A traffic identification method, device, equipment, medium and product

Abstract

This application discloses a traffic identification method, apparatus, device, medium, and product, comprising: establishing a TCP connection with a server during a TCP three-way handshake with a client, and maintaining consistency in TCP sequence numbers between the client and the security gateway, and between the security gateway and the server; receiving a client greeting handshake packet sent by the client after the TCP three-way handshake is completed; extracting the target domain name information of the data stream from the client greeting handshake packet; executing the preset security policy if the target domain name information matches any preset security policy, and falling back to routing forwarding mode for the data stream if the target domain name information does not match any preset security policy. This enables the identification of the domain name accessed by the traffic without relying on DNS traffic, avoiding the failure of security policies to be executed.

Description

Technical Field

[0001] This application relates to the field of network communication technology, and in particular to a traffic identification method, apparatus, device, medium and product. Background Technology

[0002] Currently, security gateways cannot determine the domain names accessed by business data streams from encrypted traffic. Therefore, they typically rely on DNS (Domain Name System) traffic. Based on DNS traffic, they learn in advance the mapping relationship between the domain names accessed by the business data streams and IP (Internet Protocol) addresses, and then execute security policies on traffic to specific domain names based on this mapping relationship. This approach relies on DNS traffic passing through the security gateway in plaintext. However, in some deployment scenarios, DNS traffic does not pass through the security gateway, or the client has encrypted DNS enabled. In these cases, the security gateway cannot learn the mapping relationship between the domain names accessed by the business data streams and IP addresses from the DNS traffic, thus failing to execute the corresponding security policies.

[0003] Therefore, how to identify the domain name accessed by traffic without relying on DNS traffic, and avoid the failure of security policies to be executed, is a technical problem that needs to be solved by those skilled in the art. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a traffic identification method, apparatus, device, medium, and product that can identify the domain name accessed by traffic without relying on DNS traffic, thereby preventing security policies from failing to execute. The specific solution is as follows: In a first aspect, this application provides a traffic identification method applied to a security gateway, comprising: During the TCP three-way handshake with the client, a TCP connection is established with the server, and the TCP sequence numbers between the client and the security gateway, as well as between the security gateway and the server, are kept consistent. After the TCP three-way handshake is completed, the client greeting handshake packet sent by the client is received; Extract the target domain name information of the data stream from the client's greeting handshake packet; If the target domain name information matches any preset security policy, the preset security policy is executed; if the target domain name information does not match any preset security policy, the data flow is rolled back to the routing forwarding mode.

[0005] Optionally, maintaining consistency of TCP sequence numbers between the client and the security gateway, and between the security gateway and the server, includes: Extract the first TCP sequence number from the synchronization packet sent by the client, and use the first TCP sequence number as the TCP sequence number of the synchronization packet sent by the security gateway to the server; The system receives a synchronization confirmation packet returned by the server, extracts the second TCP sequence number from the synchronization confirmation packet, and uses the second TCP sequence number as the TCP sequence number of the synchronization confirmation packet that the security gateway replies to the client.

[0006] Optionally, the target domain name information of the data stream can be extracted from the client greeting handshake packet, including: The callback interface of the transport layer security protocol library is invoked to parse the client greeting handshake packet and read the target domain name information from the server name indication extended field.

[0007] Optionally, the preset security policy includes access control policy and / or security detection policy; If the target domain name information matches any preset security policy, the preset security policy is executed, including: If the target domain name information matches any access control policy, the access control policy is executed to determine whether the data flow is allowed to pass through the security gateway; If the target domain name information matches any security detection policy, the security detection policy is executed to detect attack behavior in the data stream.

[0008] Optionally, after falling back to the routing forwarding mode for the data stream, the method further includes: Record the target domain name information; When the preset security policy is updated, if the target domain name information matches the updated security policy, a connection reset message is sent to the client to interrupt the current data flow and cause the client to re-initiate the TCP connection.

[0009] Optionally, the step of falling back to the routing forwarding mode for the data stream includes: Disconnect the TCP connections established between the security gateway and the client, as well as between the security gateway and the server, and switch the data stream to a Layer 3 routing forwarding mode, allowing the client and the server to communicate directly end-to-end.

