CN114679314A - Data decryption method, device, equipment and storage medium - Google Patents

Data decryption method, device, equipment and storage medium Download PDF

Info

Publication number
CN114679314A
CN114679314A CN202210295761.9A CN202210295761A CN114679314A CN 114679314 A CN114679314 A CN 114679314A CN 202210295761 A CN202210295761 A CN 202210295761A CN 114679314 A CN114679314 A CN 114679314A
Authority
CN
China
Prior art keywords
data
server
key
encrypted
quic
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN202210295761.9A
Other languages
Chinese (zh)
Other versions
CN114679314B (en
Inventor
谭奎
罗成
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Tencent Technology Shenzhen Co Ltd
Original Assignee
Tencent Technology Shenzhen Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Tencent Technology Shenzhen Co Ltd filed Critical Tencent Technology Shenzhen Co Ltd
Priority to CN202210295761.9A priority Critical patent/CN114679314B/en
Publication of CN114679314A publication Critical patent/CN114679314A/en
Application granted granted Critical
Publication of CN114679314B publication Critical patent/CN114679314B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords

Abstract

The application provides a method, a device, equipment and a storage medium for data decryption, which relate to the technical field of internet communication; in the embodiment of the application, key information negotiated between a terminal device and a server is obtained, wherein the key information comprises a premaster secret key, a session secret key between the terminal device and the server is generated according to the premaster secret key based on a general rule negotiated between the terminal device and the server, encrypted QUIC data transmitted between the terminal device and the server is obtained, the encrypted QUIC data is decrypted through the session secret key, corresponding plaintext data is obtained, and integrity analysis is carried out on the plaintext data; the encrypted QUIC data is decrypted to obtain corresponding plaintext data, integrity analysis is further performed on the plaintext data, real data content corresponding to an application layer transmitted in the data transmission process and data receiving and transmitting conditions corresponding to a transmission layer can be determined, data packet loss monitoring is achieved, and accuracy of data transmission content is guaranteed.

