An encryption traffic management method, system and terminal based on eBPF and HTTPS

Abstract

This invention provides a method, system, and terminal for encrypted traffic management based on eBPF and HTTPS, belonging to the field of data encryption technology. It constructs a one-to-many management and one-to-one execution architecture. Upon startup, the eBPF module is initialized, capturing handshake messages, acquiring data, and blocking connections through various probes and traffic filters. A policy synchronization and command transmission channel is established, with the agent terminal obtaining domain policies, sensitive word data, etc., from the server and synchronizing them to the eBPF module. The eBPF module collects connection information mapping relationships according to the policy and cleans them up when connections are disconnected. HTTPS connections are audited or blocked based on the policy and collected information. The audit results are logged and reported to the server for storage. The one-to-many management and one-to-one execution architecture improves system scalability and execution efficiency. Multiple probes and traffic filters achieve comprehensive data capture and precise blocking. The policy synchronization mechanism ensures timely policy updates, the auditing and blocking functions safeguard network security, and log reporting facilitates subsequent audit analysis.

Description

Technical Field

[0001] This invention belongs to the field of data encryption technology, specifically relating to an encrypted traffic management method, system, and terminal based on eBPF and HTTPS. Background Technology

[0002] Industries such as finance, government affairs, energy, and the internet are increasingly demanding strict data security requirements, and also require effective auditing of network communication content. As a native Linux kernel capability, eBPF has been implemented in scenarios such as cloud-native security, endpoint protection, and network micro-segmentation.

[0003] Among related technologies, policy-driven auditing and blocking schemes using HTTPS encrypted traffic are employed. HTTPS traffic auditing, through application-layer hooking, impacts performance and cannot reach the kernel / user-space encryption / decryption stages, resulting in missing plaintext before and after encryption and incomplete auditing. These technologies require network-layer interception, cannot block traffic in advance during the TLS handshake phase, and are difficult to implement based on fine-grained policies such as domain names and sensitive words, leading to low control precision. When processing large amounts of plaintext data, these technologies are time-consuming in scenarios with multiple sensitive words, failing to meet real-time auditing requirements. Furthermore, information is scattered across the TCP establishment, TLS handshake, and encrypted communication stages of HTTPS, making it difficult to correlate plaintext data, domain names, and four-tuples, hindering source tracing. Summary of the Invention

[0004] This invention provides an encrypted traffic management method based on eBPF and HTTPS. The method improves system scalability and execution efficiency through a one-to-many management and one-to-one execution architecture. Multiple probes and traffic filters enable comprehensive data capture and precise blocking. A policy synchronization mechanism ensures timely policy updates, while auditing and blocking functions safeguard network security.

[0005] The methods include:

[0006] S101: Establish a one-to-many control relationship between the terminal management server and multiple agent terminals, and configure a one-to-one execution relationship between the agent terminal and the eBPF module;

[0007] S102: When the Agent terminal starts up, it initializes the corresponding eBPF module, and uses probes and traffic filters to capture handshake messages, monitor status, obtain encrypted and decrypted data, and block data.

[0008] S103: Configure policy synchronization and command transmission channels based on the Agent terminal establishing communication links with the terminal management server and eBPF module respectively;

[0009] S104: The Agent terminal obtains the domain name policy, sensitive word data and sensitive word switch status from the terminal management server, synchronizes the domain name policy to the domain name policy storage structure of the eBPF module, and synchronizes the sensitive word data and switch status to the eBPF module.

[0010] S105: The eBPF module, based on the strategy enabled by S104, collects the mapping relationship of connection information through probes at each stage, and clears the mapping relationship and the corresponding quadruple information in the blocking list when the connection is disconnected.

[0011] S106: The eBPF module, based on the domain name policy and sensitive word switch status synchronized in S104, combined with the connection information and mapping relationship collected in S105, performs audit logging or blocking operations on the matched HTTPS connections.

[0012] S107: The Agent terminal organizes the audit results into log data containing connection information and sensitive words; the Agent terminal reports the log data to the terminal management server for storage.

[0013] Preferably, S101 specifically includes the following steps:

[0014] Configure network identification information on the terminal management server;

[0015] When the Agent terminal starts up, it sends a registration request to the terminal management server;

[0016] After receiving the registration request, the terminal management server authenticates the Agent terminal. Once the authentication is successful, the server stores the Agent terminal's identification information in the terminal management list and returns a registration response containing the server's identification to the Agent terminal.

[0017] The agent terminal reads the metadata of the eBPF modules installed on the local system and extracts the unique module identifier of the eBPF module.

[0018] The agent terminal creates a mapping file in the local storage medium, which records the correspondence between the agent terminal's own identifier and the extracted eBPF module's unique identifier.

[0019] The terminal management server sends a relationship verification command to the registered Agent terminal. The Agent terminal returns the eBPF module identifier and its own identifier stored locally. The terminal management server associates the corresponding relationship with the terminal management list and stores it, thus completing the construction of the control relationship and execution relationship.

[0020] Preferably, S102 specifically includes the following steps:

[0021] S1021: The eBPF module loads the tracepoint probe to the TCP socket state change tracing point to capture socket information during TCP connection establishment and termination;

[0022] S1022: The eBPF module attaches the uprobe and uretprobe probes to the SSL library functions to capture plaintext data during SSL object binding, domain name retrieval, and encryption / decryption processes;

[0023] S1023: The eBPF module attaches a traffic filtering program to the network interface and creates a blocking list mapping, providing an execution basis for link-layer packet blocking.

[0024] Preferably, S103 specifically includes the following steps:

[0025] S1031: The Agent terminal initializes the communication endpoint, creates two independent communication handles, one for communicating with the terminal management server and the other for communicating with the eBPF module; configures the local port multiplexing attribute and receive buffer size for the server communication handle, and associates kernel-mode mapping access permissions for the eBPF communication handle.