[0010] Secondly, this application provides a traffic identification device applied to a security gateway, comprising: The connection establishment module is used to establish a TCP connection with the server during the TCP three-way handshake process with the client, and to maintain the consistency of the TCP sequence numbers between the client and the security gateway, as well as between the security gateway and the server. The greeting packet receiving module is used to receive the client greeting handshake packet sent by the client after the TCP three-way handshake is completed; The domain name resolution module is used to extract the target domain name information of the data stream from the client's greeting handshake packet; The security policy execution module is used to execute the preset security policy when the target domain name information matches any preset security policy, and to fall back to the routing forwarding mode for the data flow when the target domain name information does not match any preset security policy.

[0011] Thirdly, this application provides an electronic device, including a memory and a processor, wherein: The memory is used to store computer programs; The processor is used to execute the computer program to implement the aforementioned traffic identification method.

[0012] Fourthly, this application provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned traffic identification method.

[0013] Fifthly, this application provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the aforementioned traffic identification method.

[0014] As can be seen from the above scheme, the present invention provides a traffic identification method applied to a security gateway, comprising: establishing a TCP connection with a server during a TCP three-way handshake with a client, and maintaining consistency of TCP sequence numbers between the client and the security gateway, and between the security gateway and the server; receiving a client greeting handshake packet sent by the client after the TCP three-way handshake is completed; extracting the target domain name information of the data stream from the client greeting handshake packet; executing the preset security policy if the target domain name information matches any preset security policy, and falling back to the routing forwarding mode for the data stream if the target domain name information does not match any preset security policy.

[0015] As can be seen, the beneficial effects of this application are as follows: This application establishes a connection with the server synchronously during the TCP three-way handshake with the client and keeps the sequence numbers on both sides consistent. After the TCP three-way handshake is completed, the target domain name is extracted from the client's greeting handshake packet. Based on the target domain name, a security policy is matched and the policy or fallback routing forwarding mode is executed based on the matching result. This solves the problem that the security gateway cannot identify the business flow domain name in scenarios where DNS traffic is encrypted or does not pass through the security gateway. It can identify the domain name accessed by the traffic without relying on DNS traffic, and avoid the failure of security policies to be executed. The whole process is unknown to the client and the server.

[0016] Accordingly, the traffic identification device, equipment, readable storage medium and product provided in this application also have the above-mentioned technical effects. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0018] Figure 1 A flowchart of a traffic identification method provided in an embodiment of this application; Figure 2 This application provides a schematic diagram of traffic identification interaction. Figure 3 A schematic diagram of a standard interactive timing provided for an embodiment of this application; Figure 4 This is a schematic diagram of a flow identification device provided in an embodiment of this application; Figure 5 This is a structural diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0020] Security gateway devices need to enforce security policies on business data streams that conform to specific domain name policies. However, these business data streams are highly likely to be encrypted. The security gateway cannot determine from the encrypted traffic which domain the business data stream is accessing, thus failing to determine whether the business data stream conforms to the security policy and resulting in missed detections. The industry solution to this problem relies on DNS traffic. DNS traffic is a process initiated by the client before the business data stream is established, querying the corresponding server IP based on the business domain name. The security gateway uses this opportunity to learn the mapping relationship between the business data stream domain name and IP address in advance, thereby guiding its decryption module to proxy and decrypt the business data stream for that IP address, ultimately achieving the effect of enforcing security policies on traffic from specific domain names. With the upgrading of network privacy protection, the industry's DNS solution has significant flaws. The prerequisite for this solution to work correctly is that DNS traffic must flow through the security gateway and must be in plaintext. However, in some deployment scenarios, DNS traffic does not pass through the security gateway device, or the client has enabled encrypted DNS (DoT, DoH) functions, preventing the security gateway from learning the mapping relationship between the business data stream domain name and IP address from the DNS traffic, thus failing to decrypt and enforce security policies. Therefore, this application provides a traffic identification scheme that can identify the domain name accessed by the traffic without relying on DNS traffic, thus preventing security policies from failing to be executed.

[0021] DNS is a domain name resolution system based on UDP or TCP, resolving domain names into IP addresses through plaintext transmission. DOT (DNS over TLS (Transport Layer Security), TLS-encrypted DNS): uses the TLS protocol to encrypt DNS queries, protecting data from man-in-the-middle attacks. DOH (DNS over HTTPS (Hypertext Transfer Protocol Secure), HTTPS-encrypted DNS): uses the HTTPS protocol to encrypt DNS queries, protecting data from man-in-the-middle attacks.