Description

Data decryption method, device, equipment and storage medium
Technical Field
The present application relates to the field of internet communications technologies, and in particular, to a method, an apparatus, a device, and a storage medium for data decryption.
Background
With the development of internet technology, the increase of images, videos and other multimedia contents, a widely used hypertext Transfer Protocol (HTTP) cannot meet the transmission of complex data; at present, in order to satisfy the transmission of complex data, a low-latency Internet transmission Protocol (quickudp) based on a User Data Protocol (UDP) is proposed.
In order to ensure the security of data transmission, in the process of data transmission, the QUIC transmission protocol encrypts the data of an application layer and the information of a transmission layer and transmits the data by adopting the encrypted QUIC data. However, due to imperfect support of the QUIC transmission protocol, the application layer data and the transmission layer information are encrypted and cannot be decrypted to obtain effective information in the transmission process; for example: it is impossible to decrypt the data received by the opposite end, that is, it is impossible to determine whether the data is lost, and it is impossible to decrypt the actual data content of the transmission, that is, it is impossible to ensure the accuracy of the data transmission.
Therefore, how to decrypt the encrypted QUIC data, realize data packet loss monitoring and ensure the accuracy of data transmission content is a problem to be solved at present.
Disclosure of Invention
The application provides a data decryption method, a device, equipment and a storage medium, which are used for realizing decryption processing on encrypted QUIC data, realizing data packet loss monitoring and ensuring the accuracy of data transmission contents.
In a first aspect, an embodiment of the present application provides a method for decrypting data, where the method includes:
acquiring key information negotiated by the terminal equipment and the server, wherein the key information comprises a premaster key;
generating a session key between the terminal equipment and the server according to the pre-master key based on a general rule negotiated by the terminal equipment and the server;
acquiring encrypted QUIC data transmitted between terminal equipment and a server;
and decrypting the encrypted QUIC data through the session key to obtain corresponding plaintext data, and performing data integrity analysis on the plaintext data.
In a possible implementation manner, the premaster secret key is generated by the terminal device or the server according to the random value generated by the terminal device or the server and the public key random value sent by the opposite terminal.
In a possible implementation manner, the key information further includes a terminal random number and a server random number;
generating a session key between the terminal device and the server according to the premaster secret key, specifically comprising:
pseudo-randomization processing is carried out according to the pre-master key, the terminal random number and the server random number to generate a pseudo-randomized key;
and performing key derivation processing on the pseudo-randomized key, expanding the pseudo-randomized key to a specified length, and generating a session key.
In one possible implementation manner, the obtaining of encrypted QUIC data transmitted between a terminal device and a server includes:
capturing a session data packet transmitted between the terminal equipment and the server through a QUIC protocol in the session process of the terminal equipment and the server, and converting the file format of the session data packet into a target file format;
analyzing the session data packet according to the target file format to obtain an encrypted session data byte stream transmitted between the terminal equipment and the server;
and converting the encrypted session data byte stream into a QUIC format to obtain encrypted QUIC data.
In a possible implementation manner, after converting the encrypted session data byte stream into a QUIC format and acquiring the encrypted QUIC data, and before performing decryption processing on the encrypted QUIC data through a session key, the method further includes:
and carrying out verification processing on the encrypted QUIC data through one or the combination of the following modes:
reading the public identification of each session data byte in the encrypted QUIC data, and respectively checking whether the public identification is in a specified range;
reading the QUIC version number corresponding to the encrypted QUIC data, and checking whether the encrypted QUIC data is the correct version according to the QUIC version number;
reading a connection identifier in the encrypted QUIC data, and matching the connection identifier with a reference identifier of the current session;
and reading the packet number corresponding to the encrypted QUIC data, and checking whether the packet number is in a target range.
In a possible implementation manner, after the encrypted QUIC data is decrypted by the session key to obtain corresponding plaintext data, the method further includes:
respectively identifying the data type corresponding to each frame data aiming at each frame data contained in the plaintext data;
and respectively determining corresponding frame processing modes aiming at the data types, and analyzing the corresponding frame data based on the determined frame processing modes to acquire corresponding analysis data.
In a possible implementation manner, after the encrypted QUIC data is decrypted by the session key to obtain corresponding plaintext data, the method further includes:
displaying plaintext data in a target display mode;
the target display mode comprises a text format, a log file format and an interactive graph format.
In a second aspect, an embodiment of the present application provides an apparatus for decrypting data, where the apparatus includes:
the first obtaining unit is used for obtaining key information negotiated by the terminal equipment and the server, wherein the key information comprises a pre-master key;
the generation unit is used for generating a session key between the terminal equipment and the server according to the premaster key based on a general rule negotiated by the terminal equipment and the server;
a second acquisition unit for acquiring encrypted QUIC data transmitted between the terminal device and the server;
and the decryption unit is used for decrypting the encrypted QUIC data through the session key to obtain corresponding plaintext data and carrying out data integrity analysis on the plaintext data.
In a possible implementation manner, the premaster secret key is generated by the terminal device or the server according to the random value generated by the terminal device or the server and the public key random value sent by the opposite terminal.
In a possible implementation manner, the key information further includes a terminal random number and a server random number; the generating unit is specifically configured to:
performing pseudo-randomization processing according to the pre-master key, the terminal random number and the server random number to generate a pseudo-randomized key;
and performing key derivation processing on the pseudo-randomized key, expanding the pseudo-randomized key to a specified length, and generating a session key.
In a possible implementation manner, the second obtaining unit is specifically configured to:
capturing a session data packet transmitted between the terminal equipment and the server through a QUIC protocol in the session process of the terminal equipment and the server, and converting the file format of the session data packet into a target file format;
analyzing the session data packet according to the target file format to obtain an encrypted session data byte stream transmitted between the terminal equipment and the server;
and converting the encrypted session data byte stream into a QUIC format to obtain encrypted QUIC data.
In a possible implementation manner, the second obtaining unit converts the encrypted session data byte stream into a QUIC format, and after obtaining the encrypted QUIC data, before performing decryption processing on the encrypted QUIC data through the session key, the second obtaining unit is further configured to:
and carrying out verification processing on the encrypted QUIC data through one or the combination of the following modes:
reading the public identification of each session data byte in the encrypted QUIC data, and respectively checking whether the public identification is in a specified range;
reading the QUIC version number corresponding to the encrypted QUIC data, and checking whether the encrypted QUIC data is a correct version according to the QUIC version number;
reading a connection identifier in the encrypted QUIC data, and matching the connection identifier with a reference identifier of the current session;
and reading the packet number corresponding to the encrypted QUIC data, and checking whether the packet number is in a target range.
In one possible implementation, the decryption unit is further configured to:
decrypting the encrypted QUIC data through the session key to obtain corresponding plaintext data, and then respectively identifying the data type corresponding to each frame data aiming at each frame data contained in the plaintext data;
and respectively determining corresponding frame processing modes aiming at the data types, and analyzing the corresponding frame data based on the determined frame processing modes to acquire corresponding analysis data.
In one possible implementation, the decryption unit is further configured to:
decrypting the encrypted QUIC data through the session key to obtain corresponding plaintext data, and displaying the plaintext data in a target display mode;
the target display mode comprises a text format, a log file format and an interactive graph format.
In a third aspect, an embodiment of the present application provides an apparatus for decrypting data, including: a memory and a processor, wherein the memory is used for storing computer instructions; and a processor for executing computer instructions to implement the steps of the method for decrypting data provided by the embodiment of the present application.
In a fourth aspect, embodiments of the present application provide a computer-readable storage medium, where computer instructions are stored, and when executed by a processor, implement the steps of the method for decrypting data provided by embodiments of the present application.
In a fifth aspect, embodiments of the present application provide a computer program product, which includes computer instructions stored in a computer-readable storage medium; when the processor of the electronic device reads the computer instructions from the computer-readable storage medium, the processor executes the computer instructions, so that the electronic device executes the steps of the method for decrypting data provided by the embodiment of the application.
The beneficial effect of this application is as follows:
in the scheme for data decryption provided by the embodiment of the application: firstly, acquiring a premaster secret key which is negotiated by a terminal device and a server and used for generating a session secret key; then, based on the general rule negotiated by the terminal equipment and the server, generating a session key between the terminal equipment and the server according to the premaster secret key, and because the session key is generated by adopting the same rule as the terminal equipment and the server, the generated session key can decrypt the encrypted QUIC data transmitted between the terminal equipment and the server; after the session key is generated, the session key is adopted to decrypt the acquired encrypted QUIC data transmitted between the terminal equipment and the server to obtain corresponding plaintext data, and data integrity analysis is carried out on the plaintext data;
the decryption processing of the QUIC data is realized, the corresponding plaintext data is obtained, the problem that the data transmitted based on the QUIC protocol cannot be decrypted offline is solved, and the QUIC is aligned to the HTTP on the offline decryption function; further, integrity analysis is carried out on the decrypted plaintext data, so that the real data content corresponding to the application layer in the data transmission process and the data transceiving condition corresponding to the terminal device and the server in the transmission layer can be determined, and based on the data transceiving condition, the problem location corresponding to each of the terminal device and the server in the data transmission process can be determined, wherein the problem location includes whether data packet loss occurs, data transceiving delay and the number of a specific lost data packet, and data packet loss detection can be realized, so that the accuracy of the data transmission content is ensured.
Additional features and advantages of the application will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by the practice of the application. The objectives and other advantages of the application may be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.
