Packet decryption method, device, equipment and medium

Abstract

The application provides a message decryption method and device, equipment and medium, which are applied to a load balancing device. The load balancing device is used for providing load balancing service for communication between a server and a client. The method comprises the following steps: in response to detecting a message capturing instruction, starting a packet capturing process, and obtaining a pre-configured message capturing rule; when detecting that a secure sockets layer (SSL) handshake between the server and the client is completed, collecting key information of an SSL connection, and transmitting the key information to the packet capturing process; capturing a target message transmitted between the server and the client according to the message capturing rule through the packet capturing process, and storing the target message and the received key information into a target file, wherein the target message is an encrypted message; in response to detecting a viewing instruction for the target file, performing decryption processing on the target message based on the key information to obtain a decrypted message. In this way, the convenience of message decryption is effectively improved, which is helpful for efficiently eliminating network faults.

Description

Technical Field

[0001] This application relates to the field of computer technology, and more specifically, to a message decryption method, apparatus, device, and medium. Background Technology

[0002] With the continuous development of network technology, people have increasingly higher requirements for the security of network communication. Therefore, the Secure Socket Layer (SSL) protocol is often used to encrypt network communication and ensure the confidentiality and integrity of data. The encryption and decryption process of the SSL protocol places high demands on server computing resources, and traditional single servers struggle to handle large-scale user access. By performing SSL offloading on a load balancer, SSL traffic is decrypted on the load balancer before being forwarded to the backend server. This method helps improve server performance, reduces server load, and ensures data transmission security because SSL encryption is used between the client and server.

[0003] However, various problems may arise during SSL encrypted communication, such as service disruptions and abnormal data exchange. Because the transmitted traffic is encrypted, the plaintext cannot be clearly identified, making problem localization and troubleshooting quite difficult. Therefore, when problems occur, it is extremely important to know how to decrypt captured packets and analyze them to obtain the plaintext. Summary of the Invention

[0004] In view of this, this application provides a message decryption method, apparatus, device and medium, which effectively improves the convenience of message decryption.

[0005] Specifically, this application is implemented through the following technical solution:

[0006] According to a first aspect of this application, a message decryption method is provided, applied to a load balancing device, the load balancing device being used to provide load balancing services for communication between a server and a client, the method comprising:

[0007] In response to the detection of a packet capture command, the packet capture process is started, and the pre-configured packet capture rules are obtained;

[0008] When a Secure Sockets Layer (SSL) handshake is detected between the server and the client, the key information of the SSL connection is collected and transmitted to the packet capture process.

[0009] The packet capture process captures the target packets transmitted between the server and the client according to the packet capture rules, and stores the target packets and the received key information into a target file, wherein the target packets are encrypted packets;

[0010] In response to the detection of a viewing command for the target file, the target message is decrypted based on the key information to obtain a decrypted message.

[0011] In one optional implementation, the method further includes:

[0012] The received key information is written into a pre-initialized key information linked list through the packet capture process.

[0013] The step of storing the target message and the received key information into a target file includes:

[0014] In response to the detection that the packet capture process has exited, check whether key information exists in the key information chain;

[0015] If it exists, extract the key information from the key information linked list, and store the target message and the extracted key information into the target file.

[0016] In one optional implementation, the packet capture process is controlled to exit through the following steps:

[0017] The content of the stop packet capture flag is detected, wherein the stop packet capture flag is used to indicate whether packet capture is performed;

[0018] If the stop packet capture flag indicates that packet capture has stopped, control the packet capture process to exit.

[0019] In one optional implementation, the indication content of the stop packet capture flag is set through the following steps:

[0020] After the packet capture process is started, the stop packet capture flag is set to indicate packet capture;

[0021] If the information received by the packet capture process is of the type "stop packet capture", the stop packet capture flag will be adjusted to indicate that packet capture should be stopped.

[0022] In one optional implementation, the step of writing the received key information into a pre-initialized key information linked list through the packet capture process includes:

[0023] Through the packet capture process, a key type information node is created based on the received key information;

[0024] Write the key type information node into the pre-initialized key information linked list.

[0025] In one optional implementation, the step of collecting the SSL connection key information when a Secure Sockets Layer (SSL) handshake is detected to be completed between the server and the client includes:

[0026] When a Secure Sockets Layer (SSL) handshake is detected between the server and the client, the SSL version is checked, where different SSL versions correspond to different key information;

[0027] Collect the key information for the SSL connection according to the stated SSL version.

[0028] In one optional implementation, if the SSL version is greater than or equal to the target version, the key information includes the SSL version, a client random number, and a master key;

[0029] If the SSL version is less than the target version, the key information includes the SSL version, client random number, client handshake key, server handshake key, client application key, and server application key.

