Method and system for forensic decryption of secure shell protocol traffic based on key injection

Abstract

This invention belongs to the field of network security and communication technology, and provides a method and system for forensic decryption of Secure Shell protocol traffic based on key injection. The method includes: injecting a custom dynamic library into the service process during the execution of the Secure Shell protocol server, intercepting key encryption functions and extracting session keys as shared keys; performing session identification on the encrypted traffic captured from the network, completing the reassembly of IP fragments and TCP segments to obtain reconstructed encrypted traffic; performing matching and integrity verification between the shared key and the reconstructed encrypted traffic, and then decrypting to generate plaintext packets; parsing the plaintext packets into structured operation records according to channel type, and storing them in categories based on timestamps, session IDs, and user identifiers to form audit evidence data. The method of this invention does not require modification of system files and can achieve complete decryption and behavior reconstruction of multiple types of sessions such as Shell, SCP, and SFTP, and is suitable for network security auditing and judicial evidence collection scenarios.

Description

Technical Field

[0001] This invention belongs to the field of network security and communication technology, and relates to a method and system for forensic decryption of traffic based on the Secure Shell Protocol (SSH) with key injection, which is applicable to scenarios such as network security monitoring, judicial evidence collection, and compliance auditing. Background Technology

[0002] With the development of information technology, the Secure Shell Protocol (SSH), as a core protocol for ensuring remote login and file transfer (such as SCP and SFTP), has been widely used in critical scenarios such as server management, cloud computing platforms, and automated operation and maintenance. SSH uses asymmetric encryption for authentication and key exchange, and after the session is established, it uses symmetric encryption algorithms (such as AES-256 and ChaCha20-Poly1305) to encrypt communication data to ensure the security of data transmission.

[0003] However, due to its strong encryption mechanism, traditional network security devices (such as firewalls and intrusion detection systems (IDS) cannot parse SSH encrypted traffic, leaving user actions in a regulatory blind spot. Attackers can exploit legitimate SSH sessions to carry out malicious activities (such as lateral movement and theft of sensitive files), and these behaviors are difficult to effectively identify and document, weakening the enterprise's security protection capabilities and the evidentiary support for judicial investigations.

[0004] Currently, the industry mainly uses the following three technical solutions for monitoring and decrypting SSH encrypted traffic, but all of them have significant limitations:

[0005] 1. Reliance on application-layer logs: User operation logs are collected using tools such as bash_history and auditd. However, high-privilege users can easily delete or tamper with these logs, and the log content may be incomplete, failing to meet the requirements for forensic evidence collection.

[0006] 2. Brute-force encryption of traffic: This attempt aims to recover the symmetric key of an SSH session. However, due to the extremely high strength of modern encryption algorithms, such as high-strength encryption algorithms (e.g., AES-256, ChaCha20-Poly1305) and key exchange mechanisms (e.g., ECDH, Curve25519), their key spaces are extremely large. The computational resources and time required for brute-force cracking far exceed the scope of practical feasibility, making it impractical in reality.

[0007] 3. Collect plaintext data at the source: capture plaintext data by deploying privileged proxy programs. Although this method can obtain complete session data, it is highly intrusive, requires modification of the system environment, affects stability, and is difficult to deploy in a multi-tenant cloud environment.

[0008] Furthermore, existing technical solutions (such as CN117201072A and CN106685896A) also have shortcomings: CN117201072A only obtains the user password and cannot decrypt the complete session traffic, lacking a comprehensive reconstruction of user operations. CN106685896A relies on a specific network topology and lacks integrity verification and packet reassembly mechanisms, limiting its applicability. Some technical solutions attempt to achieve key extraction and traffic monitoring by replacing the SSH server binary file (such as a customized sshd), modifying system configuration, or hijacking system calls. However, such methods compromise system integrity and auditability, potentially triggering security baseline alerts.

[0009] Therefore, current technologies cannot reliably decrypt and reconstruct SSH encrypted traffic without compromising system integrity, relying on unreliable logs, or resorting to brute-force attacks. A new technical solution is urgently needed that can overcome the regulatory blind spots created by SSH encryption while remaining legal and compliant, thereby enhancing the visualization and forensic capabilities of network security. Summary of the Invention

[0010] To address the technical problems of strong system invasiveness, low decryption reliability, and weak auditing capabilities in existing technologies, and to achieve non-intrusive decryption, complete restoration, and structured auditing of Secure Shell (SSH) encrypted traffic through legitimate means without modifying the Secure Shell server-side source code or binary files, this invention discloses a Secure Shell traffic forensic decryption method based on key injection. Specifically, the method includes the following steps:

[0011] S100. When the Secure Shell protocol server is running, a custom dynamic library is injected into the Secure Shell protocol process to intercept the key encryption function in the key exchange phase. During the execution of the key encryption function, the session key and Secure Shell protocol session negotiation parameters are obtained, and the session key is used as the shared key of the current session.