Drawings
In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the description of the embodiments are briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present application, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.
Fig. 1 is a schematic diagram of encrypted HTTP data transmitted by using an HTTP protocol in the related art;
fig. 2 is a schematic diagram illustrating a related art for obtaining a decryption key corresponding to encrypted HTTP data;
fig. 3 is a schematic diagram of a related art that decrypts encrypted HTTP data to obtain real data content;
fig. 4 is a schematic view of an application scenario provided in an embodiment of the present application;
fig. 5 is a flowchart of a method for decrypting data according to an embodiment of the present application;
fig. 6 is a schematic diagram of generating a session key according to an embodiment of the present application;
fig. 7 is a schematic diagram of obtaining an encrypted session data byte stream according to an embodiment of the present application;
FIG. 8 is a flowchart of a method for performing decryption processing on encrypted QUIC data according to an embodiment of the present application;
FIG. 9 is a diagram illustrating plaintext data corresponding to encrypted QUIC data according to an embodiment of the present application;
FIG. 10 is a diagram illustrating plaintext data in a textual format according to an embodiment of the disclosure;
fig. 11 is a schematic diagram illustrating plaintext data in a log file format according to an embodiment of the application;
fig. 12 is a schematic diagram illustrating plaintext data in an interactive chart format according to an embodiment of the disclosure;
FIG. 13 is a flowchart of a method for decrypting data according to an embodiment of the present disclosure;
fig. 14 is a block diagram of a data decryption apparatus according to an embodiment of the present application;
fig. 15 is a block diagram of an electronic device according to an embodiment of the present disclosure;
fig. 16 is a block diagram of another electronic device according to an embodiment of the present application.
Detailed Description
In order to make the purpose, technical solution and advantages of the present application more clearly and clearly understood, the technical solution in the embodiments of the present application will be described below in detail and completely with reference to the accompanying drawings in the embodiments of the present application, and it is obvious that the described embodiments are only some embodiments of the present application, and not all embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments in the present application without making any creative effort belong to the protection scope of the present application.
In order to facilitate those skilled in the art to better understand the technical solutions of the present application, some concepts related to the present application will be described below.
QUIC is a UDP-based low-latency Internet transport layer protocol that well addresses the various requirements faced by transport layer information and application layer data, including handling more connections, security, and low latency. QUIC incorporates the characteristics of protocols including Transmission Control Protocol (TCP), Security Transport Layer Protocol (TLS), HTTP/2, etc., but is based on UDP Transport.
HKDF is a specific Key Derivation Function (KDF), which is a HMAC-based KDF that can be applied to the construction of various protocols and applications. Because the KDF is a basic component of a cryptosystem and is mainly used to obtain some original key materials and derive one or more keys with high security strength from the original key materials, the main purpose of the HKDF is to derive one or more keys that can achieve the cryptographic strength by using the original key materials so as to ensure randomness. The HKDF comprises two processes, namely extracting and expanding, wherein the extracting uses original key material to derive a pseudo-random key which accords with the cryptology intensity, and the expanding uses the extracted pseudo-random key to Expand a key with a specified length.
The HMAC is a hash operation message authentication code related to a key, and the HMAC uses a hash algorithm to generate a message digest as an output by taking a key and a message as inputs.
dump in the computer domain for dump; when a program runs in a computer, data on devices such as a memory, a CPU, an I/O and the like are dynamic and easily lost, that is, data is used up or lost when an exception occurs, and if data at some time is desired, the data needs to be dumped (dump) into a static form, for example, stored in a file form.
The pcap file is a common datagram storage format, and can be understood as a file format, but the data in the pcap file is stored according to a specific format.
qlog is used as a log recording tool for conveniently monitoring and investigating the reasons of problems.
Cloud technology refers to a hosting technology for unifying serial resources such as hardware, software, network and the like in a wide area network or a local area network to realize calculation, storage, processing and sharing of data.
Cloud technology (Cloud technology) is based on a general term of network technology, information technology, integration technology, management platform technology, application technology and the like applied in a Cloud computing business model, can form a resource pool, is used as required, and is flexible and convenient. Cloud computing technology will become an important support. Background services of the technical network system require a large amount of computing and storage resources, such as video websites, picture-like websites and more web portals. With the high development and application of the internet industry, each article may have an own identification mark and needs to be transmitted to a background system for logic processing, data of different levels can be processed separately, and various industry data need strong system background support and can be realized only through cloud computing.
The word "exemplary" is used hereinafter to mean "serving as an example, embodiment, or illustration. Any embodiment described as "exemplary" is not necessarily to be construed as preferred or advantageous over other embodiments.
The terms "first" and "second" are used herein for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, features defined as "first" and "second" may explicitly or implicitly include one or more features, and in the description of embodiments of the application, unless otherwise indicated, "plurality" means two or more.
The following briefly introduces the design concept of the embodiments of the present application:
with the development of internet technology and the increase of images, videos and other multimedia contents, the widely used hypertext transfer protocol cannot meet the transmission of complex data; at present, in order to satisfy the transmission of complex data, a QUIC transmission protocol is proposed.
In order to ensure the security of data transmission, in the process of data transmission, the QUIC transmission protocol encrypts the data of an application layer and the information of a transmission layer and transmits the encrypted QUIC data.
However, the encrypted QUIC data corresponding to the QUIC transmission protocol is not like the encrypted HTTP data corresponding to the HTTP transmission protocol, and the encrypted HTTP data corresponding to the HTTPS/HTTP2 transmission protocol can be decrypted offline by combining a browser and a packet grabbing tool so as to restore the real data content.
Generally, in the data transmission process, capturing an HTTPS session data packet by using a packet capturing tool such as wirereshark, and viewing the captured HTTPS session data packet to obtain encrypted HTTP data, as shown in fig. 1, which is a schematic diagram of encrypted HTTP data transmitted by using an HTTP protocol in the related art;
then, decrypting the captured encrypted HTTP data, and in the related art, when decrypting the encrypted HTTP data corresponding to the HTTPs/HTTP2 transport protocol, mainly deriving a key (SSL key) in the browser, and setting the SSL key in the wireshark, as shown in fig. 2, which is a schematic diagram of obtaining a decryption key corresponding to the encrypted HTTP data for a wireshark in the related art; after obtaining the ssl key, the wirereshark decrypts the encrypted HTTP data corresponding to the HTTPS/HTTP2 transmission protocol according to the ssl key, and obtains the real data content after decryption, as shown in fig. 3, which is a schematic diagram of obtaining the real data content after decrypting the encrypted HTTP data in one of the related memories.
That is, in the related art, only the transport protocol such as HTTPS/HTTP2 using the TLS cipher suite can be decrypted offline. Due to the fact that the QUIC uses a QuicCrypto handshake and encryption and decryption method, supporting support of a transmission protocol of the QUIC is incomplete, and after data of an application layer and information of a transmission layer are encrypted, effective information cannot be decrypted in the transmission process; for example: it is impossible to decrypt the data received by the opposite end, that is, it is impossible to determine whether the data is lost, and it is impossible to decrypt the real data, that is, it is impossible to ensure the accuracy of data transmission.
Therefore, how to decrypt the encrypted QUIC data, realize data packet loss detection and ensure the accuracy of data transmission content is a problem to be solved at present.
In view of this, an embodiment of the present application provides a technical solution for performing offline decryption on encrypted QUIC data, where in a session process between a terminal device and a server, an encrypted session data packet transmitted through a QUIC transmission protocol is captured, and then the encrypted session data packet is recovered offline, and real data content corresponding to an application layer and various information corresponding to a transmission layer are obtained, so that the QUIC is aligned to HTTP on an offline decryption function, and problem locations, such as packet loss analysis and delay analysis, in the transmission process of the QUIC transmission protocol can be analyzed based on plaintext data obtained through decryption.
In the embodiment of the application, firstly, a premaster secret key which is negotiated between a terminal device and a server and used for generating a session secret key is obtained; then, based on the general rule negotiated by the terminal equipment and the server, generating a session key between the terminal equipment and the server according to the premaster secret key, and because the session key is generated by adopting the same rule as the terminal equipment and the server, the generated session key can decrypt the encrypted QUIC data transmitted between the terminal equipment and the server; after the session key is generated, the session key is adopted to decrypt the acquired encrypted QUIC data transmitted between the terminal equipment and the server to obtain corresponding plaintext data, and data integrity analysis is carried out on the plaintext data;
the decryption processing of the QUIC data is realized, the corresponding plaintext data is obtained, the problem that the data transmitted based on the QUIC protocol cannot be decrypted offline is solved, and the QUIC is aligned to the HTTP on the offline decryption function; further, integrity analysis is carried out on the decrypted plaintext data, so that the real data content corresponding to the application layer in the data transmission process and the data transceiving condition corresponding to the terminal device and the server in the transmission layer can be determined, and based on the data transceiving condition, the problem location corresponding to each of the terminal device and the server in the data transmission process can be determined, wherein the problem location includes whether data packet loss occurs, data transceiving delay and the number of a specific lost data packet, and data packet loss detection can be realized, so that the accuracy of the data transmission content is ensured.
The preferred embodiments of the present application will be described below with reference to the accompanying drawings of the specification, it should be understood that the preferred embodiments described herein are merely for illustrating and explaining the present application, and are not intended to limit the present application, and that the embodiments and features of the embodiments in the present application may be combined with each other without conflict.
Referring to fig. 4, fig. 4 is a schematic view of an application scenario according to an embodiment of the present application. The application scenario includes a plurality of terminal devices 410 and a server 420, and the terminal devices 410 and the server 420 can communicate with each other through a communication network.