[0030] According to a second aspect of this application, a message decryption apparatus is provided, applied to a load balancing device, the load balancing device being used to provide load balancing services for communication between a server and a client, the apparatus comprising:

[0031] The process startup module is used to start the packet capture process in response to the detection of a packet capture command and to obtain the pre-configured packet capture rules;

[0032] The information acquisition module is used to acquire the key information of the SSL connection when the server and the client complete the Secure Sockets Layer (SSL) handshake, and transmit the key information to the packet capture process;

[0033] The packet capture module is used to capture target packets transmitted between the server and the client according to the packet capture rules through the packet capture process, and store the target packets and the received key information into a target file, wherein the target packets are encrypted packets;

[0034] The message decryption module is used to respond to the detection of a viewing command for the target file, and decrypt the target message based on the key information to obtain the decrypted message.

[0035] According to a third aspect of this application, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the message decryption method described in the first aspect above.

[0036] According to a fourth aspect of this application, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps of the message decryption method described in the first aspect above.

[0037] The message decryption method, apparatus, device, and medium provided in this application embodiment utilize a load balancing device that provides load balancing services for communication between a server and a client. This device initiates a packet capture process to capture target messages transmitted between the server and client according to message capture rules. When a Secure Sockets Layer (SSL) handshake is detected between the server and client, the key information of the SSL connection is collected. The target message and key information are stored in the same target file through the packet capture process, thus establishing an association between the message and key information. This avoids situations where decryption is impossible due to incorrect association between the message and key information. Therefore, when it is necessary to view the target file, the target message can be directly decrypted based on the key information to obtain the decrypted message. Compared to related technologies, this method does not require client cooperation or setting environment variables, nor does it restrict the certificate used by the server, effectively improving the convenience of message decryption and facilitating efficient analysis of protocol interactions, troubleshooting of network faults, and analysis of network protocols.

[0038] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of this disclosure.

[0039] To make the above-mentioned objects, features and advantages of this disclosure more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0040] Figure 1 This is a flowchart illustrating a message decryption method according to an exemplary embodiment of this application;

[0041] Figure 2 This is a schematic diagram illustrating an exemplary embodiment of the present application of a process for initiating a packet capture process;

[0042] Figure 3 This is a schematic diagram illustrating a packet capture process in an exemplary embodiment of this application;

[0043] Figure 4 This is a schematic diagram illustrating a process for collecting key information, as shown in an exemplary embodiment of this application.

[0044] Figure 5 This is a schematic diagram illustrating a process of capturing target messages according to an exemplary embodiment of this application;

[0045] Figure 6 This is a schematic diagram illustrating an exemplary embodiment of the present application of a process for setting a stop packet capture flag and filling in a key information linked list;

[0046] Figure 7 This is a schematic diagram illustrating a process for storing a target file, as shown in an exemplary embodiment of this application;

[0047] Figure 8 This is a schematic diagram of a message decryption device shown in an exemplary embodiment of this application;

[0048] Figure 9 This is a schematic diagram of the structure of a computer device shown in an exemplary embodiment of this application. Detailed Implementation

[0049] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0050] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0051] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0052] Research has found that there are generally two methods for decrypting SSL traffic:

[0053] Method 1: On the Windows or Linux client system, set the SSLKEYLOGFILE environment variable. Access the server using a browser. The SSL-related keys are stored in the file specified by SSLKEYLOGFILE. Import the specified file into the network packet analysis tool Wireshark to decrypt encrypted packets. Here, the specified file can store SSL key information.

[0054] Method two: If the server uses an asymmetric encryption algorithm (Rivest-Shamir-Adleman, RSA) certificate, which performs both key negotiation and authentication, importing the server's private key into Wireshark will decrypt subsequently captured encrypted messages. The principle is that after importing the RSA private key into Wireshark, the pre-master key transmitted during the decryption key exchange, combined with client and server random numbers, can generate a master key. This master key can then be used to generate a session key, which in turn can decrypt subsequently captured encrypted messages.

[0055] However, while the above methods can decrypt messages, they all have certain requirements and limitations.

[0056] Regarding method one, there are limitations on the client side. Although Windows or Linux systems generally support the SSLKEYLOGFILE environment variable, when packet capture is needed due to problems, users need to temporarily configure the client's environment variable. This requires client cooperation, affecting normal user operation and making the process quite difficult. Even if users can configure the SSLKEYLOGFILE environment variable, they still need to associate the captured packets with the saved key information, a cumbersome process that may even lead to incorrect packet and key information association, resulting in decryption failure. Furthermore, in practical applications, clients are often not browsers and therefore lack the conditions to set the SSLKEYLOGFILE environment variable, such as mobile operating systems.

[0057] Regarding method two, only the server uses an RSA certificate, and this certificate is used for both key negotiation and authentication, requiring the RSA private key. This is unsuitable for SSL traffic using key exchange algorithms such as Diffie-Hellman Ephemeral (DHE) and Elliptic Curve Diffie-Hellman Ephemeral (ECDHE). Because it does not support Perfect Forward Secrecy (PFS), attackers can capture and save packets. If an attacker obtains the private key in the future, they can decrypt the packets, posing a security risk. Furthermore, TLS 1.3 has removed the suite that uses RSA for key exchange, so this method is not applicable to TLS 1.3. In summary, this method has a narrow scope of application and low versatility.