[0026] S1032: The Agent terminal creates an HTTPS client socket, configures a TLS encryption context, specifies the communication protocol, and initiates a connection request to the fixed service port of the terminal management server;

[0027] S1033: The Agent terminal calls the bpf_map_create function to create a communication buffer mapping of type BPF_MAP_TYPE_RINGBUF; configures the ring_buffer__poll listening function to grant buffer access permissions to the eBPF module, and specifies that the eBPF module submits data through the bpf_ringbuf_reserve function and the bpf_ringbuf_submit function;

[0028] S1034: The Agent terminal defines the data interaction rules for cross-module communication, agrees with the terminal management server on the tag specifications for XML messages, agrees with the eBPF module on the structure format of data in ringbuf, and determines that the operation mode when updating the eBPF mapping through the bpf_map_update_elem function is BPF_ANY.

[0029] Preferably, S104 specifically includes the following steps:

[0030] S1041: The Agent terminal sends a policy request message in XML format to the terminal management server through an HTTPS encrypted channel;

[0031] S1042: The Agent terminal receives and parses the XML response message from the terminal management server, and extracts the domain name list and sensitive word array;

[0032] S1043: The Agent terminal converts the domain name list into an LPM_TRIE key structure and synchronizes it to the https_policies mapping through eBPF mapping operations;

[0033] S1044: The Agent terminal sets the switch status based on the sensitive word array and constructs an Aho-Corasick dictionary tree, which is then synchronized to the corresponding mapping in the eBPF module.

[0034] Preferably, S105 specifically includes the following steps:

[0035] During the TCP connection establishment process, state changes are captured and a socketcookie-quadruple mapping is constructed;

[0036] Capture SSL object binding events and construct SSL object-socket cookie mappings during the TLS initialization phase;

[0037] If the sensitive word policy is enabled during the TIL handshake phase, a four-tuple-domain mapping is constructed.

[0038] During the encrypted communication phase, capture encrypted and decrypted data and construct a socket cookie-plaintext data mapping;

[0039] Clean up connection-related mappings during the TCP connection termination phase;

[0040] Update the blocking list when a control action is triggered or clear blocking entries when the connection is lost.

[0041] Preferably, S106 specifically includes the following steps:

[0042] S1061: The eBPF module completes domain policy matching by querying the https_policies mapping through the LPM_TRIE key during the TLS handshake phase;

[0043] S1062: The eBPF module queries the sensitive_words mapping during the TLS encrypted communication phase and applies the Aho-Corasick algorithm to complete sensitive word retrieval and connection tracing.

[0044] S1063: The eBPF module submits audit logs or updates the blacklist mapping through a circular buffer to perform blocking based on the matching and retrieval results.

[0045] Preferably, S105 further includes the following steps:

[0046] When a TCP connection is established, the eBPF module obtains socket cookie and four-tuple information through the tracepoint probe and writes the mapping relationship into connect_map;

[0047] During the TLS initialization phase, the eBPF module obtains the mapping between SSL object pointers and socket cookies through the uprobe probe during the SSL object binding phase, and writes the mapping into ssl_cookie_map;

[0048] During the TLS handshake phase, the eBPF module uses the uprobe / uretprobe probe to parse domain information in the host information acquisition function. When the sensitive word policy is enabled, it will establish a mapping relationship between four tuples and domain names and write it into the domain_map.

[0049] During the encrypted communication phase, the eBPF module obtains plaintext data through the uprobe and uretprobe probes, establishes a mapping relationship between the socket cookie and the plaintext data, and sends it to the Agent terminal through the wake-up buffer.

[0050] When a TCP connection is closed, the eBPF module cleans up the relevant mappings in connect_map, domain_map, and ssl_cookie_map using tracepoint probes.

[0051] When a connection is lost, the eBPF module also clears the blocking entries for the corresponding quadruple in the blacklist.

[0052] According to another embodiment of this application, an encrypted traffic management system based on eBPF and HTTPS is provided. The system includes: a terminal management server, an agent terminal, and an eBPF module.

[0053] Establish a one-to-many control relationship between the terminal management server and multiple agent terminals, and configure a one-to-one execution relationship between the agent terminals and the eBPF module;

[0054] When the Agent terminal starts up, it initializes the corresponding eBPF module, and uses probes and traffic filters to capture handshake messages, monitor status, acquire encrypted and decrypted data, and block data.

[0055] Configure policy synchronization and command transmission channels based on the Agent terminal establishing communication links with the terminal management server and the eBPF module respectively;

[0056] The Agent terminal obtains the domain name policy, sensitive word data, and sensitive word switch status from the terminal management server, synchronizes the domain name policy to the domain name policy storage structure of the eBPF module, and synchronizes the sensitive word data and switch status to the eBPF module.

[0057] The eBPF module, based on the synchronization strategy, collects the mapping relationship of connection information through probes at each stage, and clears the mapping relationship and the corresponding quadruple information in the blocking list when the connection is broken.

[0058] The eBPF module, based on synchronized domain name policies and sensitive word switch status, combined with collected connection information and mapping relationships, performs audit logging or blocking operations on matching HTTPS connections.

[0059] The agent terminal organizes the audit results into log data containing connection information and sensitive words;

[0060] The agent terminal reports the log data to the terminal management server for storage.

[0061] The present invention also provides an Agent terminal, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of an encrypted traffic management method based on eBPF and HTTPS.

[0062] As can be seen from the above technical solutions, the present invention has the following advantages:

[0063] This invention provides an encrypted traffic management method based on eBPF and HTTPS. The method constructs an architecture consisting of a terminal management server, an agent terminal, and an eBPF module. The agent interacts with the server and eBPF module, collecting handshake messages, plaintext, and status information at each stage of HTTPS through multiple eBPF probes. It synchronizes dynamic domain name / sensitive word policies, performs auditing or double blocking operations using eBPF, and the agent compiles logs and reports them to the server, achieving end-to-end encrypted traffic management and auditing. This invention achieves centralized management of multiple terminals and precise one-to-one execution, obtaining encrypted traffic plaintext and related information without modifying the kernel or application. It covers the entire HTTPS lifecycle, supports dynamic updates and real-time effects, and requires no module restart. The audit logs contain complete connection and sensitive word information, ensuring strong traceability. Attached Figure Description

[0064] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the description will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0065] Figure 1 A flowchart illustrating an encrypted traffic management method based on eBPF and HTTPS;

[0066] Figure 2 This is a schematic diagram of an encrypted traffic management system based on eBPF and HTTPS. Detailed Implementation

[0067] The encrypted traffic management method and system based on eBPF and HTTPS provided by this invention includes a terminal management server, an agent terminal, and an eBPF module. The terminal management server and agent terminals have a one-to-many relationship, including functions such as dynamically configuring policies and displaying log information. The agent terminal obtains policy information from the management system, executes the corresponding policy operations, and then formats the execution results into log information before reporting them to the management system. The agent terminal and the eBPF module have a one-to-one relationship; the eBPF module is the final executor of the policies. The agent formats the policies obtained from the terminal management server, synchronizes them to the eBPF module for execution, and synchronizes the execution results to the agent terminal, which then generates log information and reports it to the terminal management server.