[0012] S200: Capture Secure Shell Protocol encrypted traffic in the network in real time, identify the encrypted traffic based on the TCP 5-tuple or Secure Shell Protocol session identifier, and reassemble IP fragments and TCP segments to obtain reassembled encrypted traffic;

[0013] S300. Match the shared key with the reconstructed encrypted traffic through session association information. Perform integrity verification on the reconstructed encrypted traffic based on the matched shared key and the Secure Shell Protocol session negotiation parameters. After the verification is successful, decrypt the traffic to generate a plaintext message.

[0014] S400. The plaintext message is parsed according to the channel type of the Secure Shell Protocol session, user operation semantic information is extracted to generate a structured operation record, and the record is classified and stored in combination with timestamp, session ID and user identifier to form audit evidence data that can be retrieved and traced back.

[0015] This invention also provides a secure shell protocol traffic forensics and decryption system based on key injection, including a key acquisition module, an encrypted traffic capture module, a decryption calculation module, and a data restoration module.

[0016] The key acquisition module is used to inject a custom dynamic library into the Secure Shell protocol process when the Secure Shell protocol server is running, intercept key encryption functions in the key exchange phase, obtain the session key and Secure Shell protocol session negotiation parameters during the execution of the key encryption function, and use the session key as the shared key for the current session.

[0017] The encrypted traffic capture module is used to capture Secure Shell Protocol encrypted traffic in the network in real time, identify the encrypted traffic based on the TCP 5-tuple or Secure Shell Protocol session identifier, and complete the reassembly of IP fragments and TCP segments to obtain reassembled encrypted traffic.

[0018] The decryption calculation module is used to match the shared key with the reconstructed encrypted traffic through session association information, and perform integrity verification on the reconstructed encrypted traffic based on the matched shared key and the Secure Shell Protocol session negotiation parameters. After the verification is passed, the traffic is decrypted to generate a plaintext message.

[0019] The data restoration module is used to parse the plaintext message according to the channel type of the Secure Shell Protocol session, extract user operation semantic information to generate structured operation records, and classify and store them in combination with timestamps, session IDs and user identifiers to form audit evidence data that can be retrieved and traced back.

[0020] The Secure Shell Protocol (SEP) traffic forensics and decryption method of the present invention achieves real-time decryption and structured reconstruction of SEP traffic by means of key injection, provided that the session shared key is legally obtained. This provides efficient and reliable technical support for network security monitoring, judicial evidence collection, and compliance auditing. Compared with existing technologies, the beneficial effects that at least one of the above-mentioned technical solutions adopted in the embodiments of this specification can achieve include at least the following:

[0021] 1. Obtain session keys without modifying the system: By dynamically loading custom dynamic libraries through the Linux system's LD_PRELOAD mechanism and injecting them into the SSH service process (such as sshd), the key encryption functions (such as EVP_PKEY_derive()) during the key exchange phase are intercepted. Without modifying the SSH server's binary files, configuration files, or source code, the session shared key can be extracted in real time, ensuring that the system integrity is not compromised. The deployment process is covert and compliant.

[0022] 2. Supports complete decryption and behavior restoration of multi-protocol sessions: This method can decrypt and semantically analyze various types of encrypted communication channels under the SSH protocol, including interactive shell sessions, SFTP file operations, SCP file transfers, etc., and realize the complete restoration of key operation behaviors such as user input commands, execution results, file paths, operation time, and permission changes, breaking through the limitations of traditional encrypted traffic "black box" monitoring.

[0023] 3. Supports real-time and offline dual-mode parsing: The method of this invention can be combined with high-speed packet capture technology (such as DPDK) to achieve real-time capture and decryption of encrypted traffic, and can also be connected to offline traffic files (such as PCAP) for backtracking analysis, meeting the security audit and incident investigation needs in different scenarios.

[0024] 4. Structured Reconstruction and Auditable Evidence Generation: The decrypted plaintext data is semantically parsed according to session type to extract structured fields (such as command, file name, source / target path, return code, timestamp, etc.), and combined with session ID and user identifier for classified storage, forming a time-continuous, logically complete, and searchable chain of operational evidence, providing original and reliable data support for network security audits, compliance inspections, and judicial evidence collection.