In an alternative embodiment, the communication network may be a wired network or a wireless network. Thus, the terminal device 410 and the server 420 may be directly or indirectly connected through wired or wireless communication. For example, the terminal device 410 may be indirectly connected to the server 420 through a wireless access point, or the terminal device 410 may be directly connected to the server 420 through the internet, which is not limited herein.
In the embodiment of the present application, the terminal device 410 includes, but is not limited to, a mobile phone, a tablet computer, a notebook computer, a desktop computer, an e-book reader, an intelligent voice interaction device, an intelligent household appliance, a vehicle-mounted terminal, and other devices; various clients can be installed on the terminal device, and the clients can be application programs (such as browsers, game software and the like) and also can be web pages, applets and the like;
server 420 is a backend server corresponding to the client. The server 420 may be an independent physical server, a server cluster or a distributed system formed by a plurality of physical servers, or a cloud server providing basic cloud computing services such as a cloud service, a cloud database, cloud computing, a cloud function, cloud storage, a Network service, cloud communication, a middleware service, a domain name service, a security service, a Content Delivery Network (CDN), a big data and artificial intelligence platform, and the like.
After the terminal device 410 and the server 420 are in communication connection, data transmission can be performed between the terminal device 410 and the server 420 through a QUIC transmission protocol, and in order to ensure the security of transmitted data, encryption processing is performed on application layer data and transmission layer information in the transmission process.
In order to decrypt the encrypted QUIC data transmitted based on the QUIC transmission protocol so as to analyze problem location in the data transmission process based on the QUIC transmission protocol, the encrypted QUIC data transmitted between the terminal device 410 and the server 420 needs to be decrypted.
It should be noted that the method for decrypting data in the embodiment of the present application may be performed by a packet decryption tool deployed in an electronic device, and the electronic device may be a server or a terminal device, that is, the method may be performed by the server or the terminal device alone, where the terminal device or the server may be the terminal device 410 and the server 420 shown in fig. 4, and may also be another terminal device or another server besides the terminal device 410 and the server 420 shown in fig. 4.
The illustration in fig. 4 is merely an example, and the number of the terminal devices 410 and the servers 420 is not limited in practice and is not specifically limited in the embodiment of the present application.
In the embodiment of the present application, when the number of the servers 420 is multiple, the multiple servers 420 may be grouped into a blockchain, and the servers 420 are nodes on the blockchain; according to the method for viewing the application data, the related application data can be stored on the block chain.
Moreover, the embodiment of the application can be applied to data decryption in various scenes, including but not limited to various scenes such as cloud technology, artificial intelligence, intelligent traffic, driving assistance and the like.
Based on the above application scenarios, the method for decrypting data provided by the exemplary embodiment of the present application is described below with reference to the above application scenarios, and it should be noted that the above application scenarios are only illustrated for facilitating understanding of the spirit and principles of the present application, and the embodiments of the present application are not limited in this respect.
Referring to fig. 5, fig. 5 exemplarily provides a flowchart of a method for decrypting data, which is applied to a packet decryption tool in the embodiment of the present application, and the method includes:
step S500, key information negotiated by the terminal equipment and the server is obtained, wherein the key information comprises a premaster secret key.
In order to ensure the security of data transmission between the terminal device and the server, data transmitted between the terminal device and the server is usually encrypted, and then, after receiving the encrypted data, the opposite end decrypts the encrypted data to obtain the actual transmitted real data content.
However, if the terminal device and the server negotiate only a simple public key-private key in the key negotiation process, and after the public key is used for encryption, the corresponding private key is used for decryption processing of the encrypted data, so that actual transmitted real data content can be obtained; at this time, after the public-private key is intercepted, the security of the data is also affected.
Therefore, the embodiment of the present application provides a way to generate a premaster-key (premaster-key), that is, during a key agreement process between a terminal device and a server, the terminal device and the server exchange some public information, and the terminal device and the server obtain a key by using a mathematical calculation way through the public information respectively. In the process, a public key-a private key is not directly exchanged, so that the security of key transmission is ensured, and the security of data transmission is further ensured.
In a possible implementation manner, the premaster secret key in the embodiment of the present application is generated by the terminal device or the server according to the random value generated by the terminal device or the server itself and the public key random value sent by the opposite terminal by using an elliptic curve algorithm, and the generated premaster secret key is output after being transferred to a static form such as a file by using a Dump technology. Therefore, the data packet decryption tool can obtain the premaster secret key of the terminal equipment and the server.
The specific process of generating the premaster secret key by the terminal device and the server by adopting an elliptic curve algorithm according to the random value generated by the terminal device and the random value of the public key sent by the opposite terminal is as follows:
1) the terminal device randomly generates a random value a, calculates Fa (x, y) ═ a × Q (x, y), and transmits Fa (x, y) to the server, wherein Fa (x, y) is a public key random value transmitted to the server by the terminal device.
2) The server randomly generates a random value b and calculates Fb (x, y) ═ b × Q (x, y). And sending Fb (x, y) to the terminal equipment, wherein the Fb (x, y) is a random value of the public key sent to the terminal equipment by the server.
3) The terminal device calculates key1(x, y) ═ a (b × Q (x, y)).
4) The server calculates key2(x, y) ═ b (a × Q (x, y)).
key1 key2 key, the x vector of the key is taken as the premaster key. Where Q (x, y) is the base point of a certain elliptic curve algorithm that is generally recognized.
It should be noted that the elliptic curve algorithm is only an exemplary illustration, and any data calculation method that can be used to generate the premaster secret is suitable for the present application.
Step S501, based on the general rule negotiated by the terminal device and the server, a session key between the terminal device and the server is generated according to the premaster secret key.
In a possible implementation manner, the key information further includes a terminal random number and a server random number; the terminal random number and the server random number are obtained by decrypting a negotiation data packet captured in real time.
In the embodiment of the application, when decrypting the encrypted QUIC data, the session key is only a necessary condition in the decryption process, besides the session key, information such as encryption and decryption algorithms and the like are required, the decryption operations corresponding to different encryption and decryption algorithms are different, and when generating the session key, besides the pre-master key, the cooperation of a data packet is required to be negotiated; therefore, in the embodiment of the present application, the negotiation data packet is to be captured, and the encryption and decryption algorithm and the session key are accurately obtained through the negotiation data packet.
Specifically, in the process of establishing a communication connection between the terminal device and the server, a negotiation data packet transmitted between the terminal device and the server is acquired, the negotiation data packet is analyzed, and negotiation data content in the negotiation data packet is acquired, wherein the negotiation data content includes: terminal Nonce (Client Nonce), Server Nonce (Server Nonce), QUIC protocol version, encryption algorithm, Server configuration (Server Config), and the like.
It should be noted that the negotiation packet is a packet transmitted during the process of establishing a communication connection between the terminal device and the server, and the negotiation packet is also referred to as a handshake packet by those skilled in the art.
After acquiring negotiation data content in the negotiation data packet, HKDF key derivation and randomization processing is performed based on a terminal random number (Client Nonce), a Server Nonce (Server Nonce) and a premaster key in the negotiation data packet transmitted between the terminal device and the Server, and a session key is generated.
During the process of performing HKDF key derivation and randomization to generate the session key:
firstly, performing pseudo-randomization processing according to a premaster secret key, a terminal random number and a server random number by adopting an Extract technology in HKDF to generate a pseudo-randomized secret key; then, the Expand technique in HKDF is used to perform key derivation processing on the pseudo-randomized key generated in the previous step, and the pseudo-randomized key is extended to a predetermined length to generate a session key.
Referring to fig. 6, fig. 6 exemplarily provides a schematic diagram of generating a session key in an embodiment of the present application.
Fig. 6 shows that a pre-master key is generated by performing discrete logarithm calculation through an elliptic curve algorithm by using a randomly generated random number, a public key generated by an opposite terminal (Pubs) random number, and a generated private key;
after a pre-master key is generated, a pre-master key is derived, the derived pre-master key is injected as a parameter derived from an HKDF session key, when the session key is generated based on the pre-master key, the session key is injected with parameters such as a terminal random number (Client number), a Server random number (Server number), a QUIC protocol version, an encryption algorithm, a Server configuration (Server Config) and the like in addition to the pre-master key, an HKDF-Extract randomization key is performed based on the injected parameter, and then, HKDF-Expand is performed to generate a specified length so as to generate a forward secure session key.
It should be noted that, in the embodiment of the present application, the session key is generated in an offline manner, because the session key is relatively long, and if the session key is generated and derived online, a relatively large space is occupied, and therefore, a manner of generating the session key in an offline manner is provided, so that a space occupied when the session key is derived online can be saved.
Step S502, acquiring encrypted QUIC data transmitted between the terminal equipment and the server.
In the embodiment of the application, the encrypted QUIC data transmitted between the terminal device and the server are mainly decrypted, so that the encrypted QUIC data transmitted between the terminal device and the server need to be acquired.
When acquiring encrypted QUIC data transmitted between a terminal device and a server:
firstly, capturing a session data packet transmitted between a terminal device and a server through a QUIC protocol in real time by using a packet capturing tool in the session process of the terminal device and the server, and converting the file format of the session data packet into a target file format; the packet capturing tool can be a packet capturing tool with a type Tcpdump, and the target file format is a pcap file format;
then, converting the session data packet which is captured in real time and transmitted by the QUIC protocol into an encrypted session data byte stream which can be decrypted; illustratively, analyzing a pcap file corresponding to the pcap file format according to the pcap file format, and traversing to obtain session data; analyzing the two-layer and three-layer headers of the session data, stripping the IP layer header and the UDP layer header from the session data, and acquiring a UDP data packet; acquiring a real session data byte stream transmitted between the terminal equipment and the server from the UDP data packet, wherein the real session data byte stream is in an encrypted state, so the real session data byte stream is also called as an encrypted session data byte stream; referring to fig. 7, fig. 7 is a schematic diagram for obtaining an encrypted session data byte stream according to an embodiment of the present application;