[0068] The encrypted traffic management method based on eBPF and HTTPS involved in this application will be described in detail below. Specific details such as particular system architectures and technologies are presented for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application can also be implemented in other embodiments without these specific details.

[0069] It should be understood that, when used in this specification, the term "comprising" indicates the presence of the described feature, integral, step, operation, element, and / or component, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or collections thereof. The terms "comprising," "including," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0070] The terms "one embodiment" or "some embodiments" used in this application mean that one or more embodiments of this application include the specific features, structures, or characteristics described in that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this application do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized.

[0071] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0072] Please see Figure 1 The diagram shows a flowchart of an encrypted traffic management method based on eBPF and HTTPS in a specific embodiment. The method includes:

[0073] S101: Establish a one-to-many control relationship between the terminal management server and multiple agent terminals, and configure a one-to-one execution relationship between the agent terminals and the eBPF module.

[0074] S101 specifically includes the following steps:

[0075] S1011: The terminal management server configures network identification information, including fixed service port, unique server identifier and network communication protocol type.

[0076] This embodiment uses a preset port and a unique identifier to enable agent terminals to locate the terminal management server via network addressing and to verify the server's identity through the identifier, thus avoiding connection to unauthorized servers. It provides agent terminals with a clear network access point, ensuring that multiple agent terminals can accurately identify and connect to the same terminal management server.

[0077] S1012: When the Agent terminal starts up, it sends a registration request to the terminal management server. The registration request includes the Agent terminal's hardware identifier, operating system type, and network address information.

[0078] S1013: After receiving the registration request, the terminal management server authenticates the Agent terminal. If the authentication is successful, the server stores the Agent terminal's identification information in the terminal management list and returns a registration response containing the server's identification to the Agent terminal.

[0079] In some embodiments, after receiving a registration request, the terminal management server verifies whether the Agent terminal hardware identifier is in a preset license list. If the verification is successful, it adds an entry containing the Agent identifier, network address, and registration time to the terminal management list, and generates a registration response containing the server UUID and validity period, which is returned to the Agent terminal through a TLS encrypted channel.

[0080] S1014: The Agent terminal reads the metadata of the eBPF modules installed on the local system and extracts the unique module identifier of the eBPF module.

[0081] S1015: The Agent terminal creates a mapping file in the local storage medium, and the mapping file records the correspondence between the Agent terminal's own identifier and the extracted eBPF module unique identifier.

[0082] In some embodiments, the Agent terminal records the correspondence between the Agent's own hardware identifier and the eBPF module UUID extracted in S1014, and sets the file permissions to be read and written only by the Agent process. By storing the correspondence between the Agent and the eBPF module, the Agent terminal can restore the association after restarting or reloading the module, ensuring correct routing during policy synchronization and result feedback.

[0083] S1016: The terminal management server sends a relationship verification command to the registered agent terminal. The agent terminal returns the locally stored eBPF module identifier and its own identifier. The terminal management server associates and stores this corresponding relationship with the terminal management list, thus completing the construction of the control relationship and execution relationship.

[0084] In some embodiments, the terminal management server sends verification instructions to registered Agent terminals at preset intervals. The Agent terminal reads the mapping file from S1015 and returns its own identifier and eBPF module UUID. The terminal management server associates and stores the received correspondence with the Agent information in the terminal management list, forming a relationship chain. Real-time verification of the relationship's validity ensures that control policies are accurately delivered to the designated execution modules, improving system reliability.

[0085] S102: When the Agent terminal starts, it initializes the corresponding eBPF module, and uses probes and traffic filters to capture handshake messages, monitor status, obtain encrypted and decrypted data, and block data.

[0086] S102 specifically includes the following steps:

[0087] S1021: The Agent terminal calls the eBPF program loading interface to load the tracepoint probe program for the kernel inet_sock_set_state tracing point into the kernel, configures the probe capture parameters as a sock structure pointer and a state value, and sets the data capture process to be triggered only when the state changes to TCP_ESTABLISHED or TCP_CLOSED.

[0088] In some embodiments, inet_sock_set_state is the core tracking point for TCP socket state changes in the kernel, and all TCP connection state transitions pass through this tracking point.

[0089] A tracepoint probe passively monitors key state nodes throughout the entire lifecycle of a TCP connection by inserting a probe at the trace point. When preset state trigger conditions are met, the probe automatically captures and extracts the necessary socket information.

[0090] S1022: The Agent terminal uses eBPF user-space tools to parse the symbol table of the target SSL library (such as libssl.so), locate the memory addresses of the functions SSL_set_fd, ssl_get_servername, SSL_write, SSL_read, SSL_write_ex, and SSL_read_ex, mount uprobe probes for each function individually or combine uprobe and uretprobe probes, and configure the context data capture rules and memory data read permissions for each probe.

[0091] In some embodiments, the uprobe probe can be triggered when a user-space function is called, while the uretprobe probe is triggered when the function returns upon completion. Together, they cover the entire function execution process. By instrumenting core SSL-related functions, core data from each critical stage of HTTPS communication is captured—the binding relationship between the SSL pointer object and the socket cookie is the key link between encrypted communication and network connection. The probe in the ssl_get_servername function reliably obtains domain name information, while the probe combination in the encryption / decryption functions obtains the plaintext data before and after encryption. The data captured by each probe forms a data link through temporary mappings and associations.

