WO2016112580A1 - 业务处理方法及装置 - Google Patents

业务处理方法及装置 Download PDF

Info

Publication number
WO2016112580A1
WO2016112580A1 PCT/CN2015/073784 CN2015073784W WO2016112580A1 WO 2016112580 A1 WO2016112580 A1 WO 2016112580A1 CN 2015073784 W CN2015073784 W CN 2015073784W WO 2016112580 A1 WO2016112580 A1 WO 2016112580A1
Authority
WO
WIPO (PCT)
Prior art keywords
user agent
proxy node
ciphertext
key
information
Prior art date
Application number
PCT/CN2015/073784
Other languages
English (en)
French (fr)
Inventor
韦安妮
熊春山
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP15877498.4A priority Critical patent/EP3242444A4/en
Priority to CN201580001098.5A priority patent/CN106031097A/zh
Publication of WO2016112580A1 publication Critical patent/WO2016112580A1/zh
Priority to US15/650,484 priority patent/US20170317836A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0281—Proxies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/166—Implementing security features at a particular protocol layer at the transport layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/084—Access security using delegated authorisation, e.g. open authorisation [OAuth] protocol

Definitions

  • the present invention relates to the field of communications, and in particular, to a service processing method and apparatus.
  • An intermediate proxy node is a portal site that is equivalent to a gateway to the Internet.
  • Portals generally have search engines that allow users to find other websites they want to visit.
  • the intermediate proxy node provides a webpage including an input box, and the user inputs the web address of the website to be accessed in the input box, and the intermediate proxy node forwards the website access request triggered by the user, and forwards the response data of the website to the user.
  • the intermediate proxy node can be a portal.
  • SSL Secure socket layer
  • TLS transport layer security
  • the SSL/TLS protocol is located between the transmission control protocol (English: transmission control protocol; TCP) protocol and the hypertext transfer protocol (English: hypertext transfer protocol; HTTP).
  • a service processing method provided by the related art includes: a user agent (English agent: UA) establishes a network connection with the Internet through an intermediate agent node, the user agent sends service information to the intermediate agent node, and the intermediate agent node sends the service information.
  • a user agent English agent: UA
  • the intermediate proxy node receives the service data returned by the network server, and then sends the service data to the user agent.
  • the service information may be used to request a webpage of the web server, or may be used to request an object in the web server.
  • the service processing system may be a GI interface-LAN (English: GI-Local Area Network; GI-LAN for short), and the GI-LAN refers to a network before the GI interface, which is enabled by a service with different functions. Unit composition.
  • the service enabling units can be connected in series to form a service chain, and the service chain is used to provide value-added services.
  • a service enabling unit with a cache function and a service enabling unit with a firewall function are sequentially connected in series to form a service chain of a video service.
  • the embodiment of the present invention provides a service processing method and device.
  • the technical solution is as follows:
  • a service processing method comprising:
  • the proxy node sends the service information to the service processing system, so that the service processing system processes the service information according to the value-added service, and triggers a process of sending the processed service information to the network server;
  • the first key and the second key are keys agreed by the user agent and the proxy node when establishing an encrypted connection.
  • the proxy node is an intermediate proxy node, and after the proxy node sends the service information to the service processing system, the method further includes:
  • the intermediate proxy node establishes an encrypted connection with the network server, and stipulates a third key and a fourth key;
  • the intermediate proxy node encrypts the service information by using the third key to obtain a second ciphertext
  • the intermediate proxy node sends the second ciphertext to the network server, so that the network server decrypts the second ciphertext by using the fourth key to obtain the service information.
  • the method further includes:
  • the intermediate proxy node receives the third ciphertext sent by the network server, and the third ciphertext is obtained by the network server by using the fourth key to encrypt the service data;
  • the intermediate proxy node decrypts the third ciphertext by using the third key to obtain the service data
  • the intermediate proxy node sends the service data to the service processing system, so that the service processing system processes the service data according to the value-added service, and sends the processed service data to the intermediate agent. node;
  • the intermediate proxy node encrypts the processed service data by using the second key to obtain a fourth ciphertext
  • the intermediate proxy node sends the fourth ciphertext to the user agent, so that the user agent decrypts the fourth ciphertext by using the first key to obtain the service data.