[0058] Based on the above research, this application provides a message decryption method, apparatus, device, and medium. The load balancing device captures target messages transmitted between the server and the client through a packet capture process. When the SSL handshake is completed, it collects the key information of the SSL connection. The target message and key information are stored in the same target file through the packet capture process, realizing the association between the message and key information. This avoids the situation where decryption is impossible due to the disorder of the association between the message and key information. Thus, when it is necessary to view the target file, the target message can be directly decrypted based on the key information to obtain the decrypted message. No client cooperation or setting of environment variables is required, nor is it necessary to restrict the certificate used by the server. This effectively improves the convenience of message decryption and helps to efficiently analyze protocol interactions, troubleshoot network faults, and analyze network protocols.

[0059] To facilitate understanding of this embodiment, a detailed description of the message decryption method disclosed in this application embodiment is provided first. The execution entity of the message decryption method provided in this application embodiment is generally an electronic device with a certain computing power. This electronic device can be a server, which can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud storage, big data, and artificial intelligence platforms. In some possible implementations, this message decryption method can be implemented by a processor calling computer-readable instructions stored in memory.

[0060] The following description, in conjunction with the accompanying drawings, illustrates a message decryption method provided in an embodiment of this application.

[0061] See Figure 1 The diagram shown is a flowchart illustrating a message decryption method according to an exemplary embodiment of this application. The message decryption method is applied to a load balancing device, which provides load balancing services for communication between a server and a client. The application service provided by the load balancing device is a virtual service, configured on the load balancing device. Client access requests arrive at the load balancing device via the network to access the virtual service. The load balancing device selects one real server from multiple real servers according to a configured delivery strategy and sends the access request to the selected real server.

[0062] like Figure 1 As shown in the figure, the message decryption method provided in this embodiment includes steps S101 to S104, wherein:

[0063] S101: In response to the detection of a packet capture command, start the packet capture process and obtain the pre-configured packet capture rules.

[0064] It should be noted that, since the method of this embodiment is applied to a load balancing device, it can be understood that the execution of each step in this embodiment is driven by the load balancing service process.

[0065] Here, packet capture rules can be pre-configured before starting the packet capture process. These rules can include source Internet Protocol (IP), destination IP, source port, destination port, protocol number, ingress interface, egress interface, etc.

[0066] To more clearly demonstrate the packet capture configuration and the process of starting the packet capture process, please refer to [link / reference]. Figure 2 This is a schematic diagram illustrating the process of starting a packet capture process, as shown in an exemplary embodiment of this application. Figure 2 As shown, packet capture rules can be configured, including the option to decrypt SSL-type traffic. When debugging or encountering business issues, packet capture and analysis are necessary. Users can issue packet capture commands, which, upon detection, initiate the capture process and retrieve the pre-configured rules.

[0067] After the packet capture process starts, for example, you can refer to the following: Figure 3 This is a schematic diagram illustrating a packet capture process in an exemplary embodiment of this application. Figure 3 As shown, after the packet capture process starts, a data link layer socket (AF_PACKET type socket) can be created. The packet capture function can be implemented through the AF_PACKET type socket, which can capture all packets passing through the load balancer.

[0068] Optionally, a Unix server type socket can also be created, through which the load balancing business process can connect with other processes for information transmission.

[0069] Optionally, a Socket Berkeley Packet Filter (BPF) can be set according to the packet capture rules. It is understood that a large number of packets pass through the load balancer. If all packets passing through the load balancer are captured, it will affect performance. By setting the Socket BPF filtering information, only packets that meet the packet capture rules can be captured. In this way, the number of captured packets is relatively small, which helps to improve processing efficiency.

[0070] Optionally, a key information linked list (SSL Key Log File) can also be initialized, which is used to record key information for SSL communication.

[0071] Optionally, a blank target file can also be created, which is used to store the captured packets and collected key information. Here, the target file can be a pcapng format file. The pcapng file contains multiple data blocks, each used to store different types of information. For example, these include a Section Header Block (SHB), an Interface Statistics Block (ISB), an Interface Description Block (IDB), a Name Resolution Block (NRB), an Enhanced Packet Block (EPB), a Simple Packet Block (SPB), a Decryption Secrets Block (DSB), and a Custom Block (CB).

[0072] In some possible implementations, a packet capture thread and a message processing thread can be started. The packet capture process includes the packet capture thread and the message processing thread; the packet capture thread is used to collect packets, and the message processing thread is used to receive information sent by other processes.

[0073] S102: When the SSL handshake between the server and the client is detected to be completed, the key information of the SSL connection is collected and the key information is transmitted to the packet capture process.

[0074] In this step, the load balancing service process includes a load balancing service thread, which is a worker thread in the load balancer device used to handle SSL protocol logic. When the load balancing service thread detects that a Secure Sockets Layer (SSL) handshake has been completed between the server and the client, the SSL connection key information can be collected and transmitted to the packet capture process.

