Terminal certificate state abnormity monitoring method and device based on traffic analysis, electronic equipment and storage medium

Abstract

The invention discloses a terminal certificate state abnormity monitoring method and device based on flow analysis, electronic equipment and a storage medium, and belongs to the field of network security monitoring, and the method comprises the steps: obtaining a certificate load message and current system time sent by a network access terminal in a key exchange process; analyzing the message to obtain a certificate public key, certificate deadline and a device unique identifier, and calling a historical fingerprint sequence from a local database according to the device unique identifier; performing hash processing on the certificate public key to generate a current public key fingerprint, comparing the current public key fingerprint with a historical fingerprint sequence, and calculating a difference value between certificate deadline and current system time to complete timeliness verification; and integrating the certificate state verification result and the certificate timeliness verification result, determining the current security state of the network access terminal, and generating a state monitoring report. According to the invention, the problem that the terminal certificate historical consistency abnormity cannot be identified in the prior art can be solved.

Description

Technical Field

[0001] This invention relates to the field of network security monitoring technology, specifically to a method, device, electronic device, and storage medium for monitoring abnormal terminal certificate status based on traffic parsing. Background Technology

[0002] With the widespread adoption of network security protocols (such as IKE), agentless monitoring technology based on traffic analysis has become an important means of identifying access terminals and ensuring perimeter security. This technology captures and analyzes certificate payload messages sent by terminals in real time, enabling immediate monitoring of the legitimacy of the certificates held by the terminals. It is currently the mainstream method for sensing device access status in network operations and maintenance.

[0003] However, existing monitoring methods typically employ an isolated verification approach for single captured packets, focusing primarily on certificate validity metrics such as the correctness of the signature and the compliance of the validity period at the time of capture. They lack historical benchmark verification dimensions independent of the single handshake. This means the monitoring system cannot establish a logical connection between current data and the terminal's past historical records. Therefore, when a terminal experiences malicious certificate rollback or unauthorized replacement, as long as the old or replacement certificate is still valid, existing monitoring methods cannot detect sudden changes in certificate status over time and thus struggle to identify such historical inconsistencies, resulting in logical blind spots in security monitoring. Summary of the Invention

[0004] This invention provides a method, apparatus, electronic device, and storage medium for monitoring abnormal terminal certificate status based on traffic parsing, which can solve the problem in the prior art that the historical consistency anomalies of terminal certificates cannot be identified because only isolated verification of a single message is performed.

[0005] An embodiment of the present invention provides a method for monitoring terminal certificate status anomalies based on traffic parsing, comprising: Real-time acquisition of certificate payload messages sent by network access terminals during Internet key exchange and the current system time; When each certificate payload message is acquired, the certificate public key, certificate expiration time, and device unique identifier are parsed from the certificate payload message, and the corresponding historical fingerprint sequence is extracted from the preset local database using the device unique identifier. The certificate public key is hashed to generate the current public key fingerprint, and the current public key fingerprint is compared with the historical fingerprint sequence to generate the certificate status verification result. Calculate the difference between the certificate expiration time and the current system time, and generate a certificate validity verification result based on the difference; Based on the certificate status verification results and certificate validity verification results, the current security status of the network access terminal is determined, and if the current security status is determined to be abnormal, a status monitoring report containing an abnormality type identifier is generated.

[0006] Furthermore, after determining the current security status of the network access terminal based on the certificate status verification results and certificate validity verification results, and generating a status monitoring report containing an anomaly type identifier when the current security status is determined to be abnormal, the process also includes: Extract the most recently stored chained hash value corresponding to the unique identifier of the device from the local database; The recently stored chained hash value is concatenated with the current public key fingerprint in binary format and then hashed to generate the current node's chained hash value, which is then appended to the local database to update the local database.

[0007] Furthermore, the step of concatenating the most recently stored chained hash value with the current public key fingerprint in binary format and performing hash processing to generate the current node's chained hash value and appending it to the local database to update the local database includes: The most recently stored chained hash values ​​are format-normalized and converted into a first binary data stream with a unified encoding format; The current public key fingerprint is standardized and converted into a second binary data stream with a unified encoding format. The second binary data stream is appended to the end of the first binary data stream to obtain the appended data block to be calculated; A hash algorithm is used to perform a digest calculation on the concatenated data block to obtain a fixed-length string as the chain hash value of the current node; Construct an index record containing the current node's chained hash value, the current system time, and the device's unique identifier, and append the index record to the local database.