  • the proxy node receives the first Before the ciphertext, it also includes:
  • the intermediate proxy node intercepts the first access request sent by the user agent to the network server, instructing the user agent to send a first connection establishment request, according to the first connection establishment request sent by the user agent, and The user agent establishes the encrypted connection, and the first access request is used to request access to the network server; or
  • the intermediate proxy node receives a first connection establishment request sent by the user agent, and establishes the encrypted connection with the user agent according to the first connection establishment request sent by the user agent, where the first connection is established.
  • the request is sent by the user agent after receiving a trigger signal triggered by the user, and the trigger signal is generated after the user triggers a webpage of the intermediate proxy node pre-stored in the user agent.
  • the indicating that the user agent sends the first connection establishment request includes:
  • the user agent is instructed to send the first connection establishment request by a redirect response.
  • the redirect response includes a URL of the intermediate proxy node, or,
  • the redirecting response includes a proxy web address, and the proxy web address is obtained by the intermediate proxy node adding an agent indication to the indication information of the network server, where the indication information is webpage indication information, One of the object indication information of the object in the page, the information obtained by converting the webpage indication information or the object indication information.
  • the intermediate proxy node when the redirecting response includes a URL of the intermediate proxy node, the intermediate proxy node is configured according to the The first connection establishment request sent by the user agent, after establishing the encrypted connection with the user agent, further includes:
  • the intermediate proxy node receives a fifth ciphertext sent by the user agent, and the fifth ciphertext is obtained by the user agent by using the first key to encrypt a second access request, where the second access request is obtained. Used to request access to the intermediate proxy node;
  • the intermediate proxy node decrypts the fifth ciphertext by using the second key to obtain the second access request
  • the intermediate proxy node acquires a webpage of the intermediate proxy node
  • the intermediate proxy node encrypts the webpage by using the second key to obtain a sixth ciphertext
  • the proxy node is a front-end proxy node located between the user agent and the intermediate proxy node, and the proxy node sends the service information to the service processing system ,Also includes:
  • the front-end proxy node receives service data sent by the service processing system
  • the front-end proxy node encrypts the service data by using the second key to obtain a seventh ciphertext
  • the front-end proxy node sends the seventh ciphertext to the user agent, so that the user agent decrypts the seventh ciphertext by using the first key to obtain the service data.
  • the method before the proxy node receives the first ciphertext sent by the user agent, the method further includes:
  • the front-end proxy node intercepts a second connection establishment request sent by the user agent to the intermediate proxy node, where the second connection establishment request includes a destination Internet Protocol IP address of the intermediate proxy node;
  • the front-end proxy node establishes the encrypted connection with the user agent according to the destination IP address and pre-stored node information of the intermediate proxy node.
  • the second connection establishment request is that after the intermediate proxy node intercepts the first access request sent by the user agent to the network server, the user agent sends the first access request by using a redirect response. Requesting access to the web server, or,
  • the second connection establishment request is sent by the user agent after receiving a trigger signal triggered by the user, and the trigger signal is generated after the user triggers a webpage of the intermediate proxy node pre-stored in the user agent.
  • the second connection establishment request is that the intermediate proxy node intercepts the first access request
  • the user agent is sent by the redirect response
  • the redirect response includes a URL of the intermediate proxy node; or,
  • the redirecting response includes a proxy web address, and the proxy web address is obtained by the intermediate proxy node adding an agent indication to the network server, where the indication information is webpage indication information, object indication information of an object in the webpage, The web page indication information or one of the information obtained after the object indication information is converted.
  • the redirect response includes a URL of the intermediate proxy node
  • the front-end proxy node After the front-end proxy node establishes the encrypted connection with the user agent according to the destination IP address and the pre-stored node information of the intermediate proxy node, the front-end proxy node further includes:
  • the front-end proxy node receives a fifth ciphertext sent by the user agent, and the fifth ciphertext is obtained by the user agent by using the first key to encrypt a second access request, where the second access request is obtained. Used to request access to the intermediate proxy node;
  • the front-end proxy node decrypts the fifth ciphertext by using the second key to obtain the second access request
  • the front-end proxy node sends the second access request to the service processing system, so that the service processing system processes the second access request according to the value-added service, and the processed second access request is processed. Sending a request to the intermediate proxy node;
  • the front-end proxy node encrypts the webpage sent by the service processing system by using the second key to obtain a sixth ciphertext, and the webpage is sent by the intermediate proxy node to the service processing system;
  • the user agent sends the first ciphertext.