[0075] In some possible implementations, the step of collecting the key information of the SSL connection when a Secure Sockets Layer (SSL) handshake is detected to be completed between the server and the client includes:

[0076] When a Secure Sockets Layer (SSL) handshake is detected between the server and the client, the SSL version is checked, where different SSL versions correspond to different key information;

[0077] Collect the key information for the SSL connection according to the stated SSL version.

[0078] In the above steps, when a Secure Sockets Layer (SSL) handshake is detected between the server and the client, the SSL version can be detected. For example, SSL versions are categorized in chronological order as SSL 3.0, TLS 1.0, TLS 1.1, TLS 1.2, TLS 1.3, etc. Different SSL versions correspond to different key information; therefore, the key information for the SSL connection can be collected according to the SSL version.

[0079] In this way, by detecting the SSL version and collecting the corresponding key information according to different SSL versions when the server and client complete the SSL handshake, compatibility support for multiple SSL versions is achieved, ensuring the accuracy of key information acquisition. This enables more efficient decryption of messages encrypted by different SSL versions, effectively adapting to diverse network environments and different SSL configurations, and enhancing the universality and reliability of message decryption.

[0080] In some possible implementations, when the SSL version is greater than or equal to the target version, the key information includes the SSL version, a client random number, and a master secret; when the SSL version is less than the target version, the key information includes the SSL version, a client random number, a client handshake key, a server handshake key, a client application key, and a server application key.

[0081] The target version can be TLS 1.3. Here, since TLS 1.3 has removed the suite that uses RSA for key exchange, this version no longer distinguishes between handshake keys and application keys, and they are all derived from the master key.

[0082] In this way, different key information is collected according to the SSL version, thereby achieving accurate adaptation to different SSL version encryption mechanisms. This helps to improve the accuracy and reliability of message decryption, enhances the adaptability of load balancing equipment in complex network environments, and provides stronger support for network protocol analysis and troubleshooting.

[0083] To more clearly illustrate the process of collecting key information, see [link to documentation]. Figure 4 This is a schematic diagram illustrating a process for collecting key information, as shown in an exemplary embodiment of this application. Figure 4As shown, when a Secure Sockets Layer (SSL) handshake is detected between the server and the client, the SSL version is checked. Based on the SSL version, the key information for the SSL connection is collected. Specifically, it is checked whether the SSL version is lower than the target version. If so, the SSL version, client random number, client handshake key, server handshake key, client application key, and server application key are collected. If not, the SSL version, client random number, and master key are collected. The collected key information is then transmitted to the packet capture process. For a detailed description, please refer to the aforementioned embodiment; it will not be repeated here.

[0084] S103: The packet capture process captures the target packets transmitted between the server and the client according to the packet capture rules, and stores the target packets and the received key information into a target file, wherein the target packets are encrypted packets.

[0085] In this step, the packet capture process can monitor and capture packets transmitted between the server and client that meet the packet capture rules in real time, based on the packet capture rules, as the target packets. Figure 3 As can be seen, a target file is pre-created, which can store the target message and the received key information, thereby realizing the associated storage of the target message and the key information.

[0086] In this way, by placing the encrypted target message and the key information used to decrypt the target message in the same file, the correspondence between the message and the key information is ensured. When it is necessary to view or analyze the target message later, the key information stored in the same file can be used directly to decrypt the target message and obtain the plaintext content of the target message.

[0087] Combination Figure 3 As can be seen, the packet capture process includes the packet capture thread and the message processing thread. Specifically, the packet capture thread can capture the target packets transmitted between the server and the client according to the packet capture rules and store the target packets in the target file; the message processing thread can receive the key information and store the received key information in the target file.

[0088] In some possible implementations, the method further includes:

[0089] The received key information is written into a pre-initialized key information linked list through the packet capture process.

[0090] The step of storing the target message and the received key information into a target file includes:

[0091] In response to the detection that the packet capture process has exited, check whether key information exists in the key information chain;

[0092] If it exists, extract the key information from the key information linked list, and store the target message and the extracted key information into the target file.

[0093] Here, the received key information can be written into a pre-initialized key information linked list through the message processing thread.

[0094] Optionally, in response to detecting the exit of the packet capture process, the message processing thread can detect whether key information exists in the key information linked list, and the packet capture thread can detect whether a target packet exists. If key information exists in the key information linked list, the message processing thread traverses the key information linked list, extracts the key information from the key information linked list, and stores the extracted key information in the target file. If a target packet exists, the packet capture thread stores the captured target packet in the target file.

[0095] Specifically, the key information can be saved in SSL keylog format. Specifically, the key information can be saved to the decryption key block of the target file, and the target message can be saved to the enhanced data packet block of the target file.

[0096] By introducing a key information linked list to manage and store key information, the key information processing flow is further optimized. The packet capture process writes the key information into a pre-initialized key information linked list. When the packet capture process exits, it can check whether the key information exists in the linked list. If it does, the key information is extracted from the list and stored together with the target packet in the target file. This ensures the integrity and accuracy of the key information, avoids the problem of key information loss due to abnormal exit of the packet capture process, and helps to improve the reliability of packet decryption.

