Automated processing method and device based on vehicle-mounted interconnection protocol encrypted packet capture

Abstract

The application provides an automatic processing method and device based on vehicle-mounted interconnection protocol encryption packet capture, which comprises the following steps: receiving packet capture data and its associated session key log; extracting the payload from the packet capture data; splicing each payload to obtain two continuous byte streams in different communication directions; dividing each continuous byte stream to obtain a plurality of protocol frame data corresponding to each continuous byte stream; analyzing each protocol frame data to extract the client random number and the server random number; for each encrypted protocol frame data, performing authentication decryption according to the corresponding write key and initial vector to obtain the corresponding original service plaintext or failure reason record; integrating all unencrypted protocol frame data and the original service plaintext or failure reason record corresponding to the encrypted protocol frame data according to the transmission time sequence to obtain the protocol plaintext log. The application can greatly improve the analysis efficiency of encrypted packet capture.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an automated processing method and apparatus for encrypted packet capture based on vehicle connectivity protocols. Background Technology

[0002] The in-vehicle Android screen mirroring system transmits control, audio, video, sensor, and input information between the mobile phone and the vehicle's infotainment system via the vehicle connectivity protocol. During R&D, debugging, certification testing, and after-sales diagnostics, engineers need to reconstruct key processes such as service discovery, channel establishment, media startup, heartbeat interaction, and video frame transmission. The vehicle connectivity protocol data is carried within the transmission control protocol connection. After authentication, it is protected by AES-128-GCM encryption under Transport Layer Security (TLS) version 1.2. Conventional packet capture only yields the ciphertext. Manual analysis requires sequentially completing bidirectional message reassembly, random number extraction, master key matching, communication key derivation, additional authentication data construction, authentication decryption, and media data splitting—a complex process prone to failure due to incorrect sequence or parameters. Therefore, existing encrypted packet capture methods suffer from low parsing efficiency. Summary of the Invention

[0003] This invention provides an automated processing method and apparatus for encrypted packet capture based on vehicle connectivity protocols, aiming to solve the problem of low parsing efficiency in existing encrypted packet capture processing methods.

[0004] In a first aspect, embodiments of the present invention provide an automated processing method for encrypted packet capture based on a vehicle connectivity protocol, the method comprising: Receive packet capture data and its associated session key logs; Extract multiple payloads from the captured packet data; The payloads are spliced ​​together according to their communication direction and their own sequence number to obtain two consecutive byte streams with different communication directions. The continuous byte streams are segmented according to the vehicle connectivity protocol to obtain multiple protocol frame data corresponding to each continuous byte stream; The various control fields in each protocol frame data are parsed to extract client-side and server-side random numbers. Based on the client-side random number, the server-side random number, and the session key log, generate the write key and initial vector corresponding to each of the consecutive byte streams; For each encrypted protocol frame data, authentication and decryption are performed according to its corresponding write key and initialization vector to obtain the corresponding original business plaintext or failure reason record; The protocol plaintext log is obtained by integrating all unencrypted protocol frame data and all encrypted protocol frame data corresponding to the original service plaintext or failure reason records according to the transmission time sequence.

[0005] Secondly, embodiments of the present invention also provide an automated processing device for encrypted packet capture based on a vehicle connectivity protocol, the device comprising: The receiving unit is used to receive packet capture data and its associated session key logs; A filtering unit is used to extract multiple payloads from the captured packet data; The splicing unit is used to splice each payload according to its communication direction and its own sequence number to obtain two continuous byte streams with different communication directions. The segmentation unit is used to segment each of the continuous byte streams according to the vehicle connectivity protocol to obtain multiple protocol frame data corresponding to each of the continuous byte streams. The extraction unit is used to parse various control fields in each protocol frame data and extract client random numbers and server random numbers; The generation unit is used to generate a write key and an initial vector corresponding to each of the consecutive byte streams based on the client random number, the server random number, and the session key log. The decryption unit is used to perform authentication decryption for each encrypted protocol frame data according to its corresponding writing key and initialization vector to obtain the corresponding original service plaintext or failure reason record; The integration unit is used to integrate all unencrypted protocol frame data and all encrypted protocol frame data corresponding to the original service plaintext or failure reason records according to the transmission time sequence to obtain the protocol plaintext log.

[0006] Thirdly, embodiments of the present invention also provide an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method described in the first aspect above.

[0007] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing a computer program, the computer program including program instructions that, when executed by a processor, can implement the method described in the first aspect.