  • the front-end proxy node establishes the encrypted connection with the user agent according to the destination IP address and the pre-stored node information of the intermediate proxy node, including :
  • the node information includes a digital certificate and a private key
  • the front-end proxy node sends the digital certificate to the user agent, and receives the encrypted information sent by the user agent according to the public key carried by the digital certificate, using the Decrypting the encrypted information by the private key to obtain a pre-master key, and establishing the encrypted connection with the user agent by using the destination IP address; or
  • the node information includes a digital certificate
  • the front-end proxy node sends the digital certificate to the user agent, and receives the encrypted information sent by the user agent according to the public key carried by the digital certificate, and sends the encrypted information.
  • the pre-master key is used to generate the first key and the second key.
  • the method further includes:
  • the intermediate proxy node intercepts a transmission control protocol TCP connection request sent by the user agent to the network server;
  • the intermediate proxy node reads information in the TCP connection request, and replaces the network server to establish a TCP connection with the user agent according to the information, and after the TCP connection is established, uses the pre-stored network and the network
  • the digital certificate corresponding to the server establishes an encryption proxy connection with the user agent, and the encryption proxy connection is used by the user agent to send the first access request to the network server.
  • the using the pre-stored digital certificate corresponding to the network server to establish an encryption with the user agent Proxy connection including:
  • the intermediate proxy node sends a first digital certificate to the user agent, the first digital certificate Is a digital certificate issued by a certificate authority and corresponding to the network server, where the second digital certificate of the certificate authority is pre-configured in an operating system of the user agent or a terminal where the user agent is installed, And causing the user agent to verify the first digital certificate according to the second digital certificate, and after the verification is passed, establishing the encrypted proxy connection with the intermediate proxy node; or
  • the intermediate proxy node sends a third digital certificate and a fourth digital certificate to the user agent, the third digital certificate being a digital certificate issued by an unauthorized certificate authority and corresponding to the network server, the fourth number
  • the certificate is a digital certificate of the non-authorized certificate authority, so that the user agent verifies the third digital certificate according to the fourth digital certificate, and after the verification is passed, establishes the encryption agent with the intermediate agent node connection.
  • the second connection establishment request is that the intermediate proxy node intercepts the user agent by using an encrypted proxy connection.
  • the encrypted proxy connection is that the intermediate proxy node intercepts a TCP connection request sent by the user agent to the network server, Reading the information in the TCP connection request, and replacing the network server with the user agent to establish a TCP connection according to the information, and after the TCP connection is established, using the pre-stored digital certificate corresponding to the network server Established with the user agent.
  • a service processing apparatus for use in a proxy node, the apparatus comprising:
  • a first receiving module configured to receive a first ciphertext sent by a user agent, where the first ciphertext is obtained by encrypting the service information by using the first key by the user agent;
  • a first decryption module configured to decrypt the first ciphertext received by the first receiving module by using a second key, to obtain the service information
  • a first sending module configured to send the service information obtained by decrypting the first decryption module to a service processing system, so that the service processing system processes the service information according to the value-added service, and triggers processing The process of sending the service information to the network server;
  • the first key and the second key are keys agreed by the user agent and the proxy node when establishing an encrypted connection.
  • the proxy node is an intermediate proxy node
  • the device further includes:
  • a second receiving module configured to receive, after the first sending module sends the service information to the service processing system, the processed service information sent by the service processing system;
  • a key agreement module configured to establish an encrypted connection with the network server, and stipulate a third key and a fourth key
  • a first encryption module configured to encrypt the service information by using the third key agreed by the key agreement module to obtain a second ciphertext
  • a second sending module configured to send the second ciphertext encrypted by the first cryptographic module to the network server, so that the network server decrypts the second ciphertext by using the fourth key , get the business information.