[0025] 5. Flexible deployment and strong compatibility: This method does not require the installation of privileged agents or kernel modules on the client or server side. It only requires the injection of a lightweight dynamic library on the server side to obtain the key. It is suitable for various operating environments such as physical machines, virtual machines, and containers. It is especially suitable for multi-tenant cloud platforms, third-party hosted devices and other permission-restricted scenarios. It has low deployment cost and minimal intrusion.

[0026] 6. No impact on normal business system operation: The key acquisition module runs as a user-space dynamic library, without modifying the core system components or interrupting the SSH service, thus avoiding operational risks caused by service restarts or system changes and ensuring business continuity.

[0027] In summary, the method and system of this invention achieve efficient, reliable, and controllable decryption of encrypted traffic using the Secure Shell protocol. It overcomes the technical bottlenecks of traditional encrypted communication monitoring without relying on brute-force attacks, unreliable logs, or compromising system integrity. By combining dynamic injection technology with a modular system architecture, it significantly improves the depth and accuracy of encrypted traffic analysis, addressing the shortcomings of existing technologies in terms of data acquisition completeness, deployment feasibility, and evidence credibility. This effectively enhances enterprises' capabilities in visually monitoring remote access behavior, tracing security incidents, and providing evidentiary support for judicial investigations, demonstrating significant innovative value and broad application prospects. Attached Figure Description

[0028] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 This is a flowchart of the Secure Shell Protocol Traffic Forensics and Decryption Method based on Key Injection of the present invention;

[0030] Figure 2 The flowchart for integrity verification and decryption;

[0031] Figure 3 A flowchart for creating searchable and traceable audit evidence data;

[0032] Figure 4 This is an architecture diagram of the Secure Shell Protocol Traffic Forensics and Decryption System based on Key Injection of the present invention;

[0033] Among them, 401 is the key acquisition module; 402 is the encrypted traffic capture module; 403 is the decryption calculation module; and 404 is the data restoration module. Detailed Implementation

[0034] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0035] The following specific examples illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. This application can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. It should be noted that, in the absence of conflict, the following embodiments and features of the embodiments can be combined with each other. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0036] The following is a description of the abbreviations and keywords used in this specific implementation:

[0037] Encrypted Tunnel: In computer networks, a logical channel established on a public network using encryption technology is used to securely transmit data between communicating parties.

[0038] Encrypted traffic refers to data traffic protected by encryption algorithms, whose plaintext content cannot be read directly without decryption.

[0039] Session Key: A symmetric encryption key temporarily generated during a session to protect communication security.

[0040] SCP (Secure Copy Protocol): A file transfer method based on an encrypted communication protocol for remote login, used for secure file copying between local and remote hosts.

[0041] SFTP (SSH File Transfer Protocol): A file transfer subsystem based on an encrypted communication protocol for remote login, supporting secure file upload, download, and directory management operations.

[0042] MAC verification (Message Authentication Code verification): An encryption technique used to verify the integrity and authenticity of messages. The sender generates a Message Authentication Code (MAC) based on the message content and a shared key. The receiver calculates the MAC using the same algorithm and key and compares it with the received MAC to determine whether the message has been tampered with or forged during transmission.

[0043] This invention provides a method for forensic decryption of Secure Shell Protocol traffic based on key injection. See [link to relevant documentation]. Figure 1 As shown, the method includes the following steps:

[0044] S100. When the Secure Shell protocol server is running, a custom dynamic library is injected into the Secure Shell protocol process to intercept the key encryption function in the key exchange phase. During the execution of the key encryption function, the session key and Secure Shell protocol session negotiation parameters are obtained, and the session key is used as the shared key of the current session.

[0045] S200: Capture Secure Shell Protocol encrypted traffic in the network in real time, identify the encrypted traffic based on the TCP 5-tuple or Secure Shell Protocol session identifier, and reassemble IP fragments and TCP segments to obtain reassembled encrypted traffic;

[0046] S300. Match the shared key with the reconstructed encrypted traffic through session association information. Perform integrity verification on the reconstructed encrypted traffic based on the matched shared key and the Secure Shell Protocol session negotiation parameters. After the verification is successful, decrypt the traffic to generate a plaintext message.

[0047] S400. The plaintext message is parsed according to the channel type of the Secure Shell Protocol session, user operation semantic information is extracted to generate a structured operation record, and the record is classified and stored in combination with timestamp, session ID and user identifier to form audit evidence data that can be retrieved and traced back.

[0048] In step S100, the key encryption functions include EVP_PKEY_CTX_new_id(), EVP_PKEY_derive(), and EVP_PKEY_derive_set_peer(). These key encryption functions are used to generate a session key after key exchange is completed. The custom dynamic library is injected into the Secure Shell protocol service process via the Linux system's LD_PRELOAD mechanism, without requiring modification of the Secure Shell protocol server's binary files or source code.