[0092] S1023: The Agent terminal executes the tc command to create an HTB queue scheduling rule, attaches the eBPF traffic filter to the ingress and egress paths of all physical network interfaces on the host through the BPF_TC_CGROUP type, and sets the filter trigger priority to the highest in the system; at the same time, it calls the bpf_map_create function to create a blacklist hash map in kernel space, defines the key as a conn_key_t structure (containing saddr, daddr, sport, dport fields), the value as __u8 type, and configures the maximum number of entries as 1024.

[0093] In some embodiments, the TC filter operates at the network link layer, at the bottom of the TCP / IP protocol stack, and can intercept and analyze data packets before they are processed by application layer programs or sent to external networks.

[0094] The eBPF filtering program mounted in this embodiment parses each data packet that passes through, extracts the four-tuple information, constructs a key of type struct conn_key_t, and queries the blacklist mapping using the bpf_map_lookup_elem function. If a matching key exists with a value of 1, the data packet is discarded; otherwise, it is allowed to pass.

[0095] The blacklist mapping serves as the storage medium for blocking rules, providing the filtering program with real-time blocking judgment criteria. It can be seen that the highest priority setting ensures that the filtering program executes first, preventing blocking failure due to interference from other network rules. S103: Configure policy synchronization and command transmission channels based on the Agent terminal establishing communication links with the terminal management server and eBPF module respectively.

[0096] S103 specifically includes the following steps:

[0097] S1031: The Agent terminal initializes the communication endpoint, creates two independent communication handles, one for communicating with the terminal management server and the other for communicating with the eBPF module; configures the local port multiplexing attribute and receive buffer size for the server communication handle, and associates kernel-mode mapping access permissions for the eBPF communication handle.

[0098] In some embodiments, the communication endpoint is the node for data interaction, and the design of two independent handles achieves physical isolation of the communication links between the Agent and the server, and the eBPF module. Parameters such as port multiplexing and buffer size configuration are optimized based on the underlying characteristics of network communication to ensure the stability of link establishment.

[0099] S1032: The Agent terminal creates an HTTPS client socket, configures a TLS encryption context, specifies the communication protocol, and initiates a connection request to the fixed service port of the terminal management server. After the connection is established, it is agreed that the data exchange will be in XML format, and the message header will contain a 4-byte length field + a 1-byte message type field.

[0100] In some embodiments, the agent terminal can initialize the TLS encryption context based on the SSL_CTX_new function to ensure security. It then initiates a TCP connection to a fixed port on the server using the connect function. After the connection is established, a TLS handshake is completed using SSL_new and SSL_connect to establish an encrypted communication channel.

[0101] S1033: The Agent terminal calls the bpf_map_create function to create a communication buffer mapping of type BPF_MAP_TYPE_RINGBUF; configures the ring_buffer__poll listening function, grants buffer access permissions to the eBPF module, and specifies that the eBPF module submits data through the bpf_ringbuf_reserve function and the bpf_ringbuf_submit function.

[0102] In some embodiments, when the Agent terminal calls the `bpf_map_create` function, it specifies the map type as `BPF_MAP_TYPE_RINGBUF` to ensure that it can cache the large amount of data generated by the eBPF module in high-concurrency scenarios. A listening object is created using the `ring_buffer__new` function, and a data processing callback function is registered. When new data is available in the ringbuf, the callback function is automatically triggered and completes the data reading. Simultaneously, the Agent uses the `bpf_map_update_elem` function to write the ringbuf access permission configuration into the eBPF global mapping, allowing the eBPF module to call the `bpf_ringbuf_reserve` function to request a specified size of memory space. After filling the memory with data, the module submits the data to the buffer using the `bpf_ringbuf_submit` function. Once the submission is successful, the data becomes visible to the Agent.

[0103] S1034: The Agent terminal defines the data interaction rules for cross-module communication, agrees with the terminal management server on the tag specifications for XML messages, agrees with the eBPF module on the structure format of data in ringbuf, and determines that the operation mode when updating the eBPF mapping through the bpf_map_update_elem function is BPF_ANY.

[0104] In some embodiments, a unified protocol format and interaction rules are prerequisites for normal communication between different modules. XML tag specifications enable the parsing of complex data between the Agent and the server. The ringbuf data structure standardizes simple and efficient data interaction between eBPF and the Agent, with fixed type and length fields facilitating rapid parsing. Clearly defined interaction rules make the data transmission process clearer, and the adoption of the BPF_ANY mode improves the efficiency of policy synchronization.

[0105] S104: The Agent terminal obtains the domain name policy, sensitive word data, and sensitive word switch status from the terminal management server, synchronizes the domain name policy to the domain name policy storage structure of the eBPF module, and synchronizes the sensitive word data and switch status to the eBPF module.

[0106] In some embodiments, the Agent terminal acts as a policy relay station, converting the server's high-level policies into a data structure format recognizable by eBPF, thereby achieving policy adaptation and synchronization from the management end to the execution end.

[0107] S105: The eBPF module, based on the strategy enabled by S104, collects the mapping relationship of connection information through probes at each stage, and clears the mapping relationship and the corresponding quadruple information in the blocking list when the connection is disconnected.

[0108] In some embodiments, based on the HTTPS connection duration, key information is captured and mapped using probes at each stage. When the connection is closed, cleanup is performed in tandem to ensure data real-time performance and efficient memory utilization. This mapping relationship establishes information associations, which can be based on data, socket cookies, four-tuples, or domain names, ensuring system stability.

[0109] S106: Based on the domain name policy and sensitive word switch status synchronized in S104, the eBPF module, combined with the connection information and mapping relationship collected in S105, performs audit logging or blocking operations on the matched HTTPS connections.

[0110] In some embodiments, based on the policy in S104 and the mapping relationship in S105, auditing or blocking operations are triggered at each stage of HTTPS, and control is ensured to be effective by prioritizing blocking during the handshake stage and blocking at the link layer.