  • the device further includes:
  • a third receiving module configured to receive, after the second sending module sends the second ciphertext to the network server, a third ciphertext sent by the network server, where the third ciphertext is The network server encrypts the service data by using the fourth key;
  • a second decryption module configured to decrypt the third ciphertext received by the third receiving module by using the third key, to obtain the service data
  • a third sending module configured to send the service data that is decrypted by the second decryption module to the service processing system, so that the service processing system processes the service data according to the value-added service, and the The service data is sent to the intermediate proxy node;
  • a second encryption module configured to encrypt the processed service data by using the second key to obtain a fourth ciphertext
  • a fourth sending module configured to send the fourth ciphertext encrypted by the second cryptographic module to the user agent, so that the user agent decrypts the fourth ciphertext by using the first key , get the business data.
  • the device further includes:
  • a first establishing module configured to: before the first receiving module receives the first ciphertext sent by the user agent, intercept the first access request sent by the user agent to the network server, and instruct the user agent to send the first a connection establishment request, the encrypted connection is established with the user agent according to the first connection establishment request sent by the user agent, where the first access request is used to request access to the network server; or
  • a second establishing module configured to receive, after the first receiving module receives the first ciphertext sent by the user agent, a first connection establishment request sent by the user agent, according to the location sent by the user agent
  • the first connection establishment request is established, and the encrypted connection is established with the user agent, where the first connection establishment request is sent by the user agent after receiving a trigger signal triggered by the user, and the trigger signal is a user triggering Generated after the webpage of the intermediate proxy node pre-stored in the user agent.
  • the first establishing module is configured to, by using a redirect response, instructing the user agent to send the The first connection establishment request.
  • the redirect response includes a URL of the intermediate proxy node, or,
  • the redirecting response includes a proxy web address, and the proxy web address is obtained by the intermediate proxy node adding an agent indication to the network server, where the indication information is webpage indication information, object indication information of an object in the webpage, The web page indication information or one of the information obtained after the object indication information is converted.
  • the device when the redirecting response includes the URL of the intermediate proxy node, the device further includes:
  • a fourth receiving module configured to receive, after the first establishing module sends the encrypted connection with the user agent according to the first connection establishment request sent by the user agent, receiving a fifth sent by the user agent
  • the ciphertext, the fifth ciphertext is obtained by the user agent using the first key to encrypt a second access request, and the second access request is used to request access to the intermediate proxy node;
  • a third decryption module configured to decrypt the fifth ciphertext received by the fifth receiving module by using the second key, to obtain the second access request
  • a webpage obtaining module configured to acquire a webpage of the intermediate proxy node
  • a third encryption module configured to encrypt the webpage acquired by the webpage obtaining module by using the second key, to obtain a sixth ciphertext
  • a fifth sending module configured to send the sixth ciphertext encrypted by the third cryptographic module to the user agent, so that the user agent decrypts the sixth ciphertext by using the first key And obtaining the webpage, where the webpage is used to trigger the user agent to send the first ciphertext.
  • the proxy node is a front-end proxy node located between the user agent and the intermediate proxy node, and the device further includes:
  • a fifth receiving module configured to send the service information to the service processing in the first sending module After receiving the service data sent by the service processing system;
  • a fourth encryption module configured to encrypt the service data received by the fifth receiving module by using the second key, to obtain a seventh ciphertext
  • a sixth sending module configured to send the seventh ciphertext encrypted by the fourth cryptographic module to the user agent, so that the user agent decrypts the seventh ciphertext by using the first key , get the business data.
  • the device further includes:
  • an intercepting module configured to intercept, before the first receiving module receives the first ciphertext sent by the user agent, a second connection establishment request sent by the user agent to the intermediate proxy node, where the second connection establishment request includes Determining the destination Internet Protocol IP address of the intermediate proxy node, the second connection establishment request is that the intermediate proxy node intercepts the first access request sent by the user agent to the network server, and indicates the user by using a redirect response And sending, by the proxy, the first access request is used to request access to the network server, or the second connection establishment request is sent by the user agent after receiving a trigger signal triggered by the user, where the trigger signal is Generating, after the user triggers a webpage of the intermediate proxy node pre-stored in the user agent;
  • a third establishing module configured to establish the encrypted connection with the user agent according to the destination IP address and pre-stored node information of the intermediate proxy node.