[0049] In one embodiment of step S100 above, the shared key is transmitted from the Secure Shell Protocol server to the decryption computing node through an encrypted channel, wherein the encrypted channel is a TLS tunnel, an encrypted Unix domain socket, or an access-controlled shared memory channel.

[0050] In one embodiment of step S200 above, the location for capturing / seizing the encrypted traffic includes the client's local machine, the network border gateway, or the port of a mirror switch. The encrypted traffic capture uses the DPDK library for high-speed packet acquisition and the libnDPI library for protocol identification and session differentiation.

[0051] In practice, the captured encrypted traffic can be identified and distinguished by the transport layer and application layer sessions, and then the data can be reassembled to ensure that continuous traffic can be received and processed in sequence during decryption.

[0052] In one embodiment of step S300 above, the integrity verification is performed based on the encryption mode determined by the Secure Shell Protocol session negotiation parameters, including:

[0053] When the encryption algorithm is in AEAD mode, verify the authentication tag of the reconstructed encrypted traffic;

[0054] When the encryption algorithm is not in AEAD mode, the HMAC value is calculated based on the negotiated message authentication code algorithm. The calculated HMAC value is then compared with the received HMAC value to complete the verification.

[0055] In one embodiment of step S300 above, see Figure 2 As shown, the process of integrity verification and decryption includes:

[0056] S310. Identify the currently used encryption algorithm and message authentication algorithm based on the Secure Shell Protocol session negotiation parameters;

[0057] S320. Initialize the local message sequence number counter based on the session association information to synchronize the local message sequence number with the message sequence number of the communication peer.

[0058] S330. Based on the encryption algorithm, the synchronized local message sequence number, and the communication peer message sequence number, perform an integrity check on the reconstructed encrypted traffic;

[0059] S340. The reconstructed encrypted traffic that has passed the integrity check is decrypted using the matching shared key and the encryption algorithm to generate a plaintext message.

[0060] In one embodiment of step S400 above, see Figure 3 As shown, the process of creating searchable and traceable audit evidence data includes:

[0061] S410. Classify the plaintext messages based on the session identifier and channel number, and establish independent message channels to distinguish between Shell sessions, SCP file transfers and SFTP operations.

[0062] S420. In the Shell session channel, identify terminal control characters and user input commands, extract the complete command line and its execution result, and generate an operation behavior record containing command content, timestamp and return code;

[0063] S430. In the SCP file channel, parse the control message to extract the source path, destination path, file name, file size and permission attributes, and generate file transfer audit entries;

[0064] S440. In the SFTP operation channel, parse the protocol operation code, identify upload, download, delete, directory browsing or permission modification operations, extract the operation path, file attributes and timestamp, and generate a fine-grained file operation log.

[0065] S450. The operation behavior records, the file transfer audit entries, and the fine-grained file operation logs are integrated and stored according to time series, user identifier, and session ID to form audit evidence data that can be retrieved and traced back.

[0066] In one embodiment of step S450 above, the establishment of the audit evidence data is based on a full-text search mechanism with an inverted index, which supports fast querying of commands, file names, and path keywords. The full-text search mechanism is implemented using the inverted index structure of Elasticsearch.

[0067] The present invention will provide a detailed description of the above method through the following examples:

[0068] First, capture the shared key (private key).

[0069] (1) Using the LD_PRELOAD mechanism provided by the Linux system, there is no need to modify the source code or binary files of the server. The custom dynamic library is automatically loaded into the address space of the service process (such as sshd) when it starts through the dynamic linker, which has good concealment and versatility.

[0070] (2) Intercepting critical functions during the key exchange phase: In the injection library, a function hook mechanism is used to intercept calls to critical encryption / decryption functions within the server. For example:

[0071] Session key generation functions (such as EVP_PKEY_CTX_new_id(), EVP_PKEY_derive(), EVP_PKEY_derive_set_peer());

[0072] (3) By intercepting key intermediate variables when these functions return, the symmetric session key for each session can be precisely located and extracted.

[0073] Secondly, capturing and reassembling Secure Shell Protocol encrypted traffic forms reconstructed encrypted traffic.

[0074] (1) On the client local, border gateway or mirror switch port, the underlying data packet capture is implemented through the dpdk library, which can capture all traffic in real time. If you want to reduce the data processing pressure, you can also capture only the encrypted traffic passing through a specific port (such as TCP / 22).

[0075] (2) Using libraries such as libndpi to perform protocol parsing, automatically identify different encrypted TCP sessions, and assign a unique identifier (Session ID) to each session.