[0111] S107: The Agent terminal organizes the audit results into log data containing connection information and sensitive words, and reports the log data to the terminal management server for storage.

[0112] In some embodiments, the log information stored during the execution of audit and control actions is formatted into a format that facilitates communication, and then transmitted to the terminal management platform corresponding to the server through communication between the established Agent terminal and the terminal management system.

[0113] Optionally, a batch transmission and acknowledgment mechanism can be used to ensure reliable storage of logs from the Agent to the server, providing users with an access point for auditing data.

[0114] In one embodiment of the present invention, based on step S104, the following is a possible embodiment and its specific implementation will be described in a non-limiting manner. S104 specifically includes the following steps:

[0115] S1041: The Agent terminal sends a policy request message in XML format to the terminal management server through the established HTTPS encrypted channel.

[0116] In some embodiments, before initiating a policy request, the Agent terminal first reads its own hardware identifier and the policy version number from the local configuration file, and encapsulates them into an XML-formatted request body. Using an initialized TLS encryption context, the request body is converted into a byte stream, and the `write` function is called to send it to the fixed service port of the terminal management server.

[0117] S1042: The Agent terminal receives the XML-formatted policy response message returned by the terminal management server, parses the message to extract the domain name list and corresponding operation type, sensitive word array, and filters out the policy data.

[0118] In some embodiments, a detailed description is provided: After receiving the server response, the Agent terminal first reads the 4-byte length field of the header to determine the range of subsequent XML payload reading. After completing the data reading, it uses an XML parser to traverse the message nodes from... <domainpolicy>child tags <domain>and <action>The extracted domain name and corresponding operation type are filtered according to the screening policy, and the policy is 0 for no processing, 1 for auditing, and 2 for blocking. The extracted operation type is checked to filter out values other than 0, 1, and 2, ensuring that the policy data synchronized to eBPF is valid.

[0119] S1043: The agent terminal traverses the parsed domain name list, splits each domain name into multiple subdomain names according to the longest prefix matching rule, calculates the character length of each subdomain name as the prefix length, constructs an LPM_TRIE key structure containing a __u32 type prefix length and a char type domain name, and calls the bpf_map_update_elem function to synchronize the key-value pair to the https_policies mapping of the eBPF module in BPF_ANY mode.

[0120] In some embodiments, the https_policies mapping adopts the LPM_TRIE type, which implements efficient domain name retrieval based on the longest prefix matching algorithm, and requires the key structure to contain the prefix length and the domain name. The agent constructs the required key structure in advance and adapts the high-level domain name policy to the underlying data format that can be directly retrieved by the eBPF module. The BPF_ANY mode allows the coverage or addition of entries, realizing incremental updating of the policy.

[0121] S1044: The agent terminal checks the length of the sensitive word array. If the length is 0, a key-value pair of key=0, value=0 is constructed, and the bpf_map_update_elem function is called to write to the sensitive_words mapping of eBPF.

[0122] If the length is greater than 0, an Aho-Corasick dictionary tree is first constructed based on the sensitive word array, the node data and failure pointer table of the tree are serialized to a binary stream, and after verification of successful construction, value=1 is set and written to the sensitive_words mapping. The serialized data is synchronized to the ac_goto, ac_fail, and ac_out mappings of eBPF according to the structure definition.

[0123] In some embodiments, the sensitive_words mapping is of the HASH type, and the on / off state of the sensitive word strategy is stored through a fixed key = 0 to achieve fast control of the sensitive word strategy. The Aho-Corasick dictionary tree can convert multiple sensitive word retrieval into a single text scan, and the agent builds the dictionary tree in advance and serializes it. The essence is to convert the high-level sensitive word strategy into a retrieval model that can be directly executed by the eBPF module. The serialized data is synchronized according to the array mapping structure of eBPF, ensuring that eBPF can directly access the dictionary tree node information quickly through array indexing.

[0124] In an embodiment of the present application, based on step S105, a possible embodiment will be given below to specifically and non-limitingly illustrate the specific implementation thereof. S105 specifically comprises the following steps:

[0125] S1051: During the TCP connection establishment process, capture state changes and build a socket cookie-quadruple mapping.

[0126] It should be noted that the Agent terminal registers the return probe of socket_set_state through register_kretprobe, and the eBPF program is triggered when the kernel returns the TCP_ESTABLISHED state; the socketcookie and quadruple information are extracted through the first parameter of the function; and bpf_map_update_elem(connect_map_fd,&cookie,&quad,BPF_ANY) is called to write the mapping to connect_map.

[0127] S1052: Capture the SSL object binding event in the TLS initialization phase and build an SSL object-socket cookie mapping.

[0128] It should be noted that the eBPF module obtains the SSL* object through PT_REGS_PARM1 to analyze the first parameter, and obtains the socketfd through PT_REGS_PARM2; the sock structure information is obtained using the auxiliary function bpf_sock_from_fd; then the socketcookie is obtained according to the sock structure information using the auxiliary function bpf_get_socket_cookie; and finally, bpf_map_update_elem(&ssl_cookie_map,&ssl,&cookie,BPF_ANY) is called to write the mapping relationship between the SSL pointing object and the socketcookie to ssl_cookie_map.

[0129] S1053: If the sensitive word strategy is turned on, build the four tuple-domain name mapping in the TIL handshake phase;

[0130] It should be noted that in order to ensure the completeness of the mapping relationship, the eBPF module is processed in two steps. First, in the ssl_get_servername function execution phase (trigger uprobe probe), the tid is obtained by bpf_get_current_pid_tgid, the SSL* object parameter is obtained by PT_REGS_PARM1, and the mapping relationship between the tid and the SSL pointer object is built by calling bpf_map_update_elem(&tid_ssl_map,&tid,&ssl, BPF_ANY);

[0131] Then in the ssl_get_servername function return phase (trigger uretprobe probe), the tid is obtained by bpf_get_current_pid_tgid, the sni information is obtained and the domain name is parsed by calling bpf_probe_read_user_str(bpf_sni_buffer, sizeof(bpf_sni_buffer), user_sni_ptr); The domain name is retrieved in http_policies by calling bpf_map_lookup_elem, and if it is included, the audit / blocking action is performed according to the policy;

[0132] If the sensitive word strategy is turned on, the following actions are continued to be performed:

[0133] The SSL* object is obtained from the tid_ssl_map according to the tid by calling bpf_map_lookup_elem(&tid_ssl_map,&tid), the socketcookie is queried from the ssl_cookie_map by calling bpf_map_lookup_elem, and then the four tuple is obtained, and the mapping relationship between the four tuple and the domain name is written into the domain_map by using bpf_map_update_elem(&domain_map,&tuple,domain,BPF_ANY).