[0008] Furthermore, the process of hashing the certificate public key to generate the current public key fingerprint, and then performing a set inclusion comparison between the current public key fingerprint and the historical fingerprint sequence to generate a certificate status verification result includes: The certificate public key is calculated according to a preset hash algorithm to obtain the current public key fingerprint; Determine whether there is a fingerprint in the historical fingerprint sequence that is the same as the current public key fingerprint. If not, generate a certificate status verification result indicating that the certificate has changed. If so, extract the most recent storage record from the historical fingerprint sequence and determine whether the current public key fingerprint is the same as the most recent storage record. If the current public key fingerprint is the same as the most recent stored record, generate a certificate status verification result indicating the continuity of the certificate status; If the current public key fingerprint is different from the most recent stored record, a certificate status verification result indicating that a certificate history rollback has occurred is generated.

[0009] Furthermore, the calculation of the difference between the certificate expiration time and the current system time, and the generation of a certificate validity verification result based on the difference, includes: Subtract the current system time from the certificate expiration time to obtain the time difference; Determine whether the time difference is less than zero; if yes, generate a certificate validity verification result indicating that the certificate has expired; if no, determine whether the time difference is less than a preset near-expiration alarm threshold. If the time difference is less than the near-expiration alarm threshold, a certificate validity verification result indicating that the certificate is about to expire is generated; If the time difference is not less than the near-expiration alarm threshold, a certificate validity verification result indicating that the certificate is within its validity period is generated.

[0010] Based on the above method embodiments, the present invention provides corresponding apparatus embodiments.

[0011] An embodiment of the present invention provides a terminal certificate status anomaly monitoring device based on traffic parsing, comprising: a data acquisition module, a parsing and extraction module, a certificate status verification module, a timeliness verification module, and a status monitoring module; The data acquisition module is used to acquire, in real time, the certificate payload message sent by the network access terminal during the Internet key exchange process and the current system time; The parsing and extraction module is used to parse the certificate public key, certificate expiration time and device unique identifier from the certificate payload message each time a certificate payload message is obtained, and to extract the corresponding historical fingerprint sequence from a preset local database using the device unique identifier. The certificate status verification module is used to hash the certificate public key, generate the current public key fingerprint, and perform a set inclusion comparison between the current public key fingerprint and the historical fingerprint sequence to generate a certificate status verification result. The validity verification module is used to calculate the difference between the certificate expiration time and the current system time, and generate a certificate validity verification result based on the difference. The status monitoring module is used to determine the current security status of the network access terminal based on the certificate status verification result and the certificate validity verification result, and to generate a status monitoring report containing an anomaly type identifier when the current security status is determined to be abnormal.

[0012] Furthermore, the terminal certificate status anomaly monitoring device based on traffic parsing also includes: a database update module; The database update module is used to extract the most recently stored chained hash value corresponding to the unique identifier of the device from the local database; The recently stored chained hash value is concatenated with the current public key fingerprint in binary format and then hashed to generate the current node's chained hash value, which is then appended to the local database to update the local database.

[0013] Furthermore, the database update module performs binary concatenation and hash processing on the most recently stored chained hash value and the current public key fingerprint to generate the current node's chained hash value and appends it to the local database to update the local database, including: The most recently stored chained hash values ​​are format-normalized and converted into a first binary data stream with a unified encoding format; The current public key fingerprint is standardized and converted into a second binary data stream with a unified encoding format. The second binary data stream is appended to the end of the first binary data stream to obtain the appended data block to be calculated; A hash algorithm is used to perform a digest calculation on the concatenated data block to obtain a fixed-length string as the chain hash value of the current node; Construct an index record containing the current node's chained hash value, the current system time, and the device's unique identifier, and append the index record to the local database.

[0014] Based on the above method embodiments, the present invention provides corresponding electronic device embodiments.

[0015] An embodiment of the present invention provides an electronic device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the terminal certificate status anomaly monitoring method based on traffic parsing as described in any of the above-described method embodiments.

[0016] Based on the above method embodiments, the present invention provides corresponding storage medium embodiments.

[0017] One embodiment of the present invention provides a storage medium storing a computer program thereon, wherein, when the computer program is running, it controls the device where the storage medium is located to execute any of the terminal certificate status anomaly monitoring methods based on traffic parsing described in the above-described method embodiments.

[0018] Compared with the prior art, the present invention has the following beneficial effects: This invention provides a method, apparatus, electronic device, and storage medium for monitoring abnormal terminal certificate status based on traffic parsing. The method acquires in real-time the certificate payload message sent by the network access terminal during Internet key exchange and the current system time. When acquiring the certificate payload message, it parses the certificate public key, certificate expiration time, and device unique identifier, and retrieves the corresponding historical fingerprint sequence from the local database based on the device unique identifier. It hashes the certificate public key to generate the current public key fingerprint and performs a set inclusion comparison with the historical fingerprint sequence to obtain the certificate status verification result. It calculates the difference between the certificate expiration time and the current system time to generate a certificate validity verification result. By combining the certificate status verification result and the certificate validity verification result, it determines the current security status of the network access terminal and outputs a status monitoring report containing an anomaly type identifier.