after the encrypted session data byte stream and the session key are obtained, application layer data decryption and transport layer protocol data analysis can be performed.
In the embodiment of the application, the encrypted session data byte stream is decrypted through a pre-designed key function so as to restore real data content and transmission information.
Wherein, the key function includes: packet processing function (ProcessPacket), header processing function (processspublheader function and ProcessDataPacket), data decryption function (DecryptPayload), and frame processing function (ProcessFrameData).
In the process of decrypting the encrypted session data byte stream, encrypted QUIC data corresponding to the encrypted session data byte stream transmitted between the terminal device and the server needs to be acquired, so that the encrypted session data byte stream is converted into a QUIC format through a packet processing function (ProcessPacket) to acquire the encrypted QUIC data.
Step S503, the encrypted QUIC data is decrypted through the session key to obtain corresponding plaintext data, and data integrity analysis is carried out on the plaintext data.
Referring to FIG. 8, FIG. 8 is a flow chart illustrating a method for performing decryption processing on encrypted QUIC data according to the embodiment of the present application.
As can be seen from fig. 8, in the embodiment of the present application, first, format conversion is performed on the obtained encrypted session data byte stream through a packet processing function (ProcessPacket), so as to generate encrypted QUIC data;
then, a header processing function (ProcessSpublicHeader function and ProcessDataPacket) is adopted to carry out verification processing on the encrypted QUIC data; specifically, the verification processing is performed on the encrypted QUIC data, and the following steps are mainly performed:
reading Public marks (Public flag) of all session data bytes in the encrypted QUIC data, and respectively checking whether the Public marks are in a specified range;
reading the QUIC version number corresponding to the encrypted QUIC data, and checking whether the encrypted QUIC data is the correct version according to the QUIC version number;
reading a Connection identifier (Connection ID) in the encrypted QUIC data, and matching the Connection identifier with a reference identifier of the current session; generally, the connection identifier is usually 8 bytes, and after the connection identifier is determined not to be matched with the reference identifier of the current session, the encrypted QUIC data is determined to be data in the process of re-communication connection, or the encrypted QUIC data is determined to be error data;
reading a packet number (packet _ number) corresponding to the encrypted QUIC data, and checking whether the packet number is in a target range;
then, decrypting the data packet by combining a session key through a data decryption function (decryptPAyload) to obtain plaintext data; referring to FIG. 9, FIG. 9 is a schematic diagram illustrating plaintext data content corresponding to encrypted QUIC data according to an embodiment of the present application;
finally, processing each frame data contained in the plaintext data corresponding to the encrypted QUIC data by adopting a frame processing function (ProcessFrameData);
because the plaintext data is composed of frames, different types of frames enter different frame processing functions, and the frame data is analyzed and corresponding real data is restored through the frame processing functions;
in a possible implementation manner, after the encrypted QUIC data is decrypted through the session key to obtain corresponding plaintext data, respectively identifying data types corresponding to the frame data aiming at the frame data contained in the plaintext data; and respectively determining a corresponding frame processing mode for each data type, and analyzing corresponding frame data based on the determined frame processing mode to obtain corresponding analysis data, referring to fig. 8, where the frame data includes response frame data (ProcessAckFrame), reset frame data (ProcessBstFrame), close frame data (ProcessCloseFrame), and the like.
In the embodiment of the application, after the encrypted QUIC data is decrypted by the session key to obtain corresponding plaintext data, the plaintext data is displayed in a target display mode, so that integrity analysis is performed on the plaintext data based on the displayed plaintext data, and problem location of the encrypted QUIC data in the transmission process is analyzed, for example: data packet loss, data transceiving delay, and the like;
in the embodiment of the application, three modes of displaying plaintext data are provided, namely displaying in a text format, displaying in a log file format and displaying in an interactive graph format; referring to fig. 10 to 12, fig. 10 to 12 show the plaintext data in different display manners respectively.
It should be noted that, the log file format display and the interactive map format display are both converted based on the text format, for example: when the log file format is adopted for display, the text format is converted into the qlog format on the basis of the text format; for another example: when the interactive graph format is adopted for display, the text format is converted into the interactive graph format for display by combining an open element QVIS tool on the basis of the text format, so that data can be more visually analyzed, and whether packet loss or not is determined.
Referring to fig. 13, fig. 13 is a flowchart illustrating a method for decrypting data according to an embodiment of the present disclosure;
as can be seen from fig. 13, in the process of establishing a communication connection between the terminal device and the server, the data packet decryption tool provided in this embodiment captures the negotiation data packet through the packet capture tool, and analyzes the negotiation data packet to obtain the terminal random number and the server random number; then, based on the terminal random number, the server random number and the pre-master key obtained from the server, calculating a forward security key by referring to a current encryption algorithm to generate a session key between the terminal equipment and the server; the terminal random number is obtained by analyzing an invite client Hello message sent by the terminal, and the server random number is obtained by analyzing a reject message sent by the server.
In the session process of the terminal equipment and the server, the data decryption tool provided by the embodiment of the application captures the session data packet through the packet capturing tool, analyzes the session data packet, determines the encrypted session byte stream, performs QUIC format conversion on the encrypted session byte stream, and generates encrypted QUIC data; then, importing a session key generation decryption suite, decrypting the encrypted QUIC data, outputting decrypted data, namely plaintext data, and finally performing frame processing on frame data contained in the plaintext data;
and finally, analyzing results based on the plaintext data, and displaying the results in a text format, a log file format and an interactive graph format.
In the application, a premaster secret key which is negotiated by a terminal device and a server and used for generating a session secret key is obtained; based on the general rule negotiated by the terminal equipment and the server, generating a session key between the terminal equipment and the server according to the premaster secret key, wherein the generated session key can decrypt encrypted QUIC data transmitted between the terminal equipment and the server because the session key is generated by adopting the same rule as the terminal equipment and the server; after the session key is generated, the session key is adopted to decrypt the acquired encrypted QUIC data transmitted between the terminal equipment and the server to obtain corresponding plaintext data, and data integrity analysis is carried out on the plaintext data; the decryption processing of the QUIC data is realized, the corresponding plaintext data is obtained, the problem that the data transmitted based on the QUIC protocol cannot be decrypted offline is solved, and the QUIC is aligned to the HTTP on the offline decryption function; further, integrity analysis is carried out on the decrypted plaintext data, so that the real data content corresponding to the application layer in the data transmission process and the data transceiving condition corresponding to the terminal device and the server in the transmission layer can be determined, and based on the data transceiving condition, the problem location corresponding to each of the terminal device and the server in the data transmission process can be determined, wherein the problem location includes whether data packet loss occurs, data transceiving delay and the number of a specific lost data packet, and data packet loss detection can be realized, so that the accuracy of the data transmission content is ensured.
The method embodiment is based on the same inventive concept, and the embodiment further provides a device for data decryption, and the principle of the device for solving the problem is similar to the method of the embodiment, so that the implementation of the device can refer to the implementation of the method, and repeated details are not repeated.
Referring to fig. 14, fig. 14 exemplarily provides an apparatus 1400 for data decryption according to an embodiment of the present application, where the apparatus 1400 for data decryption includes:
a first obtaining unit 1401, configured to obtain key information negotiated by a terminal device and a server, where the key information includes a premaster key;
a generating unit 1402, configured to generate a session key between the terminal device and the server according to the premaster key based on a general rule negotiated between the terminal device and the server;
a second obtaining unit 1403, configured to obtain encrypted QUIC data transmitted between the terminal device and the server;
and the decryption unit 1404 is configured to perform decryption processing on the encrypted QUIC data through the session key to obtain corresponding plaintext data, and perform data integrity analysis on the plaintext data.
In a possible implementation manner, the premaster secret key is generated by the terminal device or the server according to the random value generated by the terminal device or the server and the public key random value sent by the opposite terminal.
In a possible implementation manner, the key information further includes a terminal random number and a server random number; the generating unit 1402 is specifically configured to:
performing pseudo-randomization processing according to the pre-master key, the terminal random number and the server random number to generate a pseudo-randomized key;
and performing key derivation processing on the pseudo-randomized key, expanding the pseudo-randomized key to a specified length, and generating a session key.
In a possible implementation manner, the second obtaining unit 1403 is specifically configured to:
capturing a session data packet transmitted between the terminal equipment and the server through a QUIC protocol in the session process of the terminal equipment and the server, and converting the file format of the session data packet into a target file format;
analyzing the session data packet according to the target file format to obtain an encrypted session data byte stream transmitted between the terminal equipment and the server;
and converting the encrypted session data byte stream into a QUIC format to obtain encrypted QUIC data.
In a possible implementation manner, the second obtaining unit 1403 is further configured to:
converting the encrypted session data byte stream into a QUIC format, after acquiring the encrypted QUIC data, and before decrypting the encrypted QUIC data through the session key, verifying the encrypted QUIC data through one or a combination of the following modes:
reading the public identification of each session data byte in the encrypted QUIC data, and respectively checking whether the public identification is in a specified range;
reading the QUIC version number corresponding to the encrypted QUIC data, and checking whether the encrypted QUIC data is the correct version according to the QUIC version number;
reading a connection identifier in the encrypted QUIC data, and matching the connection identifier with a reference identifier of the current session;
and reading the packet number corresponding to the encrypted QUIC data, and checking whether the packet number is in a target range.
In one possible implementation, the decryption unit 1404 is further configured to:
decrypting the encrypted QUIC data through the session key to obtain corresponding plaintext data, and then respectively identifying the data type corresponding to each frame data aiming at each frame data contained in the plaintext data;