[0134] S1054: Capture encryption and decryption data in the encrypted communication phase and build socketcookie-plaintext data mapping;

[0135] It should be noted that the uprobe probe captures the buf at the SSL_write / SSL_write_ex entry, the uretprobe captures the buf when SSL_read / SSL_read_ex returns, the socket cookie corresponding to the SSL object is queried through ssl_cookie_map, and {socketcookie, plaintext, pid} is sent to the application layer by using bpf_ringbuf_submit.

[0136] S1055: Clean up the connection-related mapping relationship in the TCP connection disconnection stage.

[0137] S1056: Update the blocking list when the control action is triggered or clean up the blocking entry when the connection is disconnected.

[0138] It should be noted that the blacklist, as a blocking list, supports fast query of connections that need to be blocked; through write and delete operations, the timeliness of the blocking list is maintained, and it is ensured that only active illegal connections are blocked.

[0139] In an embodiment of the present application, based on step S105, a possible embodiment will be given below to non-restrictively describe the specific implementation scheme of the embodiment. S105 further includes the following steps:

[0140] S2051: When the tracepoint probe of the eBPF module is called and it is detected that the state is TCP_ESTABLISHED, the socketcookie and the four-tuple information are extracted from the sock structure, and the bpf_map_update_elem function is called to write the four-tuple corresponding to the socketcookie into the connect_map.

[0141] The four-tuple information relates to saddr, daddr, sport, and dport.

[0142] S2052: When the uprobe probe of the eBPF module is called, the SSL object pointer and the socketcookie are extracted from the parameters, the bpf_map_update_elem function is called to write the socketcookie corresponding to the SSL into the ssl_sookie_map, and the mapping type is defined as BPF_MAP_TYPE_HASH.

[0143] S2053: The uprobe / uretprobe probe of the eBPF module obtains the host information from the user space and resolves the domain name when the ssl_get_server function is called, obtains the socket cookie through an auxiliary function to obtain the four-tuple, and then establishes the mapping of the four-tuple and the domain name to write the domain_map.

[0144] S2054: The uprobe / uretprobe probe of the eBPF module extracts the plaintext data before / after encryption / decryption, the SSL object pointer, and the process PID when the SSL_write / SSL_read function is called and returned, queries the ssl_cookie_map through bpf_map_lookup_elem to obtain the corresponding socketfd, establishes the temporary mapping of the socket cookie and the plaintext data, and writes the mapping and the PID to the ring buffer through the bpf_ringbuf_submit function.

[0145] S2055: The tracepoint probe of the eBPF module extracts the socket cookie from the sock structure when the socket_set_state function returns and detects that the state is TCP_CLOSE, queries the connect_map through bpf_map_lookup_elem to obtain the corresponding four-tuple, and sequentially deletes the socket cookie and the corresponding four-tuple in the connect_map, the four-tuple in the domain_map, and the mapping of the associated SSL and socket cookie in the ssl_cookie_map through bpf_map_delete_elem.

[0146] S2056: The eBPF module queries whether the four-tuple exists in the blacklist through bpf_map_lookup_elem while executing S1055, and deletes the corresponding entry through bpf_map_delete_elem if it exists.

[0147] It should be noted that when the state becomes TCP_ESTABLISHED, the tracepoint probe captures the key information, and the socketcookie is bound to the four-tuple through HASH mapping. In S1052, after the TLS initialization is completed, the binding of the SSL object and the socketfd is a fixed operation, and the socketfd corresponds to a unique socketcookie. The uprobe probe captures the association relationship at this link, and stores it through HASH mapping, so that the corresponding socketcookie can be quickly located through the SSL object in the encryption communication stage. S1053 combines the update in the TLS handshake stage and the process of obtaining the host domain name information, and the domain name of the current connection can be obtained; combined with the sensitive word strategy switch, only when needed, the mapping of the four-tuple and the domain name is stored. S1054 captures the plaintext data at the entry and return point of the SSL encryption and decryption function, binds the plaintext data to the socketcookie of the connection in combination with the mapping of the SSL object and the socketcookie, and transmits the plaintext data to the application layer through the ring buffer without locking, so as to realize the transmission of the data collected in the kernel mode to the user mode. S1055 defines that the connection disconnection is the end point of the connection cycle, and takes this as the trigger point, based on the initially established socketcookie and the four-tuple mapping, all associated mapping entries are traced back and deleted, so as to ensure the integrity of the resource release. S1056 cleans up the expired data through timing check and timeout threshold judgment, and enhances the resource management capability of the system.

[0148] In an embodiment of the present application, based on step S106, a possible embodiment will be given below to illustrate the specific implementation of the embodiment. S106 specifically includes the following steps:

[0149] S1061: After the eBPF module captures the domain name in the TLS handshake stage, the domain name is split into multi-level subdomain names according to the longest prefix matching rule, an LPM_TRIE key structure containing the prefix length and the domain name is constructed, the bpf_map_lookup_elem function is called to query the https_policies mapping, the corresponding operation type is extracted if the matching is successful, 1 for auditing and 2 for blocking, and no subsequent action is performed if the matching is unsuccessful.

[0150] S1062: After capturing plaintext data during the TLS encrypted communication phase, the eBPF module reads the switch status of the sensitive_words mapping. If the status is 1, it calls the Aho-Corasick automaton algorithm to retrieve the plaintext. When a sensitive word is found, it queries the ssl_cookie_map through the current SSL * object to obtain the socket cookie, then queries the connect_map through the cookie to obtain the four-tuple, and further queries the domain_map to obtain the domain name, thus completing the tracing of the plaintext and the HTTPS connection.