[0076] (3) Reassemble IP fragments and TCP segments to ensure that the upper-layer decryption module receives the complete application layer data stream in order, and obtain the reassembled encrypted traffic.

[0077] (4) In addition, if data packets are lost, out of order, or the session is interrupted, retransmission compensation and order recovery mechanisms can be used to ensure stability in multi-session concurrent scenarios.

[0078] For example: "IP fragments are indexed and reassembled according to the Identification and fragment offset fields in the IP header; fragments are merged using a set of intervals sorted by offset; reassembly is considered complete when MF=0 is received and consecutive bytes from offset 0 are overwritten; a timeout recycling mechanism ensures that resources are not exhausted (timeout T_default=30s, configurable)."

[0079] "TCP reassembly uses a five-tuple to locate the connection and uses sequence numbers for placement and merging; it buffers out-of-order segments, processes retransmissions and overlapping segments according to a first-come-first-served strategy, and uses SACK information to assist in reclaiming received intervals; it sets a maximum buffer size for a single connection and a global buffer threshold to prevent memory exhaustion."

[0080] Next, the encrypted traffic is reassembled and decrypted to generate plaintext messages.

[0081] (1) Based on the secure shell protocol session negotiation parameters, the currently used encryption algorithm (such as AES-CTR, AES-GCM, ChaCha20-Poly1305, etc.) and message authentication algorithm (such as HMAC-SHA2 series) can be automatically identified.

[0082] (2) Decryption is performed using an identification algorithm:

[0083] Input the captured ciphertext traffic and the shared key into the corresponding decryption algorithm module;

[0084] During the decryption process, the local message sequence number is maintained and synchronized with the communication peer.

[0085] (3) Perform integrity checks according to different encryption methods:

[0086] During decryption, if the encryption algorithm itself has a verification mechanism (such as AES-GCM, ChaCha20-Poly1305), then its verification result is used directly.

[0087] If the encryption algorithm does not have a verification mechanism (such as AES-CTR), then verification is performed in conjunction with the negotiated message authentication algorithm (HMAC).

[0088] (4) Discard and handle errors of messages that fail to be verified to ensure that the output plaintext messages are completely consistent with the actual communication.

[0089] Finally, the plaintext messages are parsed, structured, and categorized for storage to obtain audit evidence data.

[0090] (1) Based on the session ID and channel ID obtained by session identification of encrypted traffic, plaintext packets are classified into different types of sub-sessions such as Shell, SCP, and SFTP;

[0091] (2) Parse the data payload of each sub-session according to the SSH protocol message format, and extract core fields such as commands, parameters, and file paths, including:

[0092] Shell session parsing: Extracts user-input commands (such as ls, cat, ssh, etc.) from interactive channel data; captures the return results of command execution and generates a complete operation behavior record according to the input-output correspondence; marks key operations (such as remote connection, system configuration modification, sensitive file access) to support subsequent risk auditing.

[0093] SCP File Transfer Parsing: Parses control messages of SCP sub-sessions to extract source path, destination path, file name, file size, and permission attributes; tracks transfer status (start, in progress, completed, failed, etc.) to form a file flow log; and can reassemble large file fragments during transfer to ensure consistency in recorded file size and content.

[0094] SFTP Session Parsing: Classifies and identifies SFTP file operation commands, including upload (PUT), download (GET), directory browsing, permission modification, deletion, etc.; extracts the corresponding file / directory paths, operation times, and operation results; and converts operation records into a unified structured event format (such as JSON) for further indexing and statistics.

[0095] (3) Data solidification and indexing: The parsing results are classified and stored according to metadata such as timestamp, session ID, channel number, and user identifier; a full-text index (such as an inverted index structure based on Elasticsearch) is established to support fast retrieval of keywords such as command, file name, and path.

[0096] (4) Generate a traceable chain of evidence to ensure that each operation corresponds to a specific session and time point.

[0097] (5) Display and interface: The output format supports multiple methods such as standardized log (Syslog), JSON, and database writing; it can be connected with the audit platform to realize automated report generation and risk warning; in addition, it can also provide a graphical display interface, which supports replaying the session process by timeline or displaying user operation characteristics in the form of statistical charts.