[0019] This application introduces a historical benchmark verification dimension independent of the certificate's validity by using the device's unique identifier to index locally stored historical fingerprint sequences and performing a set inclusion comparison between the currently generated public key fingerprint and these historical sequences. This verification method, which forcibly associates "current data" with "historical records," enables the monitoring end to identify sudden changes in the certificate's state over time, thereby solving the problem that existing technologies, which only perform isolated verification on single messages, cannot detect historical consistency anomalies such as malicious certificate rollback or illegal replacement. Attached Figure Description

[0020] Figure 1 This is a flowchart illustrating a terminal certificate status anomaly monitoring method based on traffic parsing, provided in an embodiment of the present invention.

[0021] Figure 2 This is a schematic diagram of a terminal certificate status anomaly monitoring device based on traffic parsing provided in an embodiment of the present invention. Detailed Implementation

[0022] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] like Figure 1 As shown, to address the problem in existing technologies that fail to identify historical consistency anomalies in terminal certificates due to isolated verification of only a single message, an embodiment of the present invention provides a terminal certificate status anomaly monitoring method based on traffic parsing, comprising at least the following steps: Step S1: Obtain the certificate payload message sent by the network access terminal during the Internet key exchange process and the current system time in real time; Specifically, as the first step in the terminal certificate status anomaly monitoring method based on traffic parsing in this embodiment, the monitoring terminal first performs a real-time data stream acquisition operation. When a network access terminal attempts to access a target network or establish a secure communication tunnel, it initiates the Internet Key Exchange (IKE) protocol to negotiate a Security Association (SA). During this process, the monitoring terminal, through a traffic acquisition interface deployed at the network boundary, uses port mirroring or traffic splitting to listen to and capture the communication data flowing through the network in real time. From the massive amount of captured data traffic, the monitoring terminal identifies and filters out protocol data packets belonging to the Internet Key Exchange process.

[0024] Furthermore, the monitoring terminal performs deep packet inspection on the selected protocol data packets to locate and extract the certificate payload message containing authentication information. The certificate payload message is a digital credential data packet sent by the network access terminal during the handshake phase to prove its identity; it typically contains public key certificate data conforming to the X.509 standard. Upon successfully capturing and locking the certificate payload message, the monitoring terminal immediately reads the local clock of the device executing this method and marks the read time as the current system time. This current system time serves as the time base for subsequent calculations of the certificate validity period, independent of the time reported by the network access terminal, thus ensuring the objectivity and immutability of the time dimension.

[0025] By acquiring certificate payload messages and accurate system time in real time and non-intrusively, this step provides reliable raw data input for subsequent extraction of device identity features, historical fingerprint backtracking and comparison, and determination of certificate validity, ensuring the agile response capability of the monitoring method in the face of highly dynamic network access environments.

[0026] Step S2: When each of the certificate payload messages is obtained, the certificate public key, certificate expiration time and device unique identifier are parsed from the certificate payload message, and the corresponding historical fingerprint sequence is extracted from the preset local database using the device unique identifier. Specifically, after successfully capturing the certificate payload message, the monitoring terminal immediately initiates a message parsing program to decode the internal data structure of the certificate payload message. The certificate payload message is a digital credential generated based on a preset public key infrastructure standard, containing multiple well-defined data fields. The monitoring terminal first locates the main public key information area in the certificate payload message, reads and reconstructs the certificate public key, which contains core algorithm parameters and key values ​​used for subsequent authentication and encrypted communication. Simultaneously, the monitoring terminal locates the validity period area in the certificate payload message, reads the end time field as the certificate expiration time, and defines the time boundary of the certificate's validity. Furthermore, the monitoring terminal needs to identify the network access terminal's identity by scanning the extended fields or subject alternate name fields in the certificate payload message, and extracting a string or code that uniquely represents the network access terminal's identity according to preset identifier matching rules, using this as the device's unique identifier. In specific application scenarios, this unique device identifier can be extracted from different fields of the certificate according to the actual network planning strategy. For example, it could be the Serial Number field or the Common Name (CN) field in the certificate subject information, or the Subject Key Identifier field in the certificate extensions. The monitoring device can also be configured to extract the hash digest of the combined values ​​of the above fields as a unique identifier for the device, to ensure the global uniqueness of the device identity in an environment where multiple CAs (Certificate Authorization Centers) coexist.

[0027] After obtaining the device's unique identifier, the monitoring terminal uses it as a key index to access a pre-set local database. This local database is a repository maintained by the monitoring terminal to store historical status information of trusted terminals, organized using a key-value pair or relational table structure. The monitoring terminal uses the device's unique identifier to search the local database for records associated with it. Once a match is found, the monitoring terminal retrieves the historical fingerprint sequence bound to the device's unique identifier from the local database. This historical fingerprint sequence is a set of fingerprints generated by hashing the public keys of certificates used by the network access terminal during key exchanges at past points in time. These fingerprints are arranged chronologically according to their storage time, objectively recording the certificate usage history and change patterns of the network access terminal.