and respectively determining corresponding frame processing modes aiming at the data types, and analyzing the corresponding frame data based on the determined frame processing modes to acquire corresponding analysis data.
In one possible implementation, the decryption unit 1404 is further configured to:
decrypting the encrypted QUIC data through the session key to obtain corresponding plaintext data, and displaying the plaintext data in a target display mode;
the target display mode comprises a text format, a log file format and an interactive graph format.
For convenience of description, the above parts are separately described as modules (or units) according to functional division. Of course, the functionality of the various modules (or units) may be implemented in the same one or more pieces of software or hardware when implementing the present application.
As will be appreciated by one skilled in the art, aspects of the present application may be embodied as a system, method or program product. Accordingly, various aspects of the present application may be embodied in the form of: an entirely hardware embodiment, an entirely software embodiment (including firmware, microcode, etc.) or an embodiment combining hardware and software aspects that may all generally be referred to herein as a "circuit," module "or" system.
Having described the method and apparatus for data decryption of an exemplary embodiment of the present application, an electronic device for data decryption according to another exemplary embodiment of the present application is described next.
The embodiment of the method is based on the same inventive concept, and the embodiment of the application also provides an electronic device which can be a server. In this embodiment, the electronic device may be configured as shown in fig. 15, and may include a memory 1501, a communication module 1503, and one or more processors 1502.
A memory 1501 for storing computer programs executed by the processor 1502. The memory 1501 may mainly include a program storage area and a data storage area, where the program storage area may store an operating system, programs needed for running an instant messaging function, and the like; the storage data area can store various instant messaging information, operation instruction sets and the like.
The memory 1501 may be a volatile memory (volatile memory), such as a random-access memory (RAM); the memory 1501 may also be a non-volatile memory (non-volatile memory), such as a read-only memory (rom), a flash memory (flash memory), a hard disk (HDD) or a solid-state drive (SSD); or memory 1501 is any other medium that can be used to carry or store a desired computer program in the form of instructions or data structures and that can be accessed by a computer, but is not limited to such. The memory 1501 may be a combination of the above memories.
The processor 1502 may include one or more Central Processing Units (CPUs), or be a digital processing unit, etc. The processor 1502 is configured to implement the above-described data decryption method when calling the computer program stored in the memory 1501.
The communication module 1503 is used for communicating with terminal devices and other servers.
The embodiment of the present application does not limit the specific connection medium among the memory 1501, the communication module 1503 and the processor 1502. In fig. 15, the memory 1501 and the processor 1502 are connected by a bus 1504, the bus 1504 is depicted by a thick line in fig. 15, and the connection manner between other components is merely illustrative and not limited. The bus 1504 may be divided into an address bus, a data bus, a control bus, and the like. For ease of description, only one thick line is depicted in fig. 15, but not only one bus or one type of bus.
The memory 1501 stores a computer storage medium, and the computer storage medium stores computer-executable instructions for implementing the data decryption method according to the embodiment of the present application. The processor 1502 is configured to perform the data decryption method described above.
In another embodiment, the electronic device may also be other electronic devices, such as a terminal device. In this embodiment, the structure of the electronic device may be as shown in fig. 16, including: communications component 1610, memory 1620, display unit 1630, camera 1640, sensor 1650, audio circuitry 1660, bluetooth module 1670, processor 1680, and the like.
The communication component 1610 is configured to communicate with a server. In some embodiments, a Wireless Fidelity (WiFi) module may be included, the WiFi module being a short-range Wireless transmission technology, through which the electronic device may help the user to transmit and receive information.
Memory 1620 may be used to store software programs and data. Processor 1680 executes various functions of terminal device 110 and data processing by executing software programs or data stored in memory 1620. The memory 1620 may comprise high speed random access memory and may also comprise non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device. The memory 1620 stores an operating system that enables the terminal device 110 to operate. The memory 1620 may store an operating system and various application programs, and may also store codes for executing the data decryption method according to the embodiment of the present application.
The display unit 1630 may also be used to display a Graphical User Interface (GUI) of information input by or provided to the user and various menus of the terminal device 110. Specifically, the display unit 1630 may include a display screen 1632 provided on the front surface of the terminal device 110. The display 1632 may be configured in the form of a liquid crystal display, a light emitting diode, or the like. The display unit 1630 may be used to display plaintext data and the like in the embodiment of the present application.
The display unit 1630 may also be used to receive input numeric or character information and generate signal input related to user settings and function control of the terminal device 110, and specifically, the display unit 1630 may include a touch screen 1631 disposed on the front surface of the terminal device 110 and capable of collecting touch operations by a user thereon or nearby, such as clicking a button, dragging a scroll box, and the like.
The touch screen 1631 may cover the display screen 1632, or the touch screen 1631 and the display screen 1632 may be integrated to implement the input and output functions of the terminal device 110, and after integration, the touch screen may be referred to as a touch display screen for short. The display unit 1630 can display the application programs and the corresponding operation steps.
The camera 1640 may be used to capture still images, and the user may post comments on images taken by the camera 1640 through the application. The number of the cameras 1640 may be one or plural. The object generates an optical image through the lens and projects the optical image to the photosensitive element. The photosensitive element may be a Charge Coupled Device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The light sensing elements convert the light signals into electrical signals which are then passed to processor 1680 for conversion into digital image signals.
The terminal device may also include at least one sensor 1650, such as an acceleration sensor 1651, a distance sensor 1652, a fingerprint sensor 1653, a temperature sensor 1654. The terminal device may also be configured with other sensors such as a gyroscope, barometer, hygrometer, thermometer, infrared sensor, light sensor, motion sensor, and the like.
Audio circuitry 1660, speaker 1661, microphone 1662 may provide an audio interface between the user and terminal device 110. The audio circuit 1660 may convert the received audio data into an electrical signal, transmit the electrical signal to the speaker 1661, and convert the electrical signal into an acoustic signal by the speaker 1661 for output. Terminal device 110 may also be configured with a volume button for adjusting the volume of the sound signal. On the other hand, the microphone 1662 converts collected sound signals into electrical signals, which are received by the audio circuitry 1660 and converted into audio data, which are output to the communication component 1610 for transmission to, for example, another terminal device 110, or output to the memory 1620 for further processing.
The bluetooth module 1670 is used for information interaction with other bluetooth devices having a bluetooth module through a bluetooth protocol. For example, the terminal device may establish a bluetooth connection with a wearable electronic device (e.g., a smart watch) that is also equipped with a bluetooth module via the bluetooth module 1670, thereby performing data interaction.
The processor 1680 is a control center of the terminal device, connects various parts of the entire terminal device using various interfaces and lines, and performs various functions of the terminal device and processes data by running or executing software programs stored in the memory 1620 and calling data stored in the memory 1620. In some embodiments, processor 1680 may include one or more processing units; the processor 1680 may also integrate an application processor, which primarily handles operating systems, user interfaces, applications, etc., and a baseband processor, which primarily handles wireless communications. It is to be appreciated that the baseband processor described above may not be integrated into processor 1680. In this application, the processor 1680 may run an operating system, an application program, a user interface display, a touch response, and the data decryption method according to this embodiment. Additionally, processor 1680 is coupled with display unit 1630.
In some possible embodiments, various aspects of the method for decrypting data provided by the present application may also be implemented in the form of a program product including a computer program for causing an electronic device to perform the steps of the method for decrypting data according to various exemplary embodiments of the present application described above in this specification when the program product is run on the electronic device.
The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples (a non-exhaustive list) of the readable storage medium include: an electrical connection having one or more wires, a portable disk, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
The program product of embodiments of the present application may employ a portable compact disc read only memory (CD-ROM) and include a computer program, and may be run on a computing device. However, the program product of the present application is not limited thereto, and in this document, a readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with a command execution system, apparatus, or device.
A readable signal medium may include a propagated data signal with a readable computer program embodied therein, either in baseband or as part of a carrier wave. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A readable signal medium may also be any readable medium that is not a readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with a command execution system, apparatus, or device.
The computer program embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.
It should be noted that although several units or sub-units of the apparatus are mentioned in the above detailed description, such division is merely exemplary and not mandatory. Indeed, the features and functions of two or more units described above may be embodied in one unit, according to embodiments of the application. Conversely, the features and functions of one unit described above may be further divided into embodiments by a plurality of units.
Further, while the operations of the methods of the present application are depicted in the drawings in a particular order, this does not require or imply that these operations must be performed in this particular order, or that all of the illustrated operations must be performed, to achieve desirable results. Additionally or alternatively, certain steps may be omitted, multiple steps combined into one step execution, and/or one step broken down into multiple step executions.
As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having a computer-usable computer program embodied therein.
While the preferred embodiments of the present application have been described, additional variations and modifications in those embodiments may occur to those skilled in the art once they learn of the basic inventive concepts. Therefore, it is intended that the appended claims be interpreted as including preferred embodiments and all alterations and modifications as fall within the scope of the application.
It will be apparent to those skilled in the art that various changes and modifications may be made in the present application without departing from the spirit and scope of the application. Thus, if such modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is intended to include such modifications and variations as well.