[0098] Based on the same inventive concept, this invention also provides a Secure Shell Protocol (SPP) traffic forensics and decryption system based on key injection, as described in the following embodiments. Since the principle of the SPP traffic forensics and decryption system based on key injection is similar to that of the SPP traffic forensics and decryption method based on key injection, the implementation of the SPP traffic forensics and decryption system based on key injection can refer to the implementation of the SPP traffic forensics and decryption method based on key injection disclosed in the above embodiments; repeated details will not be elaborated further. As used below, the terms "unit" or "module" can refer to a combination of software and / or hardware that performs a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0099] Figure 4 This is a structural block diagram of a secure shell protocol traffic forensics and decryption system based on key injection disclosed in an embodiment of the present invention, as shown below. Figure 4 As shown, the system includes a key acquisition module 401, an encrypted traffic capture module 402, a decryption calculation module 403, and a data restoration module 404. The structure is described below.

[0100] Among them, the key acquisition module 401 is used to inject a custom dynamic library into the Secure Shell protocol process when the Secure Shell protocol server is running, intercept the key encryption function in the key exchange phase, acquire the session key and Secure Shell protocol session negotiation parameters during the execution of the key encryption function, and use the session key as the shared key of the current session.

[0101] The encrypted traffic capture module 402 is used to capture Secure Shell Protocol encrypted traffic in the network in real time, identify the encrypted traffic based on the TCP 5-tuple or Secure Shell Protocol session identifier, and complete the reassembly of IP fragments and TCP segments to obtain reassembled encrypted traffic.

[0102] The decryption calculation module 403 is used to match the shared key with the reconstructed encrypted traffic through session association information, perform integrity verification on the reconstructed encrypted traffic based on the matched shared key and the Secure Shell Protocol session negotiation parameters, and decrypt the traffic to generate plaintext messages after the verification is passed.

[0103] The data restoration module 404 is used to parse the plaintext message according to the channel type of the Secure Shell Protocol session, extract user operation semantic information to generate structured operation records, and classify and store them in combination with timestamps, session IDs and user identifiers to form audit evidence data that can be retrieved and traced back.

[0104] In one embodiment, the key acquisition module 401 includes an injection controller, a key capturer, and a buffer / transmission unit.

[0105] The injection controller is responsible for injecting custom dynamic libraries. The key capture unit intercepts the encryption functions of the encrypted communication protocol during remote login and extracts the key. The buffer / transmission unit is responsible for securely transmitting the extracted key and metadata to the decryption calculation module 403.

[0106] In one embodiment, the encrypted traffic capture module 402 is deployed on a client or border gateway and includes a packet capture unit, a session reassembly unit, and a data output interface.

[0107] The packet capture unit is used to capture data packets during network transmission. While capturing TCP / IP layer packets, it extracts and records relevant metadata, including timestamps, source / destination addresses and ports, and sequence numbers. The session reassembly unit parses TCP sessions and reconstructs the complete data stream through sequential reassembly. Simultaneously, deep packet inspection or application layer protocol identification technologies can be used to distinguish and identify different encrypted communication protocol sessions for remote login.

[0108] The data output interface supports concurrent processing across multiple sessions, with each session independently buffered and sorted. It requests retransmission of lost or out-of-order packets or pads them according to TCP sequence numbers, and outputs the reassembled encrypted traffic in an orderly manner to the decryption calculation module 403 for decryption.

[0109] In one embodiment, the decryption calculation module 403 uses a shared key to decrypt the reconstructed encrypted traffic and ensures order and integrity, including a receiving unit, a key management unit, a decryption core unit, an order synchronization unit, and a plaintext output interface.

[0110] The receiver unit receives the shared key, metadata, and reconstructed encrypted traffic. The key management unit manages the received shared key and metadata. The decryption core unit decrypts the reconstructed encrypted traffic according to the negotiated encryption algorithm (AES-CTR, ChaCha20, etc.), synchronizes fragmentation according to TCP sequence numbers to ensure correct message order, and performs MAC verification on each reconstructed encrypted traffic to ensure integrity. The sequence synchronization unit ensures that fragmented data is output in order. The plaintext output interface outputs plaintext messages, including encrypted communication protocols such as Shell for remote login and SCP / SFTP file transfers. Each plaintext message includes metadata (session ID, channel number, timestamp).

[0111] In one embodiment, the data restoration module 404 includes a message parsing unit, an evidence solidification unit (including an operation behavior record generation unit, a file transfer audit entry generation unit, and a fine-grained file operation log generation unit), and an audit evidence data generation unit.

[0112] The message parsing unit is used to classify the plaintext messages based on the session identifier and channel number, and establish independent message channels to distinguish between Shell sessions, SCP file transfers and SFTP operations.

[0113] The operation behavior record generation unit is used to identify terminal control characters and user input commands in the Shell session channel, extract the complete command line and its execution result, and generate operation behavior records containing command content, timestamps and return codes.

[0114] The file transfer audit entry generation unit is used to parse control messages in the SCP file channel to extract source path, destination path, file name, file size and permission attributes, and generate file transfer audit entries.