[0028] By performing in-depth analysis of the certificate payload message and targeted database retrieval based on the device's unique identifier, this step enables the accurate extraction of key identity features and historical baseline data from massive network traffic. This establishes a logical mapping relationship between the current access request and historical authentication records, providing an indispensable basis for comparison in subsequent identification of whether certificates have been illegally replaced or abnormally rolled back.

[0029] Step S3: Hash the certificate public key to generate the current public key fingerprint, and perform a set inclusion comparison between the current public key fingerprint and the historical fingerprint sequence to generate a certificate status verification result; In a preferred embodiment, the step of hashing the certificate public key to generate a current public key fingerprint, and then performing a set inclusion comparison between the current public key fingerprint and the historical fingerprint sequence to generate a certificate status verification result includes: The certificate public key is calculated according to a preset hash algorithm to obtain the current public key fingerprint; Determine whether there is a fingerprint in the historical fingerprint sequence that is the same as the current public key fingerprint. If not, generate a certificate status verification result indicating that the certificate has changed. If so, extract the most recent storage record from the historical fingerprint sequence and determine whether the current public key fingerprint is the same as the most recent storage record. If the current public key fingerprint is the same as the most recent stored record, generate a certificate status verification result indicating the continuity of the certificate status; If the current public key fingerprint is different from the most recent stored record, a certificate status verification result indicating that a certificate history rollback has occurred is generated.

[0030] Specifically, after extracting the certificate public key from the certificate payload message, the monitoring device (or executing entity) immediately initiates the fingerprint generation and comparison process. Because the original certificate public key data is long and complex in format, it is not convenient for direct high-frequency database retrieval and comparison. Therefore, the monitoring device first needs to compress the certificate public key's features. The monitoring device calls a preset hash algorithm (such as the Chinese national cryptographic algorithm SM3 or the secure hash algorithm SHA-256, etc., a one-way hash function) to calculate the digest of the binary data of the certificate public key. The hash algorithm maps a certificate public key of arbitrary length to a fixed-length string, which is the current public key fingerprint. The current public key fingerprint is unique, accurately represents the corresponding certificate public key, and cannot be reverse-engineered to derive the original public key data, ensuring the efficiency and security of data processing.

[0031] After generating the current public key fingerprint, the monitoring device retrieves a pre-extracted historical fingerprint sequence corresponding to the device's unique identifier. The historical fingerprint sequence is an ordered set storing, in chronological order, the certificate fingerprints used by the network access terminal in all past handshake processes. The monitoring device first performs a set inclusion comparison between the current public key fingerprint and the historical fingerprint sequence. Set inclusion comparison determines whether there exists an element in the historical fingerprint sequence that has the exact same value as the current public key fingerprint.

[0032] If the set inclusion comparison result is negative, meaning the current public key fingerprint is not found in the historical fingerprint sequence, this indicates that the certificate currently used by the network access terminal is a new certificate that has never appeared in the device's history. In this case, the monitoring device determines that the certificate has been replaced and generates a certificate status verification result indicating that the certificate has changed. This result suggests that subsequent steps may require further compliance auditing or trust establishment of the new certificate.

[0033] If the set inclusion comparison is successful, meaning the current public key fingerprint was found in the historical fingerprint sequence, it indicates that the certificate currently used by the network access terminal is one that the device previously used. In this case, to further confirm any anomalies in the certificate status, the monitoring device needs to perform a consistency comparison on the most recent stored record. The monitoring device locates and extracts the most recent stored record from the historical fingerprint sequence; this record represents the certificate fingerprint used by the network access terminal during its last successful handshake. The monitoring device then compares the current public key fingerprint with this most recent stored record using binary values.

[0034] If the current public key fingerprint is identical to the most recent stored record, it indicates that the network access terminal continued to use the certificate from the previous handshake during this handshake process. The certificate usage status remains stable and has not changed. In this case, the monitoring device determines this to be normal behavior and generates a certificate status verification result indicating the continuity of the certificate status.

[0035] If the current public key fingerprint differs from the most recent stored record, and given that a set inclusion comparison previously confirmed the current public key fingerprint's existence within the historical fingerprint sequence, the only logical inference is that the network access terminal abandoned the previously used, newer certificate and reverted to an older, previously used certificate. This situation typically indicates potential security risks, such as rollback attacks following key leakage or configuration errors. In this case, the monitoring device identifies it as abnormal rollback behavior and generates a certificate status verification result indicating a historical certificate rollback.

[0036] By performing the above set inclusion determination, this application can accurately distinguish between the three states of a certificate: "normal continuous use", "legitimate change" and "high-risk historical rollback". This effectively overcomes the shortcomings of traditional monitoring methods that only focus on the current validity of the certificate and ignore the consistency of historical evolution, and greatly improves the ability to perceive complex certificate attack scenarios.