Claims (11)

1. A method of data decryption, the method comprising:
acquiring key information negotiated by a terminal device and a server, wherein the key information comprises a premaster key;
generating a session key between the terminal equipment and the server according to the pre-master key based on a general rule negotiated by the terminal equipment and the server;
acquiring encrypted QUIC data transmitted between the terminal equipment and the server;
and decrypting the encrypted QUIC data through the session key to obtain corresponding plaintext data, and performing data integrity analysis on the plaintext data.
2. The method of claim 1, wherein the premaster secret is generated by the terminal device or the server from a random value generated by itself and a public key random value sent by an opposite end.
3. The method of claim 1, wherein the key information further includes a terminal random number and a server random number;
the generating a session key between the terminal device and the server according to the premaster secret key specifically includes:
performing pseudo-randomization processing according to the pre-master key, the terminal random number and the server random number to generate a pseudo-randomized key;
and performing key derivation processing on the pseudo-randomized key, expanding the pseudo-randomized key to a specified length, and generating the session key.
4. The method of claim 1, wherein said obtaining encrypted QUIC data transmitted between the terminal device and the server comprises:
capturing a session data packet transmitted between the terminal equipment and the server through a QUIC protocol in the session process of the terminal equipment and the server, and converting the file format of the session data packet into a target file format;
analyzing the session data packet according to the target file format to obtain an encrypted session data byte stream transmitted between the terminal equipment and the server;
and converting the encrypted session data byte stream into a QUIC format to obtain the encrypted QUIC data.
5. The method of claim 4, wherein said converting said encrypted session data byte stream into QUIC format further comprises, after obtaining said encrypted QUIC data and before decrypting said encrypted QUIC data with said session key,:
and performing verification processing on the encrypted QUIC data through one or the combination of the following modes:
reading the public identification of each session data byte in the encrypted QUIC data, and respectively checking whether the public identification is in a specified range;
reading the QUIC version number corresponding to the encrypted QUIC data, and checking whether the encrypted QUIC data is the correct version according to the QUIC version number;
reading a connection identifier in the encrypted QUIC data, and matching the connection identifier with a reference identifier of the current session;
and reading the packet number corresponding to the encrypted QUIC data, and checking whether the packet number is in a target range.
6. The method according to claim 1, wherein said decrypting said encrypted QUIC data with said session key to obtain corresponding plaintext data further comprises:
respectively identifying the data type corresponding to each frame data aiming at each frame data contained in the plaintext data;
and respectively determining corresponding frame processing modes aiming at the data types, and analyzing corresponding frame data based on the determined frame processing modes to acquire corresponding analysis data.
7. The method according to claim 1, wherein said decrypting said encrypted QUIC data with said session key to obtain corresponding plaintext data further comprises:
displaying the plaintext data in a target display mode;
the target display mode comprises a text format, a log file format and an interactive graph format.
8. An apparatus for decrypting data, the apparatus comprising:
the first obtaining unit is used for obtaining key information negotiated by the terminal equipment and the server, wherein the key information comprises a pre-master key;
a generating unit, configured to generate a session key between a terminal device and a server according to the pre-master secret based on a universal rule negotiated between the terminal device and the server;
the second acquisition unit is used for acquiring the encrypted fast user data network transmission layer protocol QUIC data transmitted between the terminal equipment and the server;
and the decryption unit is used for decrypting the encrypted QUIC data through the session key to obtain corresponding plaintext data and carrying out data integrity analysis on the plaintext data.
9. An electronic device, comprising: a memory and a processor, wherein:
the memory for storing a computer program;
the processor, configured to execute the computer program, implements the steps of the method according to any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program which, when executed by a processor, carries out the steps of the method according to any one of claims 1 to 7.
11. A computer program product comprising computer instructions which, when executed by a processor, carry out the steps of the method according to any one of claims 1 to 7.
CN202210295761.9A 2022-03-23 2022-03-23 Data decryption method, device, equipment and storage medium Active CN114679314B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202210295761.9A CN114679314B (en) 2022-03-23 2022-03-23 Data decryption method, device, equipment and storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202210295761.9A CN114679314B (en) 2022-03-23 2022-03-23 Data decryption method, device, equipment and storage medium