[0008] This invention provides an automated processing method and apparatus for encrypted packet capture based on a vehicle connectivity protocol. The method includes: receiving packet capture data and its associated session key log; extracting multiple payloads from the packet capture data; concatenating the payloads according to their communication direction and their associated sequence numbers to obtain two continuous byte streams with different communication directions; segmenting the continuous byte streams according to the vehicle connectivity protocol to obtain multiple protocol frame data corresponding to each continuous byte stream; parsing various control fields in each protocol frame data to extract client random numbers and server random numbers; generating a write key and an initialization vector corresponding to each continuous byte stream based on the client random numbers, the server random numbers, and the session key log; performing authentication and decryption for each encrypted protocol frame data according to its corresponding write key and initialization vector to obtain the corresponding original business plaintext or failure reason record; and integrating all unencrypted protocol frame data and all encrypted protocol frame data corresponding to the original business plaintext or failure reason record according to the transmission time sequence to obtain a protocol plaintext log. This invention obtains a plaintext log of the protocol that reconstructs the in-vehicle screen projection interaction process through automated processes such as bidirectional data reconstruction, authentication and decryption, and sequential integration. This effectively reduces the sequence and parameter errors caused by manual step-by-step operations and significantly improves the parsing efficiency of encrypted packet capture. Attached Figure Description

[0009] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0010] Figure 1 A flowchart illustrating the automated packet capture method based on the vehicle connectivity protocol provided in this embodiment of the invention; Figure 2 This is a schematic block diagram of an automated processing device for encrypted packet capture based on vehicle connectivity protocol, provided in an embodiment of the present invention. Figure 3 A schematic block diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0011] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0012] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0013] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0014] It should also be further understood that the term "and / or" as used in this specification and appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes such combinations. Embodiments of this invention provide an automated processing method and apparatus for encrypted packet capture based on a vehicle connectivity protocol. The method is applied to a terminal device or server, which can be an electronic device such as a mobile phone, tablet computer, laptop computer, desktop computer, personal digital assistant, or wearable device; the server can be a single server or a server cluster composed of multiple servers. The invention will now be described in detail through specific embodiments.

[0015] Figure 1 This is a flowchart illustrating the automated packet capture method based on the vehicle connectivity protocol provided in an embodiment of the present invention. Figure 1 As shown, the method includes the following steps S110-S180.

[0016] S110, Receive packet capture data and its associated session key log.

[0017] In this embodiment, packet capture data between the client and the server is received. The client is a mobile phone and the server is a vehicle system. The packet capture data is associated with a session key log, and subsequent decryption operations are performed based on the session key log.

[0018] In one embodiment, after step S110, the method further includes: determining whether the port parameters associated with the packet capture data are within a valid range; if the port parameters are within a valid range, then performing the step of extracting multiple payloads from the packet capture data; if the port parameters are not within a valid range, then outputting a corresponding error message and stopping subsequent decryption operations.

[0019] In this embodiment, it is determined whether the port parameters associated with the captured packet data are within a valid range; the port parameters include vehicle-mounted service port parameters and mobile phone-side port parameters; if the port parameters are within a valid range, the step of extracting multiple payloads from the captured packet data is executed; if the port parameters are not within a valid range, a corresponding error message is output and subsequent decryption operations are stopped.

[0020] S120. Extract multiple payloads from the packet capture data.

[0021] In this embodiment, the Transmission Control Protocol (TCP) messages in the captured packet data are traversed to extract multiple payloads.

[0022] More specifically, the transmission control protocol messages in the captured data are traversed to extract multiple initial payloads; initial payloads with the same sequence number and payloads with different sequence numbers but overlapping byte ranges are deduplicated; and the initial payloads after deduplication are used as the payloads.

[0023] S130. The payloads are spliced ​​together according to their communication direction and their own sequence number to obtain two continuous byte streams with different communication directions.

[0024] In this embodiment, payload reassembly operations are performed for the two communication directions: vehicle-to-mobile phone and mobile phone-to-vehicle. Based on the serial number of the payload, all payloads in the corresponding communication direction are spliced ​​together to obtain a continuous byte stream in the corresponding communication direction.

[0025] S140. The continuous byte streams are segmented according to the vehicle connectivity protocol to obtain multiple protocol frame data corresponding to each continuous byte stream.

[0026] In this embodiment, for each of the continuous byte streams, the continuous byte streams are segmented according to the transmission restrictions of the vehicle connectivity protocol to obtain multiple protocol frame data.

[0027] S150. Parse the various control fields in each of the protocol frame data and extract the client random number and the server random number.

[0028] In this embodiment, the protocol frame data includes the following control fields: channel identifier, fragmentation status, control status, and encryption status; the various control fields in each of the protocol frame data are parsed, and protocol frame data with a channel identifier of zero and an encryption status of unencrypted are selected as handshake bearer frames; client random numbers and server random numbers are extracted from each of the handshake bearer frames.

[0029] In one embodiment, step S150 includes: parsing various control fields in each of the protocol frame data, and selecting protocol frame data with a channel identifier of zero and an unencrypted state as handshake bearer frames; parsing the transport layer security protocol records of each of the handshake bearer frames to identify client greeting messages and server greeting messages; extracting client random numbers from the client greeting messages and extracting server random numbers from the server greeting messages.

[0030] In this embodiment, various control fields in each protocol frame data are parsed, and protocol frame data with a channel identifier of zero and an unencrypted state are selected as handshake bearer frames. For the communication direction from mobile phone to vehicle, the transport layer security protocol records of all the handshake bearer frames in this communication direction are parsed to identify the client greeting message, and the client random number is extracted from the client greeting message; For the vehicle-to-mobile communication direction, the transport layer security protocol records of all the handshake bearer frames in this communication direction are parsed to identify the server-side greeting message, and the server-side random number is extracted from the server-side greeting message.

[0031] S160. Based on the client random number, the server random number, and the session key log, generate the write key and initial vector corresponding to each of the consecutive byte streams.

[0032] In this embodiment, the session master key is searched in the session key log using the client random number as an index; the session master key, the client random number, and the server random number are used as inputs, and the write key and initial vector corresponding to each of the consecutive byte streams are generated according to the key expansion rules under Transport Layer Security Protocol version 1.2.

[0033] In one embodiment, step S160 includes: searching for the session master key in the session key log based on the client random number; and generating a write key and an initial vector corresponding to each of the consecutive byte streams based on the session master key, the client random number, and the server random number.

[0034] In this embodiment, the session master key is searched in the session key log using the client's random number as an index; For the communication direction from mobile phone to vehicle, this communication direction corresponds to a continuous byte stream. The specific logic for generating the write key and initial vector corresponding to this continuous byte stream is as follows: taking the session master key and the client random number as input, and according to the key expansion rules under the Transport Layer Security Protocol version 1.2, the write key and initial vector corresponding to this continuous byte stream are generated. For the communication direction from the vehicle to the mobile phone, this communication direction corresponds to a continuous byte stream. The specific logic for generating the write key and initial vector corresponding to this continuous byte stream is as follows: using the session master key and the server-side random number as input, the write key and initial vector corresponding to this continuous byte stream are generated according to the key expansion rules under Transport Layer Security Protocol version 1.2.

[0035] S170. For each encrypted protocol frame data, perform authentication and decryption according to its corresponding write key and initialization vector to obtain the corresponding original service plaintext or failure reason record.

[0036] In this embodiment, if the protocol frame data belongs to the vehicle-to-mobile communication direction, authentication and decryption are performed according to the writing key and the initial vector corresponding to the communication direction; that is, each protocol frame data corresponds to a writing key and an initial vector.

[0037] If the captured data is protected using AES-128-GCM encryption mode under Transport Layer Security 1.2, then for each encrypted protocol frame, AES-128-GCM encryption mode under Transport Layer Security 1.2 is used to perform authentication and decryption on the protocol frame data according to its corresponding write key and initialization vector; if the authentication is successful, the corresponding original service plaintext can be obtained from the protocol frame data; if the authentication fails, the reason for the failure is recorded and a corresponding failure reason record is generated.

[0038] In one embodiment, step S170 includes: extracting an explicit random number and additional authentication data from the record body of the encrypted protocol frame data; concatenating the explicit random number with the corresponding initial vector to obtain a decryption random number; and performing authentication decryption based on the additional authentication data, the decryption random number, and the corresponding write key to obtain the corresponding original service plaintext or failure reason record.

[0039] In this embodiment, for each encrypted protocol frame data, an explicit random number and additional authentication data are extracted from the record body of the protocol frame data; wherein, the additional authentication data consists of record sequence number, content type, protocol version and plaintext length; the explicit random number is concatenated with the corresponding initial vector to obtain the decryption random number; If the captured data is protected using AES-128-GCM encryption mode under Transport Layer Security (TLS) version 1.2, then for each encrypted protocol frame data, AES-128-GCM encryption mode under TLS 1.2 is used to perform authentication and decryption based on the additional authentication data, the decryption random number, and the write key corresponding to the protocol frame data. If authentication is successful, the corresponding original service plaintext can be obtained from the protocol frame data; if authentication fails, the reason for failure is recorded, and a corresponding failure reason record is generated.

[0040] In one embodiment, after step S170, the method further includes: for each of the continuous byte streams, integrating the original service plaintext or failure reason records corresponding to all unencrypted protocol frame data and all encrypted protocol frame data in the continuous byte stream to obtain a plaintext packet capture file corresponding to the communication direction.

[0041] In this embodiment, taking the communication direction from mobile phone to vehicle as an example, for the continuous byte stream corresponding to the communication direction, all unencrypted protocol frame data and all encrypted protocol frame data in the continuous byte stream are integrated to obtain the plaintext packet capture file corresponding to the communication direction.

[0042] In one embodiment, after step S170, the method further includes: filtering out protocol frame data belonging to a media channel based on the channel identifier in each protocol frame data; extracting sequence parameters, image parameters, and video encoded data segments in each protocol frame data from the unencrypted protocol frame data and the original service plaintext corresponding to the encrypted protocol frame data in the media channel; integrating each video encoded data segment according to the transmission timing to obtain an initial video data file; and writing the sequence parameters and image parameters into the header area of ​​the initial video data file to obtain a video data file.

[0043] In this embodiment, protocol frame data belonging to the media channel is filtered out based on the channel identifier in each protocol frame data. It should be noted that only successfully authenticated encrypted protocol frame data and unencrypted protocol frames will enter the subsequent video data file generation process. Sequence parameters, image parameters, and video encoded data segments in each protocol frame are extracted from the unencrypted protocol frame data and the original plaintext of the encrypted protocol frame data in the media channel; the video encoded data segments are integrated according to the transmission sequence to obtain an initial video data file; the sequence parameters and image parameters are written into the header area of ​​the initial video data file to obtain the video data file.

[0044] S180. Integrate all unencrypted protocol frame data and all encrypted protocol frame data corresponding to the original service plaintext or failure reason records according to the transmission time sequence to obtain the protocol plaintext log.

[0045] In this embodiment, the original plaintext of the service or failure reason record corresponding to all unencrypted protocol frame data and all encrypted protocol frame data are integrated according to the transmission time sequence to obtain the protocol plaintext log that restores the in-vehicle screen projection interaction process.

[0046] More specifically, plaintext packet capture files, video data files, and plaintext protocol logs can all be used for process reproduction and difference comparison in automated regression testing.

[0047] In summary, this invention obtains the plaintext log of the protocol that reconstructs the in-vehicle screen projection interaction process through automated processes such as bidirectional data reconstruction, authentication and decryption, and sequential integration. This effectively reduces the sequence and parameter errors caused by manual step-by-step operations and significantly improves the parsing efficiency of encrypted packet capture.

[0048] Figure 2 This is a schematic block diagram of an automated processing device for encrypted packet capture based on a vehicle connectivity protocol, provided in an embodiment of the present invention. Figure 2 As shown, corresponding to the above-described automated processing method for encrypted packet capture based on the vehicle connectivity protocol, this invention also provides an automated processing device for encrypted packet capture based on the vehicle connectivity protocol. The device is configured in a terminal device or a server. The terminal device can be an electronic device such as a mobile phone, tablet computer, laptop computer, desktop computer, personal digital assistant, or wearable device. The server can be a single server or a server cluster composed of multiple servers. For details, please refer to... Figure 2 The automated packet capture processing device 700 based on the vehicle connectivity protocol includes: The receiving unit 701 is used to receive packet capture data and its associated session key log; The filtering unit 702 is used to extract multiple payloads from the packet capture data; The splicing unit 703 is used to splice each payload according to its communication direction and its own sequence number to obtain two continuous byte streams with different communication directions. The segmentation unit 704 is used to segment each of the continuous byte streams according to the vehicle connectivity protocol to obtain multiple protocol frame data corresponding to each of the continuous byte streams. Extraction unit 705 is used to parse various control fields in each of the protocol frame data and extract client random numbers and server random numbers; The generation unit 706 is used to generate a write key and an initial vector corresponding to each of the continuous byte streams based on the client random number, the server random number, and the session key log. The decryption unit 707 is used to perform authentication decryption for each encrypted protocol frame data according to its corresponding writing key and initialization vector to obtain the corresponding original service plaintext or failure reason record; The integration unit 708 is used to integrate all unencrypted protocol frame data and all encrypted protocol frame data corresponding to the original service plaintext or failure reason records according to the transmission time sequence to obtain the protocol plaintext log.

[0049] In some embodiments, after performing the step of receiving packet capture data and its associated session key log, the receiving unit 701 is further configured to: Determine whether the port parameters associated with the captured packet data are within a valid range; if the port parameters are within a valid range, then perform the step of extracting multiple payloads from the captured packet data; if the port parameters are not within a valid range, then output the corresponding error message and stop the subsequent decryption operation.

[0050] In some embodiments, when the extraction unit 705 performs the steps of parsing various control fields in each protocol frame data and extracting client random numbers and server random numbers, it is specifically used for: The various control fields in each of the protocol frame data are parsed, and protocol frame data with a channel identifier of zero and an unencrypted state are selected as handshake bearer frames; the transport layer security protocol records of each of the handshake bearer frames are parsed to identify the client greeting message and the server greeting message; a client random number is extracted from the client greeting message, and a server random number is extracted from the server greeting message.

[0051] In some embodiments, when the generation unit 706 performs the step of generating the write key and initialization vector corresponding to each of the consecutive byte streams based on the client random number, the server random number, and the session key log, it is specifically used for: The session master key is retrieved from the session key log based on the client's random number; the write key and initial vector corresponding to each of the consecutive byte streams are generated based on the session master key, the client's random number, and the server's random number.

[0052] In some embodiments, when the decryption unit 707 performs the step of performing authentication decryption for each encrypted protocol frame data according to its corresponding write key and initialization vector to obtain the corresponding original service plaintext or failure reason record, it is specifically used for: Explicit random numbers and additional authentication data are extracted from the record body of the encrypted protocol frame data; the explicit random numbers are concatenated with the corresponding initial vector to obtain decryption random numbers; authentication and decryption are performed according to the additional authentication data, the decryption random numbers and the corresponding write key to obtain the corresponding original business plaintext or failure reason record.

[0053] In some embodiments, after performing the step of performing authentication decryption for each encrypted protocol frame data according to its corresponding write key and initialization vector to obtain the corresponding original service plaintext or failure reason record, the decryption unit 707 is further configured to: For each of the continuous byte streams, the original plaintext of the service or the failure reason record corresponding to all unencrypted protocol frame data and all encrypted protocol frame data in the continuous byte stream are integrated to obtain a plaintext packet capture file corresponding to the communication direction.

[0054] In some embodiments, after performing the step of performing authentication decryption for each encrypted protocol frame data according to its corresponding write key and initialization vector to obtain the corresponding original service plaintext or failure reason record, the decryption unit 707 is further configured to: Based on the channel identifier in each protocol frame data, protocol frame data belonging to the media channel are filtered out; sequence parameters, image parameters, and video encoded data segments in each protocol frame data are extracted from the unencrypted protocol frame data and the original service plaintext corresponding to the encrypted protocol frame data in the media channel; the video encoded data segments are integrated according to the transmission time sequence to obtain an initial video data file; the sequence parameters and image parameters are written into the header area of ​​the initial video data file to obtain the video data file.

[0055] It should be noted that those skilled in the art can clearly understand that the specific implementation process of the above-mentioned automated processing device and its units based on vehicle connectivity protocol encryption packet capture can be referred to the corresponding descriptions in the foregoing method embodiments. For the sake of convenience and brevity, these will not be repeated here.

[0056] The aforementioned automated packet capture device based on the vehicle connectivity protocol can be implemented as a computer program, which can, for example... Figure 3 It runs on the electronic device shown.

[0057] Please see Figure 3 , Figure 3This is a schematic block diagram of an electronic device provided in an embodiment of the present invention. The electronic device 800 can be a terminal or a server. The terminal can be an electronic device with communication functions. The server can be a standalone server or a server cluster composed of multiple servers.

[0058] See Figure 3 The electronic device 800 includes a processor 802, a memory, and a network interface 805 connected via a system bus 801. The memory may include a non-volatile storage medium 803 and internal memory 804.

[0059] The non-volatile storage medium 803 may store an operating system 8031 ​​and a computer program 8032. The computer program 8032 includes program instructions that, when executed, cause the processor 802 to perform an automated processing method for encrypted packet capture based on a vehicle connectivity protocol.

[0060] The processor 802 provides computing and control capabilities to support the operation of the entire electronic device 800.

[0061] The internal memory 804 provides an environment for the execution of the computer program 8032 in the non-volatile storage medium 803. When the computer program 8032 is executed by the processor 802, the processor 802 can execute an automated processing method for encrypted packet capture based on the vehicle interconnection protocol.

[0062] This network interface 805 is used for network communication with other devices. Those skilled in the art will understand that... Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present invention and does not constitute a limitation on the electronic device 800 to which the present invention is applied. The specific electronic device 800 may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0063] The processor 802 is used to run a computer program 8032 stored in the memory to perform the following steps: The system receives packet capture data and its associated session key log; extracts multiple payloads from the packet capture data; concatenates each payload according to its communication direction and its associated sequence number to obtain two continuous byte streams with different communication directions; segments each continuous byte stream according to the vehicle connectivity protocol to obtain multiple protocol frame data corresponding to each continuous byte stream; parses various control fields in each protocol frame data to extract client random numbers and server random numbers; generates a write key and initialization vector corresponding to each continuous byte stream based on the client random number, the server random number, and the session key log; performs authentication and decryption for each encrypted protocol frame data according to its corresponding write key and initialization vector to obtain the corresponding original service plaintext or failure reason record; integrates all unencrypted protocol frame data and all encrypted protocol frame data corresponding to the original service plaintext or failure reason record according to the transmission time sequence to obtain the protocol plaintext log.

[0064] In some embodiments, after implementing the step of receiving packet capture data and its associated session key log, the processor 802 further implements the following steps: Determine whether the port parameters associated with the captured packet data are within a valid range; if the port parameters are within a valid range, then perform the step of extracting multiple payloads from the captured packet data; if the port parameters are not within a valid range, then output the corresponding error message and stop the subsequent decryption operation.

[0065] In some embodiments, when the processor 802 parses various control fields in each protocol frame data and extracts client-side random numbers and server-side random numbers, it specifically implements the following steps: The various control fields in each of the protocol frame data are parsed, and protocol frame data with a channel identifier of zero and an unencrypted state are selected as handshake bearer frames; the transport layer security protocol records of each of the handshake bearer frames are parsed to identify the client greeting message and the server greeting message; a client random number is extracted from the client greeting message, and a server random number is extracted from the server greeting message.

[0066] In some embodiments, when the processor 802 generates the write key and initialization vector corresponding to each of the consecutive byte streams based on the client random number, the server random number, and the session key log, it specifically implements the following steps: The session master key is retrieved from the session key log based on the client's random number; the write key and initial vector corresponding to each of the consecutive byte streams are generated based on the session master key, the client's random number, and the server's random number.

[0067] In some embodiments, when the processor 802 performs authentication and decryption for each encrypted protocol frame data according to its corresponding write key and initialization vector to obtain the corresponding original service plaintext or failure reason record, the specific steps are as follows: Explicit random numbers and additional authentication data are extracted from the record body of the encrypted protocol frame data; the explicit random numbers are concatenated with the corresponding initial vector to obtain decryption random numbers; authentication and decryption are performed according to the additional authentication data, the decryption random numbers and the corresponding write key to obtain the corresponding original business plaintext or failure reason record.

[0068] In some embodiments, after implementing the step of performing authentication and decryption for each encrypted protocol frame data according to its corresponding write key and initialization vector to obtain the corresponding original service plaintext or failure reason record, the processor 802 further implements the following steps: For each of the continuous byte streams, the original plaintext of the service or the failure reason record corresponding to all unencrypted protocol frame data and all encrypted protocol frame data in the continuous byte stream are integrated to obtain a plaintext packet capture file corresponding to the communication direction.

[0069] In some embodiments, after implementing the step of performing authentication and decryption for each encrypted protocol frame data according to its corresponding write key and initialization vector to obtain the corresponding original service plaintext or failure reason record, the processor 802 further implements the following steps: Based on the channel identifier in each protocol frame data, protocol frame data belonging to the media channel are filtered out; sequence parameters, image parameters, and video encoded data segments in each protocol frame data are extracted from the unencrypted protocol frame data and the original service plaintext corresponding to the encrypted protocol frame data in the media channel; the video encoded data segments are integrated according to the transmission time sequence to obtain an initial video data file; the sequence parameters and image parameters are written into the header area of ​​the initial video data file to obtain the video data file.

[0070] It should be understood that, in this embodiment of the invention, the processor 802 may be a Central Processing Unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0071] It will be understood by those skilled in the art that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program includes program instructions and can be stored in a storage medium, which is a computer-readable storage medium. The program instructions are executed by at least one processor in the computer system to implement the process steps of the embodiments of the above methods.

[0072] Therefore, the present invention also provides a storage medium. This storage medium can be a computer-readable storage medium. The storage medium stores a computer program, wherein the computer program includes program instructions. When executed by a processor, the program instructions cause the processor to perform the following steps: The system receives packet capture data and its associated session key log; extracts multiple payloads from the packet capture data; concatenates each payload according to its communication direction and its associated sequence number to obtain two continuous byte streams with different communication directions; segments each continuous byte stream according to the vehicle connectivity protocol to obtain multiple protocol frame data corresponding to each continuous byte stream; parses various control fields in each protocol frame data to extract client random numbers and server random numbers; generates a write key and initialization vector corresponding to each continuous byte stream based on the client random number, the server random number, and the session key log; performs authentication and decryption for each encrypted protocol frame data according to its corresponding write key and initialization vector to obtain the corresponding original service plaintext or failure reason record; integrates all unencrypted protocol frame data and all encrypted protocol frame data corresponding to the original service plaintext or failure reason record according to the transmission time sequence to obtain the protocol plaintext log.

