim 11, characterized in that The method further comprises: In response to a successful handshake, encrypted traffic data is received, wherein the encrypted traffic data is doubly encrypted using TLS and the random value.

13. A device for encrypting proxy traffic, characterized in that: The device comprises: A first obtaining unit is configured to obtain a public key for encrypting a client hello ECH handshake key; A generating unit, configured to encrypt the domain name in a transport layer security (TLS) handshake data packet using the public key of the ECH handshake key to generate an encrypted TLS handshake data packet; The sending unit is configured to send the encrypted TLS handshake data packet, wherein the encrypted TLS handshake data packet is used to perform a handshake with a content distribution network server.

14. A device for encrypting proxy traffic, characterized in that: The device comprises: The first receiving unit is configured to receive a private key for encrypting a client hello ECH handshake key and an encrypted TLS handshake data packet; A second obtaining unit is configured to decrypt the TLS handshake data packet using the private key of the ECH handshake key to obtain a target domain name; The first processing unit is configured to establish a TLS handshake with a proxy server according to the proxy domain name and to establish a bidirectional link with the proxy server in response to the target domain name being a proxy domain name.

15. A device for encrypting proxy traffic, characterized in that: The device comprises: A second receiving unit is used to receive the decrypted TLS handshake data packet; The second processing unit is configured to shake hands with a content delivery network server according to the decrypted TLS handshake data packet and establish a bidirectional link with the content delivery network server.

Images