[0022] See Figure 1 As shown in the figure, this application discloses a traffic identification method applied to a security gateway, including: Step S11: During the TCP three-way handshake with the client, establish a TCP connection with the server and keep the TCP sequence numbers consistent between the client and the security gateway, as well as between the security gateway and the server.

[0023] The security gateway can be deployed on the network path between the client and the server. When a client initiates access to the target server, it first sends a SYN packet (synchronization packet) to the security gateway, initiating a TCP three-way handshake. The server, i.e., the business server, is the target server for the data flow. TCP (Transmission Control Protocol) is a connection-oriented, reliable, byte-stream-based transport layer communication protocol. Establishing a connection requires a TCP three-way handshake to achieve end-to-end communication. The data flow refers to the traffic data accessing the server, also known as the business data flow. This refers to traffic that needs to be decrypted for access control or security checks, such as encrypted traffic accessing xxx.com.

[0024] In an optional embodiment, maintaining consistency of TCP sequence numbers between the client and the security gateway, and between the security gateway and the server, may include: extracting a first TCP sequence number from a synchronization packet sent by the client, and using the first TCP sequence number as the TCP sequence number of a synchronization packet sent by the security gateway to the server; receiving a synchronization acknowledgment packet returned by the server, extracting a second TCP sequence number from the synchronization acknowledgment packet, and using the second TCP sequence number as the TCP sequence number of a synchronization acknowledgment packet replied by the security gateway to the client.

[0025] In this embodiment, after receiving a SYN packet from the client, the security gateway extracts the first TCP sequence number from the SYN packet, denoted as Seq_Client, and simultaneously parses the destination IP address of the SYN packet to determine the server's address. The security gateway immediately sends a SYN packet to the server, using Seq_Client as the TCP sequence number of this SYN packet; that is, the sequence number of the SYN packet sent by the security gateway to the server is consistent with the sequence number of the SYN packet sent by the client to the security gateway. After receiving the SYN packet from the security gateway, the server replies with a SYN+ACK packet (i.e., a synchronization acknowledgment packet). The security gateway extracts the second TCP sequence number from this SYN+ACK packet, denoted as Seq_Server, and uses Seq_Server as the TCP sequence number of the SYN+ACK packet it replies to the client, while simultaneously setting the ACK acknowledgment number. After receiving the SYN+ACK packet from the security gateway, the client sends an ACK packet to the security gateway, completing the TCP three-way handshake between the client and the security gateway. The security gateway synchronously forwards the ACK packet to the server, completing the TCP three-way handshake between the security gateway and the business server. At this point, TCP connections have been established on both sides of the security gateway—between the client and the security gateway, and between the security gateway and the server—and the uplink and downlink TCP sequence numbers on both sides are consistent. When the security gateway subsequently acts as a man-in-the-middle, forwarding TLS handshake messages and business data, it can correctly maintain the TCP connection state on both sides, ensuring that neither the client nor the server is aware of the man-in-the-middle's presence. TLS is an encryption protocol used to protect the security of data transmission over a network. It is the successor to SSL (Secure Sockets Layer), providing higher security and performance, and is used in scenarios such as HTTPS, SMTPS (Simple Mail Transfer Protocol Secure), and FTPS (File Transfer Protocol Secure).

[0026] Step S12: After the TCP three-way handshake is completed, receive the client greeting handshake packet sent by the client.

[0027] After the TCP three-way handshake is completed, the client considers the TCP connection between itself and the server (actually the security gateway) to be established. The client then begins the TLS handshake process, sending a Client Hello handshake packet to the security gateway, which contains information such as the SNI (Server Name Indication) extended field. Upon receiving the Client Hello handshake packet, the security gateway does not decrypt the data stream immediately, but instead extracts the domain name information.

[0028] Step S13: Extract the target domain name information of the data stream from the client greeting handshake packet.

[0029] The target domain name information, which is the domain name information contained in the server name indication extended field, represents the domain name accessed by the data stream.

[0030] In an optional embodiment, extracting the target domain name information of the data stream from the client greeting handshake packet may include: calling the callback interface of the transport layer security protocol library to parse the client greeting handshake packet and reading the target domain name information from the server name indication extended field.