[0115] The fine-grained file operation log generation unit is used in the SFTP operation channel to parse protocol operation codes, identify upload, download, delete, directory browsing or permission modification operations, extract operation paths, file attributes and timestamps, and generate fine-grained file operation logs.

[0116] The audit evidence data generation unit is used to integrate and store the operation behavior records, the file transfer audit entries, and the fine-grained file operation logs according to time series, user identifier, and session ID to form searchable and traceable audit evidence data.

[0117] The embodiments of this invention achieve the following technical effects: The method and system of this invention achieve efficient, reliable, and controllable decryption of encrypted traffic using the Secure Shell Protocol. Without relying on brute-force attacks, unreliable logs, or compromising system integrity, it overcomes the technical bottlenecks of traditional encrypted communication monitoring. By combining dynamic injection technology with a modular system architecture, it significantly improves the depth and accuracy of encrypted traffic analysis, addressing the shortcomings of existing technologies in terms of data acquisition completeness, deployment feasibility, and evidence credibility. It effectively enhances enterprises' capabilities in visual monitoring of remote access behavior, tracing security incidents, and providing evidentiary support for judicial evidence collection, demonstrating significant innovative value and broad application prospects.

[0118] In this embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any of the above-mentioned Secure Shell Protocol traffic forensics and decryption methods based on key injection.

[0119] Specifically, the computer device can be a computer terminal, a server, or a similar computing device.

[0120] In this embodiment, a computer-readable storage medium is provided, which stores a computer program that executes any of the above-described key injection-based Secure Shell Protocol traffic forensics and decryption methods.

[0121] Specifically, computer-readable storage media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer-readable storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable storage media does not include transient media, such as modulated data signals and carrier waves.

[0122] Obviously, those skilled in the art should understand that the modules or steps of the above-described embodiments of the present invention can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those presented here, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the embodiments of the present invention are not limited to any particular hardware and software combination.

[0123] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations can be made to the embodiments of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for forensic decryption of Secure Shell Protocol traffic based on key injection, characterized in that, include: When the Secure Shell protocol server is running, a custom dynamic library is injected into the Secure Shell protocol process to intercept the key encryption function during the key exchange phase. During the execution of the key encryption function, the session key and Secure Shell protocol session negotiation parameters are obtained, and the session key is used as the shared key for the current session. The system captures Secure Shell Protocol encrypted traffic in the network in real time, identifies the encrypted traffic based on the TCP 5-tuple or Secure Shell Protocol session identifier, and reassembles IP fragments and TCP segments to obtain reassembled encrypted traffic. The shared key is matched with the reconstructed encrypted traffic using session association information. Based on the matched shared key and the Secure Shell Protocol session negotiation parameters, the integrity of the reconstructed encrypted traffic is verified. If the verification passes, the traffic is decrypted to generate a plaintext message. The plaintext messages are parsed according to the channel type of the Secure Shell Protocol session, and user operation semantic information is extracted to generate structured operation records. These records are then classified and stored in combination with timestamps, session IDs, and user identifiers to form searchable and traceable audit evidence data. The key encryption functions include EVP_PKEY_CTX_new_id(), EVP_PKEY_derive(), and EVP_PKEY_derive_set_peer(), which are used to generate a session key after the key exchange is completed. The custom dynamic library is injected into the Secure Shell protocol service process through the Linux system's LD_PRELOAD mechanism, without requiring modification of the Secure Shell protocol server's binary files or source code.

2. The method for forensic decryption of Secure Shell Protocol traffic based on key injection according to claim 1, characterized in that, The shared key is transmitted from the Secure Shell Protocol server to the decryption computing node via an encrypted channel, which can be a TLS tunnel, an encrypted Unix domain socket, or an access-controlled shared memory channel.

3. The method for forensic decryption of Secure Shell Protocol traffic based on key injection according to claim 1, characterized in that, The encrypted traffic is captured from the client's local location, network border gateway, or mirror switch port. The encrypted traffic is captured using the DPDK library for high-speed data packet collection, combined with the libnDPI library for protocol identification and session differentiation.

4. The method for forensic decryption of Secure Shell Protocol traffic based on key injection according to claim 1, characterized in that, The integrity verification is performed based on the encryption mode determined by the Secure Shell Protocol session negotiation parameters, including: When the encryption algorithm is in AEAD mode, verify the authentication tag of the reconstructed encrypted traffic; When the encryption algorithm is not in AEAD mode, the HMAC value is calculated based on the negotiated message authentication code algorithm. The calculated HMAC value is then compared with the received HMAC value to complete the verification.