  • the second connection establishment request is sent by the user agent after the intermediate agent node intercepts the first access request sent by the user agent to the network server, and the first access request is used to request access to the Network server, or,
  • the second connection establishment request is sent by the user agent after receiving a trigger signal triggered by the user, and the trigger signal is generated after the user triggers a webpage of the intermediate proxy node pre-stored in the user agent.
  • the redirect response includes a URL of the intermediate proxy node; or,
  • the redirect response includes a proxy URL, the proxy URL being described by the intermediate proxy node
  • the indication information of the network server is obtained by adding a proxy indication, where the indication information is one of webpage indication information, object indication information of an object in the webpage, and information obtained by converting the webpage indication information or the object indication information.
  • the apparatus when the redirect response includes a URL of the intermediate proxy node, the apparatus further includes :
  • a sixth receiving module configured to: after the third establishing module establishes the encrypted connection with the user agent according to the destination IP address and the pre-stored node information of the intermediate proxy node, receive the user agent to send a fifth ciphertext, wherein the fifth ciphertext is obtained by the user agent using the first key to encrypt a second access request, and the second access request is used to request access to the intermediate proxy node;
  • a fourth decryption module configured to decrypt the fifth ciphertext received by the sixth receiving module by using the second key, to obtain the second access request
  • a seventh sending module configured to send the second access request that is decrypted by the fourth decryption module to the service processing system, so that the service processing system processes the second access request according to the value-added service Transmitting the processed second access request to the intermediate proxy node;
  • a fifth encryption module configured to encrypt the webpage sent by the service processing system by the second key, to obtain a sixth ciphertext, where the webpage is sent by the intermediate proxy node to the service processing system;
  • An eighth sending module configured to send the sixth ciphertext encrypted by the fifth ciphering module to the user agent, so that the user agent decrypts the sixth ciphertext by using the first key And obtaining the webpage, where the webpage is used to trigger the user agent to send the first ciphertext.
  • the third establishing module is specifically used to
  • the node information includes a digital certificate and a private key, and the digital certificate is sent to the user agent, and the encrypted information sent by the user agent according to the public key carried by the digital certificate is received, and the private key is used to Encrypting the information to obtain a pre-master key, and establishing the encrypted connection with the user agent using the destination IP address; or
  • the node information includes a digital certificate, and the digital certificate is sent to the user agent, and the encrypted information sent by the user agent according to the public key carried by the digital certificate is received, and the encrypted information is sent.
  • the pre-master key is used to generate the first key and the second key.
  • the device further includes:
  • a request obtaining module configured to intercept, before the first establishing module intercepts the first access request sent by the user agent to the network server, a transmission control protocol TCP connection request sent by the user agent to the network server;
  • a fourth establishing module configured to read information in the TCP connection request, and replace the network server to establish a TCP connection with the user agent according to the information, and after the TCP connection is established, use the pre-stored
  • the digital certificate corresponding to the network server establishes an encryption proxy connection with the user agent, and the encryption proxy connection is used by the user agent to send the first access request to the network server.
  • the fourth establishing module is specifically configured to:
  • the first digital certificate is a digital certificate issued by a certificate authority and corresponding to the network server
  • the second digital certificate of the certificate authority is pre-configured in the user In an operating system of the terminal or the terminal in which the user agent is installed, so that the user agent verifies the first digital certificate according to the second digital certificate, and after the verification is passed, establishes with the intermediate agent node Encrypted proxy connection; or,
  • the third digital certificate is a digital certificate issued by an unauthorized certificate authority and corresponding to the network server
  • the fourth digital certificate is the non- Authorizing a digital certificate of the certificate authority to enable the user agent to verify the third digital certificate according to the fourth digital certificate, and establish the encrypted proxy connection with the intermediate proxy node after the verification is passed.