[0097] In some possible implementations, the packet capture process is controlled to exit through the following steps:

[0098] The content of the stop packet capture flag is detected, wherein the stop packet capture flag is used to indicate whether packet capture is performed;

[0099] If the stop packet capture flag indicates that packet capture has stopped, control the packet capture process to exit.

[0100] In the above steps, the indication content of the stop packet capture flag can be detected. For example, if the content of the stop packet capture flag is 1, it indicates that packet capture should be stopped and the packet capture process should be controlled to exit. If the content of the stop packet capture flag is 0, it indicates that packet capture should be performed, and there is no need to control the packet capture process to exit.

[0101] In this way, controlling the exit of the packet capture process by detecting the indication of the stop packet capture flag enables flexible and reliable packet capture control. This allows for precise control of the start and stop of the packet capture process based on actual needs, avoiding unnecessary resource consumption and packet collection. It also ensures timely and accurate exit of the packet capture process when it needs to be stopped, enhancing the overall controllability and stability of packet decryption. Furthermore, controlling the packet capture process through the stop packet capture flag simplifies the operation process, facilitates management and maintenance, and further improves the efficiency and reliability of the load balancing equipment in the packet collection and decryption process.

[0102] In some possible implementations, the indication content of the stop packet capture flag is set through the following steps:

[0103] After the packet capture process is started, the stop packet capture flag is set to indicate packet capture;

[0104] If the information received by the packet capture process is of the type "stop packet capture", the stop packet capture flag will be adjusted to indicate that packet capture should be stopped.

[0105] It is understood that after the packet capture process starts, packet capture is required. The message processing thread can set a stop packet capture flag to indicate packet capture, for example, setting the stop packet capture flag to 0. When the user deems it appropriate to stop packet capture, they can initiate a stop packet capture command, thereby transmitting stop packet capture type information to the message processing thread. If the message processing thread receives information of the stop packet capture type, it will adjust the stop packet capture flag to indicate stop packet capture, for example, adjusting the stop packet capture flag to 1.

[0106] In this way, by explicitly setting the indication of the stop packet capture flag, the control logic of the packet capture process is further optimized. After the packet capture process starts, the stop packet capture flag is set to indicate the packet capture status, ensuring that packet capture can proceed normally. When the packet capture process receives the stop packet capture type information, the stop packet capture flag is adjusted to indicate that packet capture has stopped, thereby achieving precise control over the packet capture process. This makes the start and stop of the packet capture process more flexible and controllable, and can adjust the packet capture behavior in real time according to actual needs, avoiding invalid packet capture or waste of resources.

[0107] In some possible implementations, the step of writing the received key information into a pre-initialized key information linked list through the packet capture process includes:

[0108] Through the packet capture process, a key type information node is created based on the received key information;

[0109] Write the key type information node into the pre-initialized key information linked list.

[0110] In the above steps, the message processing thread can create a key type information node based on the received key information. The key type information node is an independent data structure that can accurately encapsulate and store the key information. Then, the key type information node can be written into the pre-initialized key information linked list.

[0111] In this way, by creating key type information nodes based on the received key information during the packet capture process and writing them into a pre-initialized key information linked list, the storage and management of key information are further optimized. This allows key information to be stored in a structured node format within the key information linked list, facilitating subsequent retrieval and use. Organizing key information into nodes enhances its scalability and flexibility, enabling more efficient processing of different types of key information. Using a key information linked list helps improve the reliability of key information storage, preventing key information loss or corruption, and providing more accurate data support for subsequent message decryption.

[0112] To more clearly demonstrate the process of capturing target messages, see [link to documentation]. Figure 5 This is a schematic diagram illustrating a process of capturing target messages, as shown in an exemplary embodiment of this application. Figure 5 As shown, after starting the packet capture thread, the indication content of the stop packet capture flag can be detected. If the content of the stop packet capture flag is 0, packet capture is indicated, and the target packets transmitted between the server and the client are captured according to the packet capture rules. If the content of the stop packet capture flag is 1, packet capture is indicated to stop, and the packet capture process is controlled to exit. For a detailed description, please refer to the aforementioned embodiment, which will not be repeated here.

[0113] To more clearly demonstrate the process of setting the stop packet capture flag and filling in the key information linked list, see [link to documentation]. Figure 6 This is a schematic diagram illustrating an exemplary embodiment of this application, showing the process of setting a stop packet capture flag and filling in a key information linked list. Figure 6As shown, the message processing thread can detect in real time whether it has received transmission information. When transmission information is received, it can detect the type of the received information. If the received information is a stop packet capture type message, the stop packet capture flag can be adjusted to indicate that packet capture has stopped. If the received information is an SSL key type message, i.e., the key information, a key type information node can be created based on the received key information, and the key type information node can be written into a pre-initialized key information linked list. For a detailed description, please refer to the aforementioned embodiment, which will not be repeated here.