[0031] In this embodiment, the security gateway can call the callback interface provided by the transport layer security protocol library (such as the OpenSSL library) to parse the Client Hello handshake packet. The security gateway can register the SSL_CTX_set_tlsext_servername_callback function. When the OpenSSL library parses the SNI extension field, it reads the target domain name information carried in the field through the SSL_get_servername interface. The SNI field is transmitted in plaintext in the Client Hello handshake packet. The security gateway can directly read this field without decrypting the entire TLS connection, thus enabling it to know the target domain name accessed by the data stream during the TLS handshake phase, without relying on DNS traffic.

[0032] Step S14: If the target domain name information matches any preset security policy, execute the preset security policy; if the target domain name information does not match any preset security policy, fall back to the routing forwarding mode for the data flow.

[0033] In this embodiment, target domain name information can be matched with pre-configured security policies. This embodiment can pre-configure a mapping relationship between domain name information and security policies. Matching target domain name information with security policies is performed through this mapping relationship. If no security policy corresponding to the target domain name information exists in the mapping relationship, the target domain name information does not match any preset security policy. If a security policy corresponding to the target domain name information exists, it matches that security policy. It can be understood that the routing forwarding mode is the mode of disconnecting the TCP connection and forwarding the data stream.

[0034] In an optional embodiment, the preset security policy includes an access control policy and / or a security detection policy; when the target domain information matches any preset security policy, executing the preset security policy may include: when the target domain information matches any access control policy, executing the access control policy to determine whether to allow the data flow to pass through the security gateway; when the target domain information matches any security detection policy, executing the security detection policy to detect attack behavior in the data flow.

[0035] In other words, access control policies are implemented by the security gateway based on domain names. For example, if the access control policy is configured to allow traffic to xxx.com, the security gateway will allow business traffic from xxx.com to pass through; otherwise, it will block business traffic from xxx.com from passing through the security gateway. Security detection policies are implemented by the security gateway based on domain names. For example, if the security detection policy is configured to perform security detection on traffic from xxx.com, the security gateway will perform deep packet filtering on the business traffic from xxx.com to detect malicious attacks. Conversely, if no security detection policy is configured, no detection will be performed on the business traffic, causing security protection functions to fail (such as WAF (Web Application Firewall) and IPS (Intrusion Prevention System) functions).

[0036] Understandably, this access control policy is executed to determine whether the data flow is allowed to pass through the security gateway. If the data flow is allowed, it is forwarded; otherwise, it is blocked. For example, if the access control policy is configured to allow traffic to the domain name, the security gateway continues to act as a man-in-the-middle to forward the traffic; if it is configured to disallow traffic to the domain name, the security gateway sends a corresponding warning to the client and terminates the connection. If the target domain information matches any security detection policy, the security gateway executes the security detection policy to detect attack behavior in the data flow. The security gateway, acting as a man-in-the-middle, decrypts and forwards the encrypted traffic. The decrypted plaintext traffic undergoes packet filtering to detect malicious attacks such as SQL (Structured Query Language) injection, cross-site scripting attacks, and malicious code. After detection, the security gateway can re-encrypt the traffic and forward it to the server.

[0037] In an optional embodiment, the step of falling back to the routing forwarding mode for the data stream may include: disconnecting the TCP connections established between the security gateway and the client, and between the security gateway and the server, switching the data stream to a Layer 3 routing forwarding mode, and having the client and the server communicate directly end-to-end.

[0038] If the target domain information does not match any preset security policy—that is, the domain is neither in the access control policy list nor the security detection policy list—the security gateway determines that the data stream does not require access control or security detection. At this point, the security gateway disconnects the established TCP connections between the security gateway and the client, as well as between the security gateway and the server, releasing the transport layer connection state. Subsequently, the security gateway switches the data stream to Layer 3 routing forwarding mode, no longer maintaining the TCP connection state, and only forwards the data packets at the routing layer. The client and server directly conduct end-to-end TCP communication under the security gateway's Layer 3 forwarding. Through this fallback mechanism, for data streams that do not require security detection, the security gateway does not need to maintain a man-in-the-middle connection or perform decryption operations, significantly reducing the performance overhead on the security gateway. Simultaneously, the entire process is transparent to both the client and the server.

[0039] Furthermore, after the data stream falls back to the routing forwarding mode, the method may further include: recording the target domain name information; when the preset security policy is updated, if the target domain name information matches the updated security policy, then a connection reset message is sent to the client to interrupt the current data stream and cause the client to re-initiate the TCP connection.