  • the second connection establishment request is that the intermediate proxy node intercepts the user agent by using an encrypted proxy connection
  • the encrypted proxy connection is that the intermediate proxy node intercepts a TCP connection request sent by the user agent to the network server, Reading the information in the TCP connection request, according to the The information replaces the network server to establish a TCP connection with the user agent, and after the TCP connection is established, is established with the user agent by using a pre-stored digital certificate corresponding to the network server.
  • a service processing apparatus for use in a proxy node, the apparatus comprising: a bus, and a processor, a memory, a transmitter, and a receiver coupled to the bus.
  • the memory is for storing a plurality of instructions, the instructions being configured to be executed by the processor;
  • the receiver is configured to receive a first ciphertext sent by a user agent, where the first ciphertext is obtained by encrypting the service information by using the first key by the user agent;
  • the processor is configured to decrypt the first ciphertext received by the receiver by using a second key to obtain the service information
  • the transmitter is configured to send the service information decrypted by the processor to a service processing system, so that the service processing system processes the service information according to the value-added service, and triggers the processed device. Describe the process of sending service information to the network server;
  • the first key and the second key are keys agreed by the user agent and the proxy node when establishing an encrypted connection.
  • the proxy node is an intermediate proxy node
  • the receiver is further configured to: after the transmitter sends the service information to a service processing system, receive the processed service information sent by the service processing system;
  • the processor is further configured to establish an encrypted connection with the network server, and stipulate a third key and a fourth key; and encrypt the service information by using the third key to obtain a second ciphertext;
  • the transmitter is further configured to send the second ciphertext encrypted by the processor to the network server, so that the network server decrypts the second ciphertext by using the fourth key, Obtain the business information.
  • the receiver is further configured to: after the transmitter sends the second ciphertext to the network server, receive a third ciphertext sent by the network server, where the third ciphertext is used by the network
  • the server encrypts the service data by using the fourth key
  • the processor is further configured to decrypt the third ciphertext received by the receiver by using the third key to obtain the service data;
  • the transmitter is further configured to send the service data decrypted by the processor to the service Processing the system, so that the service processing system processes the service data according to the value-added service, and sends the processed service data to the intermediate proxy node;
  • the processor is further configured to use the second key to encrypt the processed service data to obtain a fourth ciphertext
  • the transmitter is further configured to send the fourth ciphertext encrypted by the processor to the user agent, so that the user agent decrypts the fourth ciphertext by using the first key, Obtain the business data.
  • the receiver is further configured to: before receiving the first ciphertext sent by the user agent, intercept the first access request sent by the user agent to the network server, where the transmitter is further used to indicate the user agent Sending a first connection establishment request, the processor is further configured to establish the encrypted connection with the user agent according to the first connection establishment request sent by the user agent, where the first access request is used for requesting Accessing the web server; or,
  • the receiver is further configured to receive a first connection establishment request sent by the user agent before receiving the first ciphertext sent by the user agent, where the processor is further configured to send according to the user agent a first connection establishment request, and the encrypted connection is established with the user agent, where the first connection establishment request is sent by the user agent after receiving a trigger signal triggered by a user, where the trigger signal is triggered by a user Generated after the web page of the intermediate proxy node pre-stored in the user agent.
  • the transmitter is configured to, by using a redirect response, instructing the user agent to send the first connection Create a request.
  • the redirect response includes a URL of the intermediate proxy node, or,
  • the redirecting response includes a proxy web address, and the proxy web address is obtained by the intermediate proxy node adding an agent indication to the network server, where the indication information is webpage indication information, object indication information of an object in the webpage, The web page indication information or one of the information obtained after the object indication information is converted.
  • the receiver is further configured to: after the processor establishes the encrypted connection with the user agent according to the first connection establishment request sent by the user agent, receive a fifth secret sent by the user agent
  • the second ciphertext is obtained by the user agent using the first key to encrypt a second access request, and the second access request is used to request access to the intermediate proxy node;
  • the processor is further configured to use the second key to decrypt the fifth ciphertext received by the receiver to obtain the second access request, acquire a webpage of the intermediate proxy node, and use the Encrypting the webpage with a second key to obtain a sixth ciphertext;
  • the transmitter is further configured to send the sixth ciphertext encrypted by the processor to the user agent, so that the user agent decrypts the sixth ciphertext by using the first key, Obtaining the webpage, where the webpage is used to trigger the user agent to send the first ciphertext.