Publications (2)

Publication Number Publication Date
CN114679314A true CN114679314A (en) 2022-06-28
CN114679314B CN114679314B (en) 2023-01-31

Family

ID=82075240

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202210295761.9A Active CN114679314B (en) 2022-03-23 2022-03-23 Data decryption method, device, equipment and storage medium

Country Status (1)

Country Link
CN (1) CN114679314B (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116346877A (en) * 2022-12-09 2023-06-27 广州通康创智软件有限公司 Remote terminal management method and system

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101183938A (en) * 2007-10-22 2008-05-21 华中科技大学 Wireless network security transmission method, system and equipment
US9258117B1 (en) * 2014-06-26 2016-02-09 Amazon Technologies, Inc. Mutual authentication with symmetric secrets and signatures
CN106941401A (en) * 2017-03-23 2017-07-11 深信服科技股份有限公司 Acceleration equipment and the method that session key is obtained based on acceleration equipment
WO2017215582A1 (en) * 2016-06-15 2017-12-21 华为技术有限公司 Encrypted content detection method and apparatus
CN111447276A (en) * 2020-03-27 2020-07-24 东南大学 Encryption continuous transmission method with key agreement function
CN112738004A (en) * 2019-10-14 2021-04-30 上海哔哩哔哩科技有限公司 Communication method and system based on QUIC transmission protocol
CN113114701A (en) * 2021-04-30 2021-07-13 网络通信与安全紫金山实验室 QUIC data transmission method and device
CN113872755A (en) * 2020-06-30 2021-12-31 华为技术有限公司 Key exchange method and device

Patent Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101183938A (en) * 2007-10-22 2008-05-21 华中科技大学 Wireless network security transmission method, system and equipment
US9258117B1 (en) * 2014-06-26 2016-02-09 Amazon Technologies, Inc. Mutual authentication with symmetric secrets and signatures
WO2017215582A1 (en) * 2016-06-15 2017-12-21 华为技术有限公司 Encrypted content detection method and apparatus
CN107517183A (en) * 2016-06-15 2017-12-26 华为技术有限公司 The method and apparatus of encrypted content detection
CN106941401A (en) * 2017-03-23 2017-07-11 深信服科技股份有限公司 Acceleration equipment and the method that session key is obtained based on acceleration equipment
CN112738004A (en) * 2019-10-14 2021-04-30 上海哔哩哔哩科技有限公司 Communication method and system based on QUIC transmission protocol
CN111447276A (en) * 2020-03-27 2020-07-24 东南大学 Encryption continuous transmission method with key agreement function
CN113872755A (en) * 2020-06-30 2021-12-31 华为技术有限公司 Key exchange method and device
CN113114701A (en) * 2021-04-30 2021-07-13 网络通信与安全紫金山实验室 QUIC data transmission method and device

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
SHWETA ARORA等: ""Secure Session Key Sharing Using Symmetric Key Cryptography"", 《2018 INTERNATIONAL CONFERENCE ON ADVANCES IN COMPUTING, COMMUNICATIONS AND INFORMATICS (ICACCI)》 *
潘进等: ""WTLS握手协议后向安全性分析及改进"", 《西安邮电大学学报》 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116346877A (en) * 2022-12-09 2023-06-27 广州通康创智软件有限公司 Remote terminal management method and system

Also Published As

Publication number Publication date
CN114679314B (en) 2023-01-31

Similar Documents

Publication Publication Date Title
CN106713320B (en) Terminal data transmission method and device
US10326797B1 (en) Provisioning a secure connection using a pre-shared key
US11240269B2 (en) Method and apparatus for decryption of encrypted SSL data from packet traces
CN111628976B (en) Message processing method, device, equipment and medium
CN104301107A (en) Methods and systems for verifying privacy of web real-time communications (WebRTC) media channels via corresponding WebRTC data channels
WO2019178942A1 (en) Method and system for performing ssl handshake
CN112235266B (en) Data processing method, device, equipment and storage medium
CN107172001B (en) Control method and device of website proxy server and key proxy server
US10291600B2 (en) Synchronizing secure session keys
US10250596B2 (en) Monitoring encrypted communication sessions
CN112422587B (en) Identity verification method and device, computer equipment and storage medium
CN110855699A (en) Flow auditing method and device, server and auditing equipment
CN114679314B (en) Data decryption method, device, equipment and storage medium
CN112073421A (en) Communication processing method, communication processing device, terminal and storage medium
WO2020154067A1 (en) Methods and apparatus to verify encrypted handshakes
Puthal et al. Decision tree based user-centric security solution for critical IoT infrastructure
WO2021048526A1 (en) System, devices and/or processes for secure computation
CN112511892A (en) Screen sharing method, device, server and storage medium
US20200177566A1 (en) Method and system for cooperative inspection of encrypted sessions
CN114139192B (en) Encrypted traffic processing method, encrypted traffic processing apparatus, electronic device, medium, and program
WO2022211899A1 (en) Agile cryptographic deployment service
CN113992734A (en) Session connection method, device and equipment
CN117061115B (en) Key negotiation method, key negotiation apparatus, computer device, and computer-readable storage medium
CN111355750B (en) Method and device for recognizing brute force password cracking behavior
JP2013187743A (en) Device, method and program for identification

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant