HTTPS Website Identification via Server Certificate Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network technologies cannot effectively identify websites visited over HTTPS protocol due to encrypted transmission, hindering website-based management, charging, and traffic control.
Innovation Solution
A deep packet inspection (DPI) device deployed in the network intercepts and analyzes the server certificate during key negotiation between a client and a server, calculates a key value using a digital digest algorithm, and searches a website key value table to identify the visited website, enabling effective website identification and management even over HTTPS.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If HTTPS encrypted transmission is used to protect user privacy and security, then transmission security is improved, but website identification capability deteriorates
Solution Approach 1:
The patent extracts the server certificate information from the encrypted HTTPS transmission stream during the handshake phase. The deep packet inspection device captures and parses the certificate message to obtain the common name field, which identifies the website without requiring decryption of the entire encrypted payload. This extraction approach maintains transmission security while enabling website identification.
Solution Approach 2:
The patent performs website identification during the SSL/TLS handshake phase, before the encrypted data transmission begins. By analyzing the server certificate that is exchanged during this preliminary phase, the system can identify the website intent before the encrypted tunnel is fully established, thus maintaining both security and identification capability.
2Difficulty of detecting and measuring
If deep packet inspection is implemented to identify HTTPS websites, then website identification capability is improved, but network device complexity increases
Solution Approach 1:
The patent extracts only the necessary common name field from the server certificate during the handshake phase, rather than attempting to decrypt or analyze the entire encrypted payload. This selective extraction approach minimizes processing requirements and device complexity while maintaining effective website identification capability.
3Measurement precision
If server certificate analysis is performed during HTTPS handshake, then website identification accuracy is improved, but processing time increases
Solution Approach 1:
The patent extracts only the common name field from the server certificate message during the SSL/TLS handshake phase, rather than performing complete certificate validation or decryption. This selective extraction of the specific identifier field enables accurate website identification with minimal processing time, as the common name directly reveals the website intent.
Solution Approach 2:
The patent performs the certificate analysis during the handshake phase, which occurs before the main data transmission begins. By completing the identification process during this preliminary phase, the system avoids adding processing time to the actual data transmission, thus minimizing the impact on overall communication efficiency.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
Embodiments of the present invention provide a method, an apparatus, and a network system for identifying a website, wherein the method for identifying a website includes: when a client visits a website over an HTTPS protocol, obtaining a server certificate of the visited website by acquiring and parsing a certificate message that is generated in a process of key negotiation between the client and a server; obtaining a key value of the server certificate according to a preset algorithm; searching a website key value table according to the key value of the server certificate; and if a website name corresponding to the key value of the server certificate is found in the website key value table, identifying, according to the website name, the website visited by the client. According to the method for identifying a website, the name of a website visited by a user can be identified even when the client visits the website over the HTTPS protocol.