[0114] To more clearly illustrate the process of storing the target message and key information into the target file, see [link to documentation]. Figure 7 This is a schematic diagram illustrating a process for storing a target file, as shown in an exemplary embodiment of this application. Figure 7 As shown, in response to the detection of the packet capture process exiting, the packet capture thread can detect whether there is a captured target packet. If a captured target packet is detected, the packet capture thread can store the captured target packet into the enhanced data packet block of the target file. The message processing thread can also detect whether there is key information in the key information linked list. If key information is detected in the key information linked list, the message processing thread can traverse the key information linked list, extract the key information from the key information linked list, and store the extracted key information into the decryption key block of the target file. Thus, the target file stores the data packets and key information of each target packet. The ciphertext can then be automatically decrypted using the network packet analysis tool Wireshark to obtain the decrypted plaintext. For specific descriptions, please refer to the aforementioned embodiments; they will not be repeated here.

[0115] S104: In response to detecting a viewing instruction for the target file, the target message is decrypted based on the key information to obtain a decrypted message.

[0116] In this step, in response to the detection of a viewing command for the target file, the target packet can be decrypted using the network packet analysis tool Wireshark based on the key information to obtain the decrypted packet.

[0117] Here, the target file can be opened and its contents viewed using packet capture tools such as Wireshark. For example, Wireshark can parse pcapng format data packet files and also supports extracting key information from data packet files containing decryption key blocks, thus decrypting SSL encrypted traffic.

[0118] The message decryption method provided in this application embodiment utilizes a load balancing device that provides load balancing services for communication between the server and the client. It initiates a packet capture process to capture target messages transmitted between the server and the client according to message capture rules. When a Secure Sockets Layer (SSL) handshake is detected between the server and the client, the SSL connection key information is collected. The packet capture process stores the target message and key information in the same target file, thus establishing an association between the message and key information. This avoids situations where decryption is impossible due to incorrect association between the message and key information. Therefore, when it is necessary to view the target file, the target message can be directly decrypted based on the key information to obtain the decrypted message. Compared to related technologies, this method does not require client cooperation or setting environment variables, nor does it restrict the certificate used by the server, effectively improving the convenience of message decryption and facilitating efficient analysis of protocol interactions, troubleshooting of network faults, and analysis of network protocols.

[0119] Those skilled in the art will understand that, in the above-described method of the specific implementation, the order in which each step is written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each step should be determined by its function and possible internal logic.

[0120] Corresponding to the embodiments of the aforementioned message decryption method, this application also provides embodiments of a message decryption apparatus.

[0121] Please see Figure 8 This is a schematic diagram illustrating a message decryption device according to an exemplary embodiment of this application. The message decryption device is applied to a load balancing device, which provides load balancing services for communication between a server and a client. Figure 8 As shown in the figure, the message decryption device 800 provided in this application embodiment includes:

[0122] The process startup module 801 is used to start the packet capture process and obtain the pre-configured packet capture rules in response to the detection of the packet capture command.

[0123] Information acquisition module 802 is used to acquire SSL connection key information when a Secure Sockets Layer (SSL) handshake is detected between the server and the client, and to transmit the key information to the packet capture process;

[0124] The packet capture module 803 is used to capture target packets transmitted between the server and the client according to the packet capture rules through the packet capture process, and store the target packets and the received key information into a target file, wherein the target packets are encrypted packets;

[0125] The message decryption module 804 is used to decrypt the target message based on the key information in response to the detection of a viewing instruction for the target file, so as to obtain the decrypted message.

[0126] In some possible implementations, the message capture module 803 is further configured to:

[0127] The received key information is written into a pre-initialized key information linked list through the packet capture process.

[0128] When the message capture module 803 stores the target message and the received key information into a target file, it is specifically used for:

[0129] In response to the detection that the packet capture process has exited, check whether key information exists in the key information chain;

[0130] If it exists, extract the key information from the key information linked list, and store the target message and the extracted key information into the target file.

[0131] In some possible implementations, the message decryption device 800 further includes a process exit module 805, which is used to control the packet capture process to exit through the following steps:

[0132] The content of the stop packet capture flag is detected, wherein the stop packet capture flag is used to indicate whether packet capture is performed;

[0133] If the stop packet capture flag indicates that packet capture has stopped, control the packet capture process to exit.

[0134] In some possible implementations, the message decryption device 800 further includes a flag setting module 806, which is used to set the indication content of the stop packet capture flag bit through the following steps:

[0135] After the packet capture process is started, the stop packet capture flag is set to indicate packet capture;

[0136] If the information received by the packet capture process is of the type "stop packet capture", the stop packet capture flag will be adjusted to indicate that packet capture should be stopped.

[0137] In some possible implementations, when the packet capture module 803 is used to write the received key information into a pre-initialized key information linked list through the packet capture process, it is specifically used for:

[0138] Through the packet capture process, a key type information node is created based on the received key information;

[0139] Write the key type information node into the pre-initialized key information linked list.

[0140] In some possible implementations, when the information acquisition module 802 acquires the key information of the SSL connection upon detecting that a Secure Sockets Layer (SSL) handshake has been completed between the server and the client, it is specifically used for:

[0141] When a Secure Sockets Layer (SSL) handshake is detected between the server and the client, the SSL version is checked, where different SSL versions correspond to different key information;

[0142] Collect the key information for the SSL connection according to the stated SSL version.