[0151] S1063: The eBPF module performs corresponding actions based on the domain name policy matching results of S1061 or the sensitive word search results of S1062: For auditing, it encapsulates the connection information (domain name / quadruple, PID, action type) into a structure and calls the bpf_ringbuf_reserve and bpf_ringbuf_submit functions to submit it to ringbuf; for blocking, it constructs a conn_key_t structure from the quadruple, calls the bpf_map_update_elem function to write it to the blacklist mapping in BPF_ANY mode, and the tc filter performs data blocking.

[0152] As can be seen, the LPM_TRIE mapping inherently supports the longest prefix matching feature. By splitting domain names to construct a multi-level key structure, it can match the domain name policies issued by the server. Query operations leverage the efficient retrieval capabilities of kernel-mode mapping, directly completing policy matching within the eBPF program to ensure matching efficiency. The Aho-Corasick automaton, through a pre-built trie and failure pointers, achieves single-pass matching of multiple sensitive words, with retrieval efficiency unaffected by the number of sensitive words. BPF ringbuf enables efficient data transmission between kernel and user modes. The blacklist mapping, serving as the storage carrier for blocking rules, works in conjunction with tcfilter: tcfilter operates at the link layer, preferentially intercepting packets upon their entry or exit from the host, achieving fast filtering through four-tuple matching.

[0153] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0154] The following are embodiments of an encrypted traffic management system based on eBPF and HTTPS provided in this disclosure. This system and the encrypted traffic management methods based on eBPF and HTTPS in the above embodiments belong to the same inventive concept. For details not described in detail in the embodiments of the encrypted traffic management system based on eBPF and HTTPS, please refer to the embodiments of the encrypted traffic management methods based on eBPF and HTTPS described above.

[0155] like Figure 2 As shown, the system includes: a terminal management server 101, an agent terminal 102, and an eBPF module 103;

[0156] Establish a one-to-many control relationship between the terminal management server 101 and multiple agent terminals 102, and configure a one-to-one execution relationship between the agent terminal 102 and the eBPF module;

[0157] When the Agent terminal starts up, it initializes the corresponding eBPF module 103, and uses probes and traffic filters to capture handshake messages, monitor status, acquire encrypted and decrypted data, and block data.

[0158] Configure policy synchronization and command transmission channels based on the Agent terminal establishing communication links with the terminal management server 101 and the eBPF module 103 respectively;

[0159] Agent terminal 102 obtains domain name policy, sensitive word data and sensitive word switch status from terminal management server 101, synchronizes the domain name policy to the domain name policy storage structure of eBPF module 103, and synchronizes the sensitive word data and switch status to eBPF module 103.

[0160] eBPF module 103, based on the synchronization strategy enabled state, collects the mapping relationship of connection information through probes at each stage, and clears the mapping relationship and the corresponding quadruple information in the blocking list when the connection is disconnected;

[0161] eBPF module 103, based on synchronized domain name policies and sensitive word switch status, combined with collected connection information and mapping relationships, performs audit logging or blocking operations on matched HTTPS connections.

[0162] The agent terminal organizes the audit results into log data containing connection information and sensitive words;

[0163] The Agent terminal reports the log data to the terminal management server 101 for storage.

[0164] This application also provides an Agent terminal, including a display module, a memory, a processor, a communication module, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps of an encrypted traffic control method based on eBPF and HTTPS.

[0165] In embodiments of the present invention, electronic devices include, but are not limited to, laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic devices may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the embodiments described and / or claimed herein.

[0166] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.< / action> < / domain> < / domainpolicy>

Claims

1. A method for encrypted traffic management based on eBPF and HTTPS, characterized in that, The methods include: S101: Establish a one-to-many control relationship between the terminal management server and multiple agent terminals, and configure a one-to-one execution relationship between the agent terminal and the eBPF module; S102: When the Agent terminal starts up, it initializes the corresponding eBPF module, and uses probes and traffic filters to capture handshake messages, monitor status, obtain encrypted and decrypted data, and block data. S103: Configure policy synchronization and command transmission channels based on the Agent terminal establishing communication links with the terminal management server and eBPF module respectively; S104: The Agent terminal obtains the domain name policy, sensitive word data and sensitive word switch status from the terminal management server, synchronizes the domain name policy to the domain name policy storage structure of the eBPF module, and synchronizes the sensitive word data and switch status to the eBPF module. S105: The eBPF module, based on the strategy enabled by S104, collects the mapping relationship of connection information through probes at each stage, and clears the mapping relationship and the corresponding quadruple information in the blocking list when the connection is disconnected. S105 specifically includes the following steps: During the TCP connection establishment process, state changes are captured and a socketcookie-quadruple mapping is constructed; Capture SSL object binding events and construct SSL object-socket cookie mappings during the TLS initialization phase; If the sensitive word policy is enabled during the TIL handshake phase, a four-tuple-domain mapping is constructed. During the encrypted communication phase, capture encrypted and decrypted data and construct a socket cookie-plaintext data mapping; Clean up connection-related mappings during the TCP connection termination phase; Update the blocking list when a control action is triggered or clear blocking entries when the connection is lost; S105 also includes the following steps: When a TCP connection is established, the eBPF module obtains socket cookie and four-tuple information through the tracepoint probe and writes the mapping relationship into connect_map; During the TLS initialization phase, the eBPF module obtains the mapping between SSL object pointers and socket cookies through the uprobe probe during the SSL object binding phase, and writes the mapping into ssl_cookie_map; During the TLS handshake phase, the eBPF module uses the uprobe / uretprobe probe to parse domain information in the host information acquisition function. When the sensitive word policy is enabled, it will establish a mapping relationship between four tuples and domain names and write it into the domain_map. During the encrypted communication phase, the eBPF module obtains plaintext data through the uprobe and uretprobe probes, establishes a mapping relationship between the socket cookie and the plaintext data, and sends it to the Agent terminal through the wake-up buffer. When a TCP connection is closed, the eBPF module cleans up the relevant mappings in connect_map, domain_map, and ssl_cookie_map using tracepoint probes. When a connection is lost, the eBPF module also clears the blocking entry for the corresponding quadruple in the blacklist. S106: The eBPF module, based on the domain name policy and sensitive word switch status synchronized in S104, combined with the connection information and mapping relationship collected in S105, performs audit logging or blocking operations on the matched HTTPS connections. S107: The Agent terminal organizes the audit results into log data containing connection information and sensitive words; the Agent terminal reports the log data to the terminal management server for storage.