[0037] Step S4: Calculate the difference between the certificate expiration time and the current system time, and generate a certificate validity verification result based on the difference; In a preferred embodiment, calculating the difference between the certificate expiration time and the current system time, and generating a certificate validity verification result based on the difference, includes: Subtract the current system time from the certificate expiration time to obtain the time difference; Determine whether the time difference is less than zero; if yes, generate a certificate validity verification result indicating that the certificate has expired; if no, determine whether the time difference is less than a preset near-expiration alarm threshold. If the time difference is less than the near-expiration alarm threshold, a certificate validity verification result indicating that the certificate is about to expire is generated; If the time difference is not less than the near-expiration alarm threshold, a certificate validity verification result indicating that the certificate is within its validity period is generated.

[0038] Specifically, during the completion or parallel execution of status verification, the monitoring device (or executing entity) initiates a compliance check targeting the certificate's time dimension. The monitoring device retrieves the certificate expiration time parsed in step S2 and the current system time obtained in step S1, and quantifies the remaining lifespan of the certificate through mathematical operations. Specifically, the monitoring device performs a subtraction operation, subtracting the current system time from the certificate expiration time to obtain a value representing the time span, i.e., the time difference. This time difference directly reflects the remaining time before the certificate expires, or the overdue period since the certificate expired.

[0039] After obtaining the time difference, the monitoring device needs to determine the specific validity status of the certificate based on the sign and range of the value. The monitoring device first checks if the time difference is less than zero. If the time difference is less than zero, it physically indicates that the current system time has exceeded the certificate's expiration time, and the certificate has objectively become invalid. In this case, the monitoring device determines that the certificate status is abnormal and generates a certificate validity verification result indicating that the certificate has expired, so that subsequent steps can block or mark the expired certificate.

[0040] If the time difference is greater than or equal to zero, it indicates that the certificate has not expired in physical time. At this point, to further assess the operational risks of the certificate and prevent service interruptions due to sudden certificate expiration, the monitoring device introduces an early warning mechanism. The monitoring device compares the time difference with a preset near-expiration alarm threshold. The preset near-expiration alarm threshold is a time constant (e.g., set to 7 days or 30 days) based on the operational security policy, used to define the security buffer period for certificate renewal. If the time difference is less than the preset near-expiration alarm threshold, it indicates that although the certificate is currently valid, its remaining validity period is insufficient to support long-term business operations, posing a risk of near-expiration. Based on this, the monitoring device generates a certificate validity verification result indicating that the certificate is about to expire, serving as an early warning signal to prompt the administrator to renew the certificate as soon as possible.

[0041] If the time difference is greater than or equal to the preset near-expiration alarm threshold, it indicates that the remaining validity period of the certificate is sufficient, exceeding the range of the early warning buffer period, and meeting the long-term requirements of secure communication. The monitoring device generates a certificate validity verification result indicating that the certificate is within its validity period, confirming that the certificate is in a healthy state in terms of validity.

[0042] Through the above-mentioned judgment logic based on time difference and multi-level thresholds, this application can accurately subdivide the validity status of the certificate into three states: expired, about to expire (near expiration), and valid. This enables refined monitoring of the entire life cycle of the certificate and effectively avoids security risks caused by certificate expiration and maintenance accidents caused by failure to renew in time.

[0043] Step S5: Based on the certificate status verification result and the certificate validity verification result, determine the current security status of the network access terminal, and if the current security status is determined to be abnormal, generate a status monitoring report containing an abnormality type identifier.

[0044] In a preferred embodiment, after determining the current security status of the network access terminal based on the certificate status verification result and the certificate validity verification result, and generating a status monitoring report containing an anomaly type identifier when the current security status is determined to be abnormal, the method further includes: Extract the most recently stored chained hash value corresponding to the unique identifier of the device from the local database; The recently stored chained hash value is concatenated with the current public key fingerprint in binary format and then hashed to generate the current node's chained hash value, which is then appended to the local database to update the local database.

[0045] In a preferred embodiment, the step of concatenating the most recently stored chained hash value with the current public key fingerprint in binary format and performing hash processing to generate the current node's chained hash value and appending it to the local database to update the local database includes: The most recently stored chained hash values ​​are format-normalized and converted into a first binary data stream with a unified encoding format; The current public key fingerprint is standardized and converted into a second binary data stream with a unified encoding format. The second binary data stream is appended to the end of the first binary data stream to obtain the appended data block to be calculated; A hash algorithm is used to perform a digest calculation on the concatenated data block to obtain a fixed-length string as the chain hash value of the current node; Construct an index record containing the current node's chained hash value, the current system time, and the device's unique identifier, and append the index record to the local database.