[0073] In one embodiment, after executing the program instructions to receive packet capture data and its associated session key log, the processor further implements the following steps: Determine whether the port parameters associated with the captured packet data are within a valid range; if the port parameters are within a valid range, then perform the step of extracting multiple payloads from the captured packet data; if the port parameters are not within a valid range, then output the corresponding error message and stop the subsequent decryption operation.

[0074] In one embodiment, when the processor executes the program instructions to parse various control fields in each of the protocol frame data and extract client-side random numbers and server-side random numbers, it specifically implements the following steps: The various control fields in each of the protocol frame data are parsed, and protocol frame data with a channel identifier of zero and an unencrypted state are selected as handshake bearer frames; the transport layer security protocol records of each of the handshake bearer frames are parsed to identify the client greeting message and the server greeting message; a client random number is extracted from the client greeting message, and a server random number is extracted from the server greeting message.

[0075] In one embodiment, when the processor executes the program instructions to generate the write key and initialization vector corresponding to each of the consecutive byte streams based on the client random number, the server random number, and the session key log, the specific implementation steps are as follows: The session master key is retrieved from the session key log based on the client's random number; the write key and initial vector corresponding to each of the consecutive byte streams are generated based on the session master key, the client's random number, and the server's random number.

[0076] In one embodiment, when the processor executes the program instructions to perform authentication and decryption for each encrypted protocol frame data according to its corresponding write key and initialization vector to obtain the corresponding original service plaintext or failure reason record, the specific steps are as follows: Explicit random numbers and additional authentication data are extracted from the record body of the encrypted protocol frame data; the explicit random numbers are concatenated with the corresponding initial vector to obtain decryption random numbers; authentication and decryption are performed according to the additional authentication data, the decryption random numbers and the corresponding write key to obtain the corresponding original business plaintext or failure reason record.

[0077] In one embodiment, after executing the program instructions to perform authentication and decryption for each encrypted protocol frame data according to its corresponding write key and initialization vector to obtain the corresponding original service plaintext or failure reason record, the processor further performs the following steps: For each of the continuous byte streams, the original plaintext of the service or the failure reason record corresponding to all unencrypted protocol frame data and all encrypted protocol frame data in the continuous byte stream are integrated to obtain a plaintext packet capture file corresponding to the communication direction.

[0078] In one embodiment, after executing the program instructions to perform authentication and decryption for each encrypted protocol frame data according to its corresponding write key and initialization vector to obtain the corresponding original service plaintext or failure reason record, the processor further performs the following steps: Based on the channel identifier in each protocol frame data, protocol frame data belonging to the media channel are filtered out; sequence parameters, image parameters, and video encoded data segments in each protocol frame data are extracted from the unencrypted protocol frame data and the original service plaintext corresponding to the encrypted protocol frame data in the media channel; the video encoded data segments are integrated according to the transmission time sequence to obtain an initial video data file; the sequence parameters and image parameters are written into the header area of ​​the initial video data file to obtain the video data file.

[0079] The storage medium can be any computer-readable storage medium capable of storing program code, such as a USB flash drive, portable hard drive, read-only memory (ROM), magnetic disk, or optical disk.

[0080] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0081] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For example, the division of each unit is merely a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0082] The steps in the method of this invention can be adjusted, merged, or reduced in order according to actual needs. The units in the device of this invention can be merged, divided, or reduced according to actual needs. Furthermore, the functional units in the various embodiments of this invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0083] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause an electronic device (which may be a personal computer, a terminal, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention.

[0084] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. An automated processing method for encrypted packet capture based on vehicle connectivity protocols, characterized in that, The method includes: Receive packet capture data and its associated session key logs; Extract multiple payloads from the captured packet data; The payloads are spliced ​​together according to their communication direction and their own sequence number to obtain two consecutive byte streams with different communication directions. The continuous byte streams are segmented according to the vehicle connectivity protocol to obtain multiple protocol frame data corresponding to each continuous byte stream; The various control fields in each protocol frame data are parsed to extract client-side and server-side random numbers. Based on the client-side random number, the server-side random number, and the session key log, generate the write key and initial vector corresponding to each of the consecutive byte streams; For each encrypted protocol frame data, authentication and decryption are performed according to its corresponding write key and initialization vector to obtain the corresponding original business plaintext or failure reason record; The protocol plaintext log is obtained by integrating all unencrypted protocol frame data and all encrypted protocol frame data corresponding to the original service plaintext or failure reason records according to the transmission time sequence.

2. The automated processing method for encrypted packet capture based on vehicle connectivity protocol according to claim 1, characterized in that, After receiving the packet capture data and its associated session key log, the process also includes: Determine whether the port parameters associated with the captured packet data are within a valid range; If the port parameters are within a valid range, then the step of extracting multiple payloads from the captured packet data is executed; If the port parameters are not within the valid range, the corresponding error message will be output and the subsequent decryption operation will be stopped.

3. The automated processing method for encrypted packet capture based on vehicle connectivity protocol according to claim 1, characterized in that, The step of parsing various control fields in each protocol frame data and extracting client-side and server-side random numbers includes: The various control fields in each of the protocol frame data are parsed, and the protocol frame data with a channel identifier of zero and an unencrypted state are selected as the handshake bearer frames. The transport layer security protocol records of each handshake bearer frame are parsed to identify the client greeting message and the server greeting message; Extract a client-side random number from the client-side greeting message, and extract a server-side random number from the server-side greeting message.

4. The automated processing method for encrypted packet capture based on vehicle connectivity protocol according to claim 1, characterized in that, The step of generating the write key and initial vector corresponding to each of the consecutive byte streams based on the client random number, the server random number, and the session key log includes: The session master key is retrieved from the session key log based on the client's random number. Based on the session master key, the client random number, and the server random number, a write key and an initial vector are generated for each of the consecutive byte streams.

5. The automated processing method for encrypted packet capture based on vehicle connectivity protocol according to claim 1, characterized in that, For each encrypted protocol frame data, authentication and decryption are performed based on its corresponding write key and initialization vector to obtain the corresponding original service plaintext or failure reason record, including: Extract explicit random numbers and additional authentication data from the record body of the encrypted protocol frame data; The explicit random number is concatenated with the corresponding initial vector to obtain the decrypted random number; Authentication and decryption are performed based on the additional authentication data, the decryption random number, and the corresponding write key to obtain the corresponding original business plaintext or failure reason record.

6. The automated processing method for encrypted packet capture based on vehicle connectivity protocol according to claim 1, characterized in that, After performing authentication and decryption for each encrypted protocol frame data according to its corresponding write key and initialization vector to obtain the corresponding original service plaintext or failure reason record, the method further includes: For each of the continuous byte streams, the original plaintext of the service or the failure reason record corresponding to all unencrypted protocol frame data and all encrypted protocol frame data in the continuous byte stream are integrated to obtain a plaintext packet capture file corresponding to the communication direction.

7. The automated processing method for encrypted packet capture based on vehicle connectivity protocol according to claim 1, characterized in that, After performing authentication and decryption for each encrypted protocol frame data according to its corresponding write key and initialization vector to obtain the corresponding original service plaintext or failure reason record, the method further includes: Based on the channel identifier in each protocol frame data, filter out the protocol frame data belonging to the media channel; Extract sequence parameters, image parameters, and video encoded data segments from the unencrypted protocol frame data and the original service plaintext corresponding to the encrypted protocol frame data in the media channel. The video encoded data segments are integrated according to the transmission sequence to obtain the initial video data file; The sequence parameters and the image parameters are written into the header area of ​​the initial video data file to obtain the video data file.

8. An automated processing device for encrypted packet capture based on vehicle connectivity protocols, characterized in that, The device includes: The receiving unit is used to receive packet capture data and its associated session key logs; A filtering unit is used to extract multiple payloads from the captured packet data; The splicing unit is used to splice each payload according to its communication direction and its own sequence number to obtain two continuous byte streams with different communication directions. The segmentation unit is used to segment each of the continuous byte streams according to the vehicle connectivity protocol to obtain multiple protocol frame data corresponding to each of the continuous byte streams. The extraction unit is used to parse various control fields in each protocol frame data and extract client random numbers and server random numbers; The generation unit is used to generate a write key and an initial vector corresponding to each of the consecutive byte streams based on the client random number, the server random number, and the session key log. The decryption unit is used to perform authentication decryption for each encrypted protocol frame data according to its corresponding writing key and initialization vector to obtain the corresponding original service plaintext or failure reason record; The integration unit is used to integrate all unencrypted protocol frame data and all encrypted protocol frame data corresponding to the original service plaintext or failure reason records according to the transmission time sequence to obtain the protocol plaintext log.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the automated processing method for encrypted packet capture based on the vehicle connectivity protocol as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which includes program instructions. When executed by a processor, the program instructions cause the processor to perform the automated processing method for encrypted packet capture based on the vehicle connectivity protocol as described in any one of claims 1-7.

Images