  • the proxy node is a front-end proxy node located between the user agent and the intermediate proxy node, and further includes:
  • the receiver is further configured to: after the transmitter sends the service information to a service processing system, receive service data sent by the service processing system;
  • the processor is further configured to use the second key to encrypt the service data received by the receiver to obtain a seventh ciphertext
  • the transmitter is further configured to send the seventh ciphertext encrypted by the processor to the user agent, so that the user agent decrypts the seventh ciphertext by using the first key, Obtain the business data.
  • the receiver is further configured to: before receiving the first ciphertext sent by the user agent, intercepting a second connection establishment request sent by the user agent to the intermediate proxy node, where the second connection establishment request includes the intermediate proxy node Purpose of the Internet Protocol IP address;
  • the processor is configured to establish the encrypted connection with the user agent according to the destination IP address and pre-stored node information of the intermediate proxy node.
  • the second connection establishment request is sent by the user agent after the intermediate agent node intercepts the first access request sent by the user agent to the network server, and the first access request is used to request access to the Network server, or,
  • the second connection establishment request is sent by the user agent after receiving a trigger signal triggered by the user, and the trigger signal is generated after the user triggers a webpage of the intermediate proxy node pre-stored in the user agent.
  • the second connection establishment request is that the intermediate proxy node intercepts the first access request
  • the user agent is sent by the redirect response
  • the redirect response includes a URL of the intermediate proxy node; or,
  • the redirecting response includes a proxy web address, and the proxy web address is obtained by the intermediate proxy node adding an agent indication to the network server, where the indication information is webpage indication information, object indication information of an object in the webpage, The web page indication information or one of the information obtained after the object indication information is converted.
  • the receiver is further configured to: after the processor establishes the encrypted connection with the user agent according to the destination IP address and the pre-stored node information of the intermediate proxy node, receive the sent by the user agent a fifth ciphertext, wherein the second ciphertext is obtained by the user agent using the first key to encrypt a second access request, and the second access request is used to request access to the intermediate proxy node;
  • the processor is further configured to decrypt the fifth ciphertext received by the receiver by using the second key to obtain the second access request;
  • the transmitter is further configured to send the second access request that is decrypted by the processor to the service processing system, so that the service processing system processes the second access request according to the value-added service. Transmitting the processed second access request request to the intermediate proxy node;
  • the processor is further configured to use the second key to encrypt a webpage sent by the service processing system to obtain a sixth ciphertext, where the webpage is sent by the intermediate proxy node to the service processing system;
  • the transmitter is further configured to send the sixth ciphertext encrypted by the processor to the user agent, so that the user agent decrypts the sixth ciphertext by using the first key, Obtaining the webpage, where the webpage is used to trigger the user agent to send the first ciphertext.
  • the node information includes a digital certificate and a private key
  • the transmitter is specifically configured to send the digital certificate to the user agent
  • the receiver is specifically configured to receive the user agent to carry according to the digital certificate.
  • the node information includes a digital certificate
  • the transmitter is configured to send the digital certificate to the user agent, where the receiver is configured to receive a public key that is carried by the user agent according to the digital certificate.
  • Sending the encrypted information the transmitter is further configured to send the encrypted information to the intermediate proxy node, where the receiver is further configured to receive, by the intermediate proxy node, the encrypted information by using a private key a pre-master key sent later, the processor, specifically configured to establish the encrypted connection with the user agent by using the destination IP address;
  • the pre-master key is used to generate the first key and the second key.
  • the receiver is further configured to intercept a transmission control protocol TCP connection request sent by the user agent to the network server before intercepting the first access request sent by the user agent to the network server;
  • the processor is further configured to read information in the TCP connection request, and replace the network server to establish a TCP connection with the user agent according to the information, and after the TCP connection is established, use the pre-stored
  • the digital certificate corresponding to the network server establishes an encryption proxy connection with the user agent, and the encryption proxy connection is used by the user agent to send the first access request to the network server.