[0046] Specifically, after obtaining the certificate status verification result and the certificate validity verification result, the monitoring device initiates a status analysis logic to comprehensively analyze the verification results of these two dimensions. Based on preset security policy mapping rules, the monitoring device converts different combinations of verification results into the current security status of the network access terminal. Specifically, when the certificate status verification result indicates that the certificate has undergone historical rollback, or the certificate validity verification result indicates that the certificate has expired, the monitoring device determines that the current security status of the network access terminal is a high-risk abnormal state; when the certificate validity verification result indicates that the certificate is about to expire, the monitoring device determines that the current security status of the network access terminal is a maintenance warning state; when the certificate status verification result indicates that the certificate has been changed, the monitoring device determines that the current security status of the network access terminal is a pending audit state. Based on the determined current security status, the monitoring device generates a status monitoring report. The status monitoring report encapsulates a clear anomaly type identifier, which is used to instruct network security devices to execute corresponding blocking, alarm, or allow policies, realizing automated closed-loop handling of abnormal risks. For example, the status monitoring report can be encapsulated in standard network management protocol formats such as Syslog, JSON, or SNMP Trap. In addition to the aforementioned anomaly type identifiers (such as "High Risk - Historical Rollback" and "Warning - Near Expiration"), the report may also include the certificate fingerprint snapshot that triggered the anomaly, the source / destination IP addresses involved in the communication, and the session ID negotiated by IKE. This status monitoring report can be pushed to the network security management platform (SOC) or firewall device in real time to trigger automated blocking policies (for high-risk statuses) or email alerts (for warning statuses).

[0047] After generating a status monitoring report containing anomaly type identifiers and completing the monitoring determination, the monitoring device performs an update operation on the local database to maintain the continuity and immutability of the audit data. The monitoring device again uses the device's unique identifier as the retrieval key to extract the most recently stored chained hash value corresponding to the device's unique identifier from the preset local database. It is important to note that if the monitoring device does not find any historical records corresponding to the device's unique identifier in the preset local database (i.e., determining that the network access terminal is accessing the system for the first time), the monitoring device will generate a preset initial vector (e.g., an all-zero sequence or a specific magic number) as the most recently stored chained hash value, or directly use the currently generated public key fingerprint after performing a preset identifier operation as the first node of the hash chain. This initialization mechanism ensures that even the device's first audit record can be included in the tamper-proof chain structure. The most recently stored chained hash value is a node digest generated at the end of the previous monitoring cycle, and its mathematical properties contain all historical state information prior to that moment. The monitoring device takes the most recently stored chained hash value and the current public key fingerprint generated during the current monitoring as input data, and performs binary concatenation and hash processing. Through this cryptographic operation, the monitoring device generates a new, fixed-length string, namely the current node's chained hash value. The monitoring device appends the current node's chained hash value to a preset local database, thereby updating the local database and establishing the comparison benchmark for the next monitoring process.

[0048] In the process of generating the current node's chain hash value, to ensure the uniqueness and consistency of the calculation results across different system environments, the monitoring device first performs strict format standardization on the input data. The monitoring device forcibly converts the most recently stored chain hash value, which may be represented in hexadecimal or Base64 encoding, read from the database into a first binary data stream conforming to a unified encoding format (such as a raw binary bitstream). Simultaneously, the monitoring device also converts the current public key fingerprint into a second binary data stream conforming to a unified encoding format. Subsequently, the monitoring device performs an ordered concatenation operation, directly concatenating the second binary data stream to the end of the first binary data stream, forming a complete and continuous concatenated data block to be calculated. The monitoring device calls a preset hash algorithm (such as SM3 or SHA-256) to perform a one-way digest calculation on the concatenated data block; the fixed-length string output is the current node's chain hash value. Finally, the monitoring device encapsulates the current node's chain hash value, the current system time, and the device's unique identifier into a structured index record, and stores the index record in an append-only manner at the end of the local database's storage queue.

[0049] Through the aforementioned status determination based on multi-dimensional verification results and dynamic update mechanism based on hash chain, this application not only achieves graded and accurate response to terminal security risks, but also constructs an anti-tampering audit chain locked by timestamps and hash values ​​in the database, effectively ensuring the authenticity and traceability of monitoring data throughout the entire lifecycle.

[0050] Based on the above method embodiments, the present invention provides corresponding apparatus embodiments.

[0051] like Figure 2 As shown, an embodiment of the present invention provides a terminal certificate status anomaly monitoring device based on traffic parsing, including: a data acquisition module, a parsing and extraction module, a certificate status verification module, a timeliness verification module, and a status monitoring module; The data acquisition module is used to acquire, in real time, the certificate payload message sent by the network access terminal during the Internet key exchange process and the current system time; The parsing and extraction module is used to parse the certificate public key, certificate expiration time and device unique identifier from the certificate payload message each time a certificate payload message is obtained, and to extract the corresponding historical fingerprint sequence from a preset local database using the device unique identifier. The certificate status verification module is used to hash the certificate public key, generate the current public key fingerprint, and perform a set inclusion comparison between the current public key fingerprint and the historical fingerprint sequence to generate a certificate status verification result. The validity verification module is used to calculate the difference between the certificate expiration time and the current system time, and generate a certificate validity verification result based on the difference. The status monitoring module is used to determine the current security status of the network access terminal based on the certificate status verification result and the certificate validity verification result, and to generate a status monitoring report containing an anomaly type identifier when the current security status is determined to be abnormal.