[0040] In other words, the security gateway can record the target domain name information of the data stream, such as recording the mapping relationship between the domain name and the server IP in a local database or in-memory table. When the administrator updates the preset security policy, such as adding a security detection policy for a certain domain name, the security gateway traverses the recorded target domain name information. If it finds that the target domain name information of a rolled-back data stream matches the updated security policy, for example, if the new policy requires security detection for the domain name, the security gateway sends a connection reset message to the client corresponding to the data stream to interrupt the current data stream and cause the client to re-initiate a TCP connection. The re-initiated TCP connection by the client will pass through the security gateway again, and at this time, the corresponding access control or security detection processing will be performed according to the updated security policy.

[0041] In an optional embodiment, the target domain name information can be mapped to the Internet Protocol address of the server and stored in a cache table; when a new TCP connection request is received from the client to the same Internet Protocol address, the cache table is queried to obtain the corresponding target domain name information, skipping the step of extracting the target domain name information from the client's greeting handshake packet.

[0042] In other words, the security gateway establishes a mapping between the target domain name information extracted from the Client Hello handshake packet and the server's Internet Protocol (IP) address, and stores this mapping in a cache table, such as a hash table structure with IP address as the key and domain name information as the value. When the security gateway receives a new TCP connection request from the client to the same IP address, after the TCP three-way handshake is completed, the security gateway first queries the cache table. If the cache table contains the domain name information corresponding to the IP address, it directly retrieves this domain name information as the target domain name information for security policy matching, skipping the step of retrieving the domain name information from the SNI field in the Client Hello handshake packet, thus improving connection processing efficiency. If the corresponding record is not found in the cache table, the domain name information is still retrieved from the Client Hello handshake packet.

[0043] As can be seen, this application embodiment establishes a connection with the server synchronously during the TCP three-way handshake with the client and keeps the sequence numbers on both sides consistent. After the TCP three-way handshake is completed, the target domain name is extracted from the client's greeting handshake packet. Based on the target domain name, a security policy is matched and the policy or fallback routing forwarding mode is executed based on the matching result. This solves the problem that the security gateway cannot identify the business flow domain name in scenarios where DNS traffic is encrypted or does not pass through the security gateway. It can identify the domain name accessed by the traffic without relying on DNS traffic, and avoid the failure of security policies to be executed. The whole process is unknown to the client and the server.

[0044] Further, see Figure 2 As shown, Figure 2 This application provides a traffic identification interaction diagram, which can efficiently identify business data streams in encrypted traffic. It can identify business data streams conforming to security policies by domain name without relying on DNS traffic, thereby achieving access control and security detection of business traffic. This application embodiment achieves the learning of the domain name-IP mapping relationship by adjusting the timing of the three-way handshake during TCP connection establishment and obtaining SNI information from the Client Hello packet in the TLS handshake.

[0045] It should be noted that if the standard interaction sequence is used, the standard TLS man-in-the-middle decryption data stream interaction sequence is as follows: Figure 3 As shown, Figure 3This is a schematic diagram illustrating a standard interactive timing process provided in an embodiment of this application. In the standard man-in-the-middle decryption process, the client needs to first establish a TCP connection with the security gateway, negotiate the TCP sequence number, and only after the security gateway terminates the TCP connection (i.e., the TCP connection is established) can the client send a Client Hello handshake packet. When the security gateway obtains the domain name information from the SNI in the Client Hello handshake packet, if it finds that the data stream of that domain name is configured such that access control or security detection policies corresponding to the security gateway do not require access control or security detection, the security gateway cannot roll back the already established TCP connection. Forcibly closing the TCP connection will only trigger abnormal behavior from the client.

[0046] like Figure 2 As shown, this embodiment improves the timing of TLS man-in-the-middle decryption data stream interaction, specifically the SYN packet sending stage of the TCP three-way handshake between the client and the security gateway, and the initial negotiation of TCP sequence numbers. Upon receiving the client's SYN packet, the security gateway immediately performs a TCP handshake with the service server, extracting the TCP sequence number of the SYN packet sent by the client to the security gateway as the TCP sequence number of the SYN packet sent by the security gateway to the server, thus achieving the effect of maintaining the same TCP sequence numbers between the client and the security gateway, and between the security gateway and the server in the uplink direction. After receiving the SYN+ACK packet from the server, the security gateway extracts the TCP sequence number as the sequence number of the SYN+ACK packet it responds to the client, achieving the effect of maintaining the same TCP sequence numbers between the server and the security gateway, and between the security gateway and the client in the downlink direction. After the TCP three-way handshake is complete, the client sends a Client Hello packet. The security gateway obtains the domain name information from the SNI using the SSL_CTX_set_tlsext_servername_callbac and SSL_get_servername interfaces provided by the OpenSSL library. Based on this information, it determines whether the business data flow conforms to access control or security detection policies. If it does, the security gateway continues to act as a man-in-the-middle, decrypting the traffic and executing access control and security detection logic to control and deeply inspect the business traffic and detect attacks. If it does not conform, the security gateway stops controlling the business traffic and detecting attacks for that domain name. The security gateway can then revert to the original routing and forwarding mode, where the client directly communicates with the server end-to-end via TCP, significantly reducing the performance overhead on the security gateway.