[0143] In some possible implementations, when the SSL version is greater than or equal to the target version, the key information includes the SSL version, a client random number, and a master key;

[0144] If the SSL version is less than the target version, the key information includes the SSL version, client random number, client handshake key, server handshake key, client application key, and server application key.

[0145] The specific implementation process of the functions and roles of each module in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0146] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this application according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0147] The message decryption device provided in this application embodiment, through a load balancing device that provides load balancing services for communication between the server and the client, initiates a packet capture process to capture target messages transmitted between the server and the client according to message capture rules. When a Secure Sockets Layer (SSL) handshake is detected between the server and the client, the key information of the SSL connection is collected. The target message and the key information are stored in the same target file through the packet capture process, realizing the association between the message and the key information. This avoids the situation where decryption is impossible due to the disorder of the association between the message and the key information. Thus, when it is necessary to view the target file, the target message can be directly decrypted based on the key information to obtain the decrypted message. Compared with related technologies, it does not require the client to cooperate or set environment variables, nor does it require restricting the certificate used by the server, effectively improving the convenience of message decryption and helping to efficiently analyze protocol interactions, troubleshoot network faults, and analyze network protocols.

[0148] Based on the same technical concept, this application also provides a computer device 900, referring to... Figure 9 The diagram shown is a schematic representation of the structure of a computer device according to an exemplary embodiment of this application, comprising:

[0149] The processor 910, memory 920, and bus 930 are included. The memory 920 is used to store execution instructions and includes main memory 921 and external memory 922. The main memory 921, also known as internal memory, is used to temporarily store the operation data in the processor 910 and the data exchanged with external memory 922 such as hard disk. The processor 910 exchanges data with external memory 922 through main memory 921.

[0150] In this embodiment, the memory 920 is specifically used to store application code that executes the scheme of this application, and its execution is controlled by the processor 910. That is, when the electronic device 900 is running, the processor 910 communicates with the memory 920 through the bus 930, or the processor 910 communicates with the memory 920 through other means, so that the processor 910 executes the application code stored in the memory 920, and then executes the steps of the message decryption method described in any of the foregoing embodiments.

[0151] The memory 920 may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc.

[0152] Processor 910 may be an integrated circuit chip with signal processing capabilities. The aforementioned processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor.

[0153] It is understood that the structures illustrated in the embodiments of this application do not constitute a specific limitation on the electronic device 900. In other embodiments of this application, the electronic device 900 may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0154] This disclosure also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the message decryption method described in the above method embodiments. The storage medium can be a volatile or non-volatile computer-readable storage medium.

[0155] This disclosure also provides a computer program product, which stores a computer program. When the computer program is run by a processor, it executes the steps of the message decryption method provided in any of the above embodiments of this disclosure. For details, please refer to the above method embodiments, which will not be repeated here.

[0156] The aforementioned computer program product can be implemented through hardware, software, or a combination thereof. In one optional embodiment, the computer program product is specifically embodied in a computer storage medium, which can be a volatile or non-volatile computer-readable storage medium. In another optional embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0157] Furthermore, embodiments of the subject matter and functional operation described in this specification can be implemented in the following ways: digital electronic circuits, tangibly embodied computer software or firmware, computer hardware including the structures disclosed in this specification and their structural equivalents, or combinations thereof. Embodiments of the subject matter described in this specification can be implemented as one or more computer programs, i.e., one or more modules of computer program instructions encoded on a tangible, non-transitory program carrier for execution by a data processing apparatus or for controlling the operation of a data processing apparatus. Alternatively or additionally, program instructions may be encoded on artificially generated propagation signals, such as machine-generated electrical, optical, or electromagnetic signals, which are generated to encode information and transmit it to a suitable receiving device for execution by the data processing apparatus. The computer storage medium may be a machine-readable storage device, a machine-readable storage substrate, a random or serial access memory device, or combinations thereof.

[0158] The processing and logic flow described in this specification can be executed by one or more programmable computers that execute one or more computer programs to perform corresponding functions by operating on input data and generating output. The processing and logic flow can also be executed by dedicated logic circuitry—such as FPGAs (Field-Programmable Gate Arrays) or ASICs (Application-Specific Integrated Circuits), and the device can also be implemented as dedicated logic circuitry.

[0159] Suitable computers for executing computer programs include, for example, general-purpose and / or special-purpose microprocessors, or any other type of central processing unit. Typically, the central processing unit receives instructions and data from read-only memory and / or random access memory. The basic components of a computer include a central processing unit for implementing or executing instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include one or more mass storage devices for storing data, such as disks, magneto-optical disks, or optical disks, or the computer will be operatively coupled to such mass storage devices to receive data from or transfer data to them, or both. However, a computer is not required to have such devices. Furthermore, a computer can be embedded in another device, such as a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a portable storage device such as a universal serial bus (USB) flash drive, to name a few.