[0052] In a preferred embodiment, the terminal certificate status anomaly monitoring device based on traffic parsing further includes: a database update module; The database update module is used to extract the most recently stored chained hash value corresponding to the unique identifier of the device from the local database; The recently stored chained hash value is concatenated with the current public key fingerprint in binary format and then hashed to generate the current node's chained hash value, which is then appended to the local database to update the local database.

[0053] In a preferred embodiment, the database update module performs binary concatenation and hash processing on the most recently stored chained hash value and the current public key fingerprint to generate the current node chained hash value and appends it to the local database to update the local database, including: The most recently stored chained hash values ​​are format-normalized and converted into a first binary data stream with a unified encoding format; The current public key fingerprint is standardized and converted into a second binary data stream with a unified encoding format. The second binary data stream is appended to the end of the first binary data stream to obtain the appended data block to be calculated; A hash algorithm is used to perform a digest calculation on the concatenated data block to obtain a fixed-length string as the chain hash value of the current node; Construct an index record containing the current node's chained hash value, the current system time, and the device's unique identifier, and append the index record to the local database.

[0054] It should be noted that the embodiments of the device described above correspond to the embodiments of the present invention described above, and can realize the terminal certificate status anomaly monitoring method based on traffic parsing described in any one of the present invention. Furthermore, the embodiments of the device described above are merely illustrative. The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. In addition, in the accompanying drawings of the device embodiments provided by the present invention, the connection relationship between modules indicates that they have a communication connection, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without creative effort.

[0055] Based on the above-described method embodiments of the present invention, a corresponding embodiment of an electronic device is provided.

[0056] An embodiment of the present invention provides an electronic device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the terminal certificate status anomaly monitoring method based on traffic parsing as described in any one of the present invention, or the processor executes the computer program to implement the functions of each module in the above-described device embodiments.

[0057] For example, the computer program may be divided into one or more modules, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules may be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in the terminal device.

[0058] The terminal device may be a desktop computer, laptop, handheld computer, or cloud server, etc. The terminal device may include, but is not limited to, a processor and a memory.

[0059] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the terminal device, connecting all parts of the terminal device via various interfaces and lines.

[0060] The memory can be used to store the computer programs and / or modules. The processor implements various functions of the terminal device by running or executing the computer programs and / or modules stored in the memory and by calling data stored in the memory. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, applications required for at least one function, etc.; the data storage area may store data created based on the use of the mobile phone, etc. In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital card (SD card), flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0061] Based on the above method embodiments, the present invention provides corresponding storage medium embodiments; Another embodiment of the present invention provides a storage medium including a stored computer program, wherein, when the computer program is running, it controls the device where the storage medium is located to execute any of the above-described terminal certificate status anomaly monitoring methods based on traffic parsing of the present invention.

[0062] The aforementioned storage medium is a computer-readable storage medium, and the computer program includes computer program code, which may be in the form of source code, object code, executable file, or certain intermediate forms. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0063] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of those different embodiments or examples.

[0064] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for monitoring abnormal terminal certificate status based on traffic parsing, characterized in that, include: Real-time acquisition of certificate payload messages sent by network access terminals during Internet key exchange and the current system time; When each certificate payload message is acquired, the certificate public key, certificate expiration time, and device unique identifier are parsed from the certificate payload message, and the corresponding historical fingerprint sequence is extracted from the preset local database using the device unique identifier. The certificate public key is hashed to generate the current public key fingerprint, and the current public key fingerprint is compared with the historical fingerprint sequence to generate the certificate status verification result. Calculate the difference between the certificate expiration time and the current system time, and generate a certificate validity verification result based on the difference; Based on the certificate status verification results and certificate validity verification results, the current security status of the network access terminal is determined, and if the current security status is determined to be abnormal, a status monitoring report containing an abnormality type identifier is generated.

2. The terminal certificate status anomaly monitoring method based on traffic parsing as described in claim 1, characterized in that, After determining the current security status of the network access terminal based on the certificate status verification results and certificate validity verification results, and generating a status monitoring report containing an anomaly type identifier when the current security status is determined to be abnormal, the system also includes: Extract the most recently stored chained hash value corresponding to the unique identifier of the device from the local database; The recently stored chained hash value is concatenated with the current public key fingerprint in binary format and then hashed to generate the current node's chained hash value, which is then appended to the local database to update the local database.