[0047] In this way, by modifying the standard TCP three-way handshake process and injecting SNI extraction logic into the handshake process, the security gateway can identify traffic of specific domain names without relying on DNS traffic. It can then execute relevant business logic according to the configured access control or security detection policies, and degrade to routing forwarding when no execution is needed. The entire process is transparent to both the client and the server. In scenarios where DNS traffic does not pass through the security gateway or is encrypted, it achieves efficient domain name identification and decryption of encrypted traffic, thereby enabling security detection.

[0048] See Figure 4 As shown in the figure, this application provides a traffic identification device applied to a security gateway, comprising: The connection establishment module 11 is used to establish a TCP connection with the server during the TCP three-way handshake process with the client, and to keep the TCP sequence numbers consistent between the client and the security gateway and between the security gateway and the server. The greeting packet receiving module 12 is used to receive the client greeting handshake packet sent by the client after the TCP three-way handshake is completed; Domain name resolution module 13 is used to extract the target domain name information of the data stream from the client greeting handshake packet; The security policy execution module 14 is used to execute the preset security policy when the target domain name information matches any preset security policy, and to fall back to the routing forwarding mode for the data flow when the target domain name information does not match any preset security policy.

[0049] In an optional embodiment, the connection establishment module 11 may be specifically used to: extract the first TCP sequence number from the synchronization packet sent by the client, and use the first TCP sequence number as the TCP sequence number of the synchronization packet sent by the security gateway to the server; receive the synchronization confirmation packet returned by the server, extract the second TCP sequence number from the synchronization confirmation packet, and use the second TCP sequence number as the TCP sequence number of the synchronization confirmation packet replied by the security gateway to the client.

[0050] In an optional embodiment, the domain name resolution module 13 may be specifically used to: call the callback interface of the transport layer security protocol library to parse the client greeting handshake packet and read the target domain name information from the server name indication extended field.

[0051] In an optional embodiment, the preset security policy includes an access control policy and / or a security detection policy; correspondingly, the security policy execution module 14 can be specifically used to: execute the access control policy when the target domain information matches any access control policy, to determine whether the data flow is allowed to pass through the security gateway; and execute the security detection policy when the target domain information matches any security detection policy, to detect attack behavior in the data flow.

[0052] In an optional embodiment, the device can also be used to record the target domain name information after the data stream falls back to the routing forwarding mode; when the preset security policy is updated, if the target domain name information matches the updated security policy, a connection reset message is sent to the client to interrupt the current data stream and cause the client to re-initiate the TCP connection.

[0053] In an optional embodiment, the security policy execution module 14 can also be specifically used to disconnect the TCP connection established between the security gateway and the client, as well as between the security gateway and the server, and switch the data stream to a Layer 3 routing forwarding mode, so that the client and the server can directly conduct end-to-end communication.

[0054] As can be seen, this application embodiment establishes a connection with the server synchronously during the TCP three-way handshake with the client and keeps the sequence numbers on both sides consistent. After the TCP three-way handshake is completed, the target domain name is extracted from the client's greeting handshake packet. Based on the target domain name, a security policy is matched and the policy or fallback routing forwarding mode is executed based on the matching result. This solves the problem that the security gateway cannot identify the business flow domain name in scenarios where DNS traffic is encrypted or does not pass through the security gateway. It can identify the domain name accessed by the traffic without relying on DNS traffic, and avoid the failure of security policies to be executed. The whole process is unknown to the client and the server.

[0055] See Figure 5 As shown in the figure, this application discloses an electronic device 20, including a processor 21 and a memory 22; wherein, the memory 22 is used to store a computer program; the processor 21 is used to execute the computer program, the traffic identification method disclosed in the foregoing embodiments.