[0160] Computer-readable media suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, such as semiconductor memory devices (e.g., EPROM, EEPROM, and flash memory devices), magnetic disks (e.g., internal hard disks or removable disks), magneto-optical disks, and CD-ROM and DVD-ROM disks. Processors and memory may be supplemented by or incorporated into dedicated logic circuitry.

[0161] While this specification contains numerous specific implementation details, these should not be construed as limiting the scope of any invention or the scope of the claims, but rather are primarily intended to describe features of specific embodiments of a particular invention. Certain features described in the various embodiments herein may also be implemented in combination in a single embodiment. Conversely, various features described in a single embodiment may also be implemented separately in various embodiments or in any suitable sub-combination. Furthermore, while features may function in certain combinations as described above and even initially claimed in this way, one or more features from a claimed combination may be removed from that combination in some cases, and a claimed combination may refer to a sub-combination or a variation thereof.

[0162] Similarly, although the operations are depicted in a specific order in the accompanying drawings, this should not be construed as requiring these operations to be performed in the specific order shown or sequentially, or requiring all illustrated operations to be performed to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. Furthermore, the separation of various system modules and components in the above embodiments should not be construed as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0163] Thus, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recited in the claims may be performed in a different order and still achieve the desired result. Furthermore, the processes depicted in the drawings are not necessarily shown in a specific order or sequence to achieve the desired result. In some implementations, multitasking and parallel processing may be advantageous.

[0164] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A message decryption method, characterized in that, Applied to a load balancing device, the load balancing device being used to provide load balancing services for communication between servers and clients, the method includes: In response to the detection of a packet capture command, the packet capture process is started, and the pre-configured packet capture rules are obtained; When a Secure Sockets Layer (SSL) handshake is detected between the server and the client, the key information of the SSL connection is collected and transmitted to the packet capture process. The packet capture process captures target packets transmitted between the server and the client according to the packet capture rules, and stores the target packets and the received key information in a target file. The target packets are encrypted; the target packets and the received key information are stored in the same target file; the target packets are stored in the enhanced data packet block of the target file, and the key information is stored in the decryption key block of the target file. In response to the detection of a viewing command for the target file, the target message is decrypted based on the key information to obtain a decrypted message.

2. The method according to claim 1, characterized in that, The method further includes: The received key information is written into a pre-initialized key information linked list through the packet capture process. The step of storing the target message and the received key information into a target file includes: In response to the detection that the packet capture process has exited, check whether key information exists in the key information chain; If it exists, extract the key information from the key information linked list, and store the target message and the extracted key information into the target file.

3. The method according to claim 2, characterized in that, The packet capture process can be exited by following these steps: The content of the stop packet capture flag is detected, wherein the stop packet capture flag is used to indicate whether packet capture is performed; If the stop packet capture flag indicates that packet capture has stopped, control the packet capture process to exit.

4. The method according to claim 3, characterized in that, The following steps are used to set the indication content of the stop packet capture flag: After the packet capture process is started, the stop packet capture flag is set to indicate packet capture; If the information received by the packet capture process is of the type "stop packet capture", the stop packet capture flag will be adjusted to indicate that packet capture should be stopped.

5. The method according to claim 2, characterized in that, The step of writing the received key information into a pre-initialized key information linked list through the packet capture process includes: Through the packet capture process, a key type information node is created based on the received key information; Write the key type information node into the pre-initialized key information linked list.

6. The method according to claim 1, characterized in that, When a Secure Sockets Layer (SSL) handshake is detected to be completed between the server and the client, the key information of the SSL connection is collected, including: When a Secure Sockets Layer (SSL) handshake is detected between the server and the client, the SSL version is checked, where different SSL versions correspond to different key information; Collect the key information for the SSL connection according to the stated SSL version.

7. The method according to claim 6, characterized in that, If the SSL version is greater than or equal to the target version, the key information includes the SSL version, the client random number, and the master key; If the SSL version is less than the target version, the key information includes the SSL version, client random number, client handshake key, server handshake key, client application key, and server application key.

8. A message decryption device, characterized in that, An apparatus for use in load balancing devices, wherein the load balancing device provides load balancing services for communication between servers and clients, the apparatus comprising: The process startup module is used to start the packet capture process in response to the detection of a packet capture command and to obtain the pre-configured packet capture rules; The information acquisition module is used to acquire the key information of the SSL connection when the server and the client complete the Secure Sockets Layer (SSL) handshake, and transmit the key information to the packet capture process; The packet capture module is used to capture target packets transmitted between the server and the client according to the packet capture rules through the packet capture process, and store the target packets and the received key information into a target file, wherein the target packets are encrypted packets; the target packets and the received key information are stored in the same target file; the target packets are stored in the enhanced data packet block of the target file, and the key information is stored in the decryption key block of the target file; The message decryption module is used to respond to the detection of a viewing command for the target file, and decrypt the target message based on the key information to obtain the decrypted message.

9. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the message decryption method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps of the message decryption method according to any one of claims 1 to 7.

Images