2. The encrypted traffic management method based on eBPF and HTTPS according to claim 1, characterized in that, S101 specifically includes the following steps: Configure network identification information on the terminal management server; When the Agent terminal starts up, it sends a registration request to the terminal management server; After receiving the registration request, the terminal management server authenticates the Agent terminal. Once the authentication is successful, the server stores the Agent terminal's identification information in the terminal management list and returns a registration response containing the server's identification to the Agent terminal. The agent terminal reads the metadata of the eBPF modules installed on the local system and extracts the unique module identifier of the eBPF module. The agent terminal creates a mapping file in the local storage medium, which records the correspondence between the agent terminal's own identifier and the extracted eBPF module's unique identifier. The terminal management server sends a relationship verification command to the registered Agent terminal. The Agent terminal returns the eBPF module identifier and its own identifier stored locally. The terminal management server associates the corresponding relationship with the terminal management list and stores it, thus completing the construction of the control relationship and execution relationship.

3. The encrypted traffic management method based on eBPF and HTTPS according to claim 1, characterized in that, S102 specifically includes the following steps: S1021: The eBPF module loads the tracepoint probe to the TCP socket state change tracing point to capture socket information during TCP connection establishment and termination; S1022: The eBPF module attaches the uprobe and uretprobe probes to the SSL library functions to capture plaintext data during SSL object binding, domain name retrieval, and encryption / decryption processes; S1023: The eBPF module attaches a traffic filtering program to the network interface and creates a blocking list mapping, providing an execution basis for link-layer packet blocking.

4. The encrypted traffic management method based on eBPF and HTTPS according to claim 1, characterized in that, S103 specifically includes the following steps: S1031: The Agent terminal initializes the communication endpoint, creates two independent communication handles, one for communicating with the terminal management server and the other for communicating with the eBPF module; configures the local port multiplexing attribute and receive buffer size for the server communication handle, and associates kernel-mode mapping access permissions for the eBPF communication handle. S1032: The Agent terminal creates an HTTPS client socket, configures a TLS encryption context, specifies the communication protocol, and initiates a connection request to the fixed service port of the terminal management server; S1033: The Agent terminal calls the bpf_map_create function to create a communication buffer mapping of type BPF_MAP_TYPE_RINGBUF; configures the ring_buffer__poll listening function to grant buffer access permissions to the eBPF module, and specifies that the eBPF module submits data through the bpf_ringbuf_reserve function and the bpf_ringbuf_submit function; S1034: The Agent terminal defines the data interaction rules for cross-module communication, agrees with the terminal management server on the tag specifications for XML messages, agrees with the eBPF module on the structure format of data in ringbuf, and determines that the operation mode when updating the eBPF mapping through the bpf_map_update_elem function is BPF_ANY.

5. The encrypted traffic management method based on eBPF and HTTPS according to claim 1, characterized in that, S104 specifically includes the following steps: S1041: The Agent terminal sends a policy request message in XML format to the terminal management server through an HTTPS encrypted channel; S1042: The Agent terminal receives and parses the XML response message from the terminal management server, and extracts the domain name list and sensitive word array; S1043: The Agent terminal converts the domain name list into an LPM_TRIE key structure and synchronizes it to the https_policies mapping through eBPF mapping operations; S1044: The Agent terminal sets the switch status based on the sensitive word array and constructs an Aho-Corasick dictionary tree, which is then synchronized to the corresponding mapping in the eBPF module.

6. The encrypted traffic management method based on eBPF and HTTPS according to claim 1, characterized in that, S106 specifically includes the following steps: S1061: The eBPF module completes domain policy matching by querying the https_policies mapping through the LPM_TRIE key during the TLS handshake phase; S1062: The eBPF module queries the sensitive_words mapping during the TLS encrypted communication phase and applies the Aho-Corasick algorithm to complete sensitive word retrieval and connection tracing. S1063: The eBPF module submits audit logs or updates the blacklist mapping through a circular buffer to perform blocking based on the matching and retrieval results.

7. An encrypted traffic management system based on eBPF and HTTPS, characterized in that, The system is used to implement the encrypted traffic management method based on eBPF and HTTPS as described in any one of claims 1 to 6; the system includes: a terminal management server, an Agent terminal, and an eBPF module; Establish a one-to-many control relationship between the terminal management server and multiple agent terminals, and configure a one-to-one execution relationship between the agent terminals and the eBPF module; When the Agent terminal starts up, it initializes the corresponding eBPF module, and uses probes and traffic filters to capture handshake messages, monitor status, acquire encrypted and decrypted data, and block data. Configure policy synchronization and command transmission channels based on the Agent terminal establishing communication links with the terminal management server and the eBPF module respectively; The Agent terminal obtains the domain name policy, sensitive word data, and sensitive word switch status from the terminal management server, synchronizes the domain name policy to the domain name policy storage structure of the eBPF module, and synchronizes the sensitive word data and switch status to the eBPF module. The eBPF module, based on the synchronization strategy, collects the mapping relationship of connection information through probes at each stage, and clears the mapping relationship and the corresponding quadruple information in the blocking list when the connection is broken. The eBPF module, based on synchronized domain name policies and sensitive word switch status, combined with collected connection information and mapping relationships, performs audit logging or blocking operations on matching HTTPS connections. The agent terminal organizes the audit results into log data containing connection information and sensitive words, and reports the log data to the terminal management server for storage.

8. An agent terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the encrypted traffic management method based on eBPF and HTTPS as described in any one of claims 1 to 6.

Images