5. The method for forensic decryption of Secure Shell Protocol traffic based on key injection according to claim 1 or 4, characterized in that, The process of performing integrity verification and decryption includes: Based on the Secure Shell Protocol session negotiation parameters, identify the currently used encryption algorithm and message authentication algorithm; The local message sequence number counter is initialized based on the session association information to achieve synchronization between the local message sequence number and the message sequence number of the communication peer. Integrity verification is performed on the reconstructed encrypted traffic based on the encryption algorithm, the synchronized local message sequence number, and the communication peer message sequence number. The reconstructed encrypted traffic that passes the integrity check is decrypted using the matching shared key and the encryption algorithm to generate a plaintext message.

6. The method for forensic decryption of Secure Shell Protocol traffic based on key injection according to claim 1, characterized in that, The process of creating searchable and traceable audit evidence data includes: The plaintext messages are classified based on the session identifier and channel number, and independent message channels are established to distinguish between Shell sessions, SCP file transfers and SFTP operations. Within the Shell session channel, terminal control characters and user input commands are identified, complete command lines and their execution results are extracted, and operation behavior records containing command content, timestamps, and return codes are generated. In the SCP file channel, control messages are parsed to extract source path, destination path, file name, file size, and permission attributes, generating file transfer audit entries; In the SFTP operation channel, the protocol operation code is parsed to identify upload, download, delete, directory browsing or permission modification operations, extract the operation path, file attributes and timestamps, and generate fine-grained file operation logs; The operation behavior records, file transfer audit entries, and fine-grained file operation logs are integrated and stored according to time series, user identifier, and session ID to form searchable and traceable audit evidence data.

7. The method for forensic decryption of Secure Shell Protocol traffic based on key injection according to claim 6, characterized in that, The establishment of the audit evidence data is based on a full-text search mechanism using inverted indexes, which supports fast queries for commands, file names, and path keywords. The full-text search mechanism is implemented using Elasticsearch's inverted index structure.

8. A secure shell protocol traffic forensics and decryption system based on key injection, characterized in that, include: The key acquisition module is used to inject a custom dynamic library into the Secure Shell protocol process when the Secure Shell protocol server is running, intercept key encryption functions in the key exchange phase, acquire the session key and Secure Shell protocol session negotiation parameters during the execution of the key encryption functions, and use the session key as the shared key for the current session. The key encryption functions include EVP_PKEY_CTX_new_id(), EVP_PKEY_derive(), and EVP_PKEY_derive_set_peer(), which are used to generate session keys after key exchange is completed. The custom dynamic library is injected into the Secure Shell protocol service process through the LD_PRELOAD mechanism of the Linux system, without modifying the binary files or source code of the Secure Shell protocol server. The encrypted traffic capture module is used to capture Secure Shell Protocol encrypted traffic in the network in real time, identify the encrypted traffic based on the TCP 5-tuple or Secure Shell Protocol session identifier, and complete the reassembly of IP fragments and TCP segments to obtain reassembled encrypted traffic. The decryption calculation module is used to match the shared key with the reconstructed encrypted traffic through session association information, perform integrity verification on the reconstructed encrypted traffic based on the matched shared key and the Secure Shell Protocol session negotiation parameters, and decrypt the traffic to generate plaintext messages after the verification is passed. The data restoration module is used to parse the plaintext message according to the channel type of the Secure Shell Protocol session, extract user operation semantic information to generate structured operation records, and classify and store them in combination with timestamps, session IDs and user identifiers to form audit evidence data that can be retrieved and traced back.

9. The Secure Shell Protocol Traffic Forensics and Decryption System based on Key Injection according to claim 8, characterized in that, The data restoration module includes: The message parsing unit is used to classify the plaintext messages based on the session identifier and channel number, and establish independent message channels to distinguish between Shell sessions, SCP file transfers and SFTP operations. The operation behavior record generation unit is used to identify terminal control characters and user input commands in the Shell session channel, extract the complete command line and its execution result, and generate operation behavior records containing command content, timestamps and return codes. The file transfer audit entry generation unit is used to parse control messages in the SCP file channel to extract source path, destination path, file name, file size and permission attributes, and generate file transfer audit entries. The fine-grained file operation log generation unit is used to parse protocol operation codes in the SFTP operation channel, identify upload, download, delete, directory browsing or permission modification operations, extract operation paths, file attributes and timestamps, and generate fine-grained file operation logs. The audit evidence data generation unit is used to integrate and store the operation behavior records, the file transfer audit entries, and the fine-grained file operation logs according to time series, user identifier, and session ID to form searchable and traceable audit evidence data.

Images