3. The terminal certificate status anomaly monitoring method based on traffic parsing as described in claim 2, characterized in that, The step of concatenating the most recently stored chained hash value with the current public key fingerprint in binary format and performing hash processing to generate the current node's chained hash value and appending it to the local database to update the local database includes: The most recently stored chained hash values ​​are format-normalized and converted into a first binary data stream with a unified encoding format; The current public key fingerprint is standardized and converted into a second binary data stream with a unified encoding format. The second binary data stream is appended to the end of the first binary data stream to obtain the appended data block to be calculated; A hash algorithm is used to perform a digest calculation on the concatenated data block to obtain a fixed-length string as the chain hash value of the current node; Construct an index record containing the current node's chained hash value, the current system time, and the device's unique identifier, and append the index record to the local database.

4. The terminal certificate status anomaly monitoring method based on traffic parsing as described in claim 1, characterized in that, The process of hashing the certificate public key to generate the current public key fingerprint, and then comparing the current public key fingerprint with the historical fingerprint sequence to generate a certificate status verification result includes: The certificate public key is calculated according to a preset hash algorithm to obtain the current public key fingerprint; Determine whether there is a fingerprint in the historical fingerprint sequence that is the same as the current public key fingerprint. If not, generate a certificate status verification result indicating that the certificate has changed. If so, extract the most recent storage record from the historical fingerprint sequence and determine whether the current public key fingerprint is the same as the most recent storage record. If the current public key fingerprint is the same as the most recent stored record, generate a certificate status verification result indicating the continuity of the certificate status; If the current public key fingerprint is different from the most recent stored record, a certificate status verification result indicating that a certificate history rollback has occurred is generated.

5. The terminal certificate status anomaly monitoring method based on traffic parsing as described in claim 1, characterized in that, The calculation of the difference between the certificate expiration time and the current system time, and the generation of a certificate validity verification result based on the difference, includes: Subtract the current system time from the certificate expiration time to obtain the time difference; Determine whether the time difference is less than zero; if yes, generate a certificate validity verification result indicating that the certificate has expired; if no, determine whether the time difference is less than a preset near-expiration alarm threshold. If the time difference is less than the near-expiration alarm threshold, a certificate validity verification result indicating that the certificate is about to expire is generated; If the time difference is not less than the near-expiration alarm threshold, a certificate validity verification result indicating that the certificate is within its validity period is generated.

6. A terminal certificate status anomaly monitoring device based on traffic parsing, characterized in that, include: The system includes a data acquisition module, a parsing and extraction module, a certificate status verification module, a timeliness verification module, and a status monitoring module. The data acquisition module is used to acquire, in real time, the certificate payload message sent by the network access terminal during the Internet key exchange process and the current system time; The parsing and extraction module is used to parse the certificate public key, certificate expiration time and device unique identifier from the certificate payload message each time a certificate payload message is obtained, and to extract the corresponding historical fingerprint sequence from a preset local database using the device unique identifier. The certificate status verification module is used to hash the certificate public key, generate the current public key fingerprint, and perform a set inclusion comparison between the current public key fingerprint and the historical fingerprint sequence to generate a certificate status verification result. The validity verification module is used to calculate the difference between the certificate expiration time and the current system time, and generate a certificate validity verification result based on the difference. The status monitoring module is used to determine the current security status of the network access terminal based on the certificate status verification result and the certificate validity verification result, and to generate a status monitoring report containing an anomaly type identifier when the current security status is determined to be abnormal.

7. The terminal certificate status anomaly monitoring device based on traffic parsing as described in claim 6, characterized in that, Also includes: Database update module; The database update module is used to extract the most recently stored chained hash value corresponding to the unique identifier of the device from the local database; The recently stored chained hash value is concatenated with the current public key fingerprint in binary format and then hashed to generate the current node's chained hash value, which is then appended to the local database to update the local database.

8. The terminal certificate status anomaly monitoring device based on traffic parsing as described in claim 7, characterized in that, The database update module performs binary concatenation and hash processing on the most recently stored chained hash value and the current public key fingerprint to generate the current node's chained hash value, which is then appended and stored in the local database to update the local database. This includes: The most recently stored chained hash values ​​are format-normalized and converted into a first binary data stream with a unified encoding format; The current public key fingerprint is standardized and converted into a second binary data stream with a unified encoding format. The second binary data stream is appended to the end of the first binary data stream to obtain the appended data block to be calculated; A hash algorithm is used to perform a digest calculation on the concatenated data block to obtain a fixed-length string as the chain hash value of the current node; Construct an index record containing the current node's chained hash value, the current system time, and the device's unique identifier, and append the index record to the local database.

9. An electronic device, characterized in that, The method includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the terminal certificate status anomaly monitoring method based on traffic parsing as described in any one of claims 1 to 5.

10. A storage medium, characterized in that, The storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device where the storage medium is located to perform the terminal certificate status anomaly monitoring method based on traffic parsing as described in any one of claims 1 to 5.

Images