[0056] For details regarding the specific process of the traffic identification method described above, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0057] Furthermore, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk, or optical disk, and the storage method can be temporary storage or permanent storage.

[0058] In addition, the electronic device 20 also includes a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26; wherein, the power supply 23 is used to provide operating voltage for the various hardware devices on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0059] Furthermore, embodiments of this application also disclose a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the traffic identification method disclosed in the foregoing embodiments.

[0060] For details regarding the specific process of the traffic identification method described above, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0061] Furthermore, embodiments of this application also provide a computer program product, including a computer program / instructions, which, when executed by a processor, implement the traffic identification method disclosed in the foregoing embodiments.

[0062] For details regarding the specific process of the traffic identification method described above, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0063] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0064] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0065] The above provides a detailed description of the traffic identification method, apparatus, device, medium, and product provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A traffic flow identification method, characterized in that, Applied to security gateways, including: During the TCP three-way handshake with the client, a TCP connection is established with the server, and the TCP sequence numbers between the client and the security gateway, as well as between the security gateway and the server, are kept consistent. After the TCP three-way handshake is completed, the client greeting handshake packet sent by the client is received; Extract the target domain name information of the data stream from the client's greeting handshake packet; If the target domain name information matches any preset security policy, the preset security policy is executed; if the target domain name information does not match any preset security policy, the data flow is rolled back to the routing forwarding mode.

2. The traffic identification method according to claim 1, characterized in that, Maintaining consistency of TCP sequence numbers between the client and the security gateway, and between the security gateway and the server, includes: Extract the first TCP sequence number from the synchronization packet sent by the client, and use the first TCP sequence number as the TCP sequence number of the synchronization packet sent by the security gateway to the server; The system receives a synchronization confirmation packet returned by the server, extracts the second TCP sequence number from the synchronization confirmation packet, and uses the second TCP sequence number as the TCP sequence number of the synchronization confirmation packet that the security gateway replies to the client.

3. The traffic identification method according to claim 1, characterized in that, The target domain name information of the data stream is extracted from the client greeting handshake packet, including: The callback interface of the transport layer security protocol library is invoked to parse the client greeting handshake packet and read the target domain name information from the server name indication extended field.

4. The traffic identification method according to claim 1, characterized in that, The preset security policy includes access control policy and / or security detection policy; If the target domain name information matches any preset security policy, the preset security policy is executed, including: If the target domain name information matches any access control policy, the access control policy is executed to determine whether the data flow is allowed to pass through the security gateway; If the target domain name information matches any security detection policy, the security detection policy is executed to detect attack behavior in the data stream.

5. The traffic identification method according to claim 1, characterized in that, After falling back to routing forwarding mode for the data stream, the method further includes: Record the target domain name information; When the preset security policy is updated, if the target domain name information matches the updated security policy, a connection reset message is sent to the client to interrupt the current data flow and cause the client to re-initiate the TCP connection.

6. The traffic flow identification method according to any one of claims 1 to 5, characterized in that, The step of falling back to the routing forwarding mode for the data stream includes: Disconnect the TCP connections established between the security gateway and the client, as well as between the security gateway and the server, and switch the data stream to a Layer 3 routing forwarding mode, allowing the client and the server to communicate directly end-to-end.

7. A flow rate identification device, characterized in that, Applied to security gateways, including: The connection establishment module is used to establish a TCP connection with the server during the TCP three-way handshake process with the client, and to maintain the consistency of the TCP sequence numbers between the client and the security gateway, as well as between the security gateway and the server. The greeting packet receiving module is used to receive the client greeting handshake packet sent by the client after the TCP three-way handshake is completed; The domain name resolution module is used to extract the target domain name information of the data stream from the client's greeting handshake packet; The security policy execution module is used to execute the preset security policy when the target domain name information matches any preset security policy, and to fall back to the routing forwarding mode for the data flow when the target domain name information does not match any preset security policy.

8. An electronic device, characterized in that, Includes memory and processor, wherein: The memory is used to store computer programs; The processor is configured to execute the computer program to implement the traffic identification method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, Used to store a computer program, wherein the computer program, when executed by a processor, implements the traffic identification method as described in any one of claims 1 to 6.

10. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the traffic identification method as described in any one of claims 1 to 6.

Images