  • the transmitter is further configured to send, to the user agent, a first digital certificate, where the first digital certificate is a digital certificate issued by a certificate authority and corresponding to the network server, and the second certificate authority
  • the digital certificate is pre-configured in an operating system of the user agent or a terminal in which the user agent is installed, so that the user agent verifies the first digital certificate according to the second digital certificate, after the verification is passed, Establishing the encrypted proxy connection with the intermediate proxy node; or,
  • the transmitter is further configured to send, to the user agent, a third digital certificate and a fourth digital certificate, where the third digital certificate is issued by an unauthorized certificate authority and corresponds to the network server.
  • a digital certificate the fourth digital certificate is a digital certificate of the non-authorized certificate authority, so that the user agent verifies the third digital certificate according to the fourth digital certificate, after the verification is passed,
  • the intermediate proxy node establishes the encrypted proxy connection.
  • the second connection establishment request is that the intermediate proxy node intercepts the user agent by using an encrypted proxy connection
  • the encrypted proxy connection is that the intermediate proxy node intercepts a TCP connection request sent by the user agent to the network server, Reading the information in the TCP connection request, and replacing the network server with the user agent to establish a TCP connection according to the information, and after the TCP connection is established, using the pre-stored digital certificate corresponding to the network server Established with the user agent.
  • the first ciphertext is obtained by the user agent using the first key to encrypt the service information; using the second key to decrypt the first ciphertext to obtain the service information; and sending the service information to the first ciphertext
  • the service processing system so that the service processing system processes the service information according to the value-added service, and triggers the process of transmitting the processed service information to the network server, which can be transmitted by the proxy node when the user agent uses the SSL/TLS protocol.
  • the first ciphertext is decrypted, and the decrypted service information is sent to the service processing system, which solves the problem that the service processing system cannot decrypt the ciphertext, and the service processing system cannot provide value-added services for the user agent using the SSL/TLS protocol.
  • the effect of expanding the use of value-added services has been achieved.
  • FIG. 1 is a flowchart of a method for processing a service according to an embodiment of the present invention
  • FIG. 2 is a flowchart of still another method for processing a service according to an embodiment of the present invention.
  • FIG. 3 is a schematic diagram of establishing a TLS connection according to an embodiment of the present invention.
  • FIG. 4A is a flowchart of an application of a first service processing method according to an embodiment of the present invention.
  • 4B is a flowchart of an application of a second service processing method according to an embodiment of the present invention.
  • FIG. 5 is a schematic diagram of establishing another encryption connection according to an embodiment of the present invention.
  • FIG. 6 is a flowchart of an application of a third service processing method according to an embodiment of the present invention.
  • FIG. 6B is a flowchart of an application of a fourth service processing method according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic diagram of another encryption connection established by an embodiment of the present invention.
  • FIG. 8A is a flowchart of an application of a fifth service processing method according to an embodiment of the present invention.
  • FIG. 8B is a flowchart of an application of a sixth service processing method according to an embodiment of the present invention.
  • FIG. 9 is a schematic structural diagram of a service processing apparatus according to an embodiment of the present invention.
  • FIG. 10 is a schematic structural diagram of still another service processing apparatus according to an embodiment of the present disclosure.
  • FIG. 11 is a schematic structural diagram of a service processing apparatus according to an embodiment of the present invention.
  • FIG. 1 is a flowchart of a method for processing a service according to an embodiment of the present invention.
  • the service processing method may include:
  • Step 101 The proxy node receives the first ciphertext sent by the user agent, and the first ciphertext is obtained by the user agent encrypting the service information by using the first key.
  • Step 102 The proxy node decrypts the first ciphertext by using the second key to obtain service information.
  • Step 103 The proxy node sends the service information to the service processing system, so that the service processing system processes the service information according to the value-added service, and triggers a process of sending the processed service information to the network server.
  • the first key and the second key are keys agreed by the user agent and the proxy node when establishing an encrypted connection.
  • the service processing method receives the first ciphertext sent by the user agent, decrypts the first ciphertext by using the second key, and obtains the service information, and sends the service information to the service processing system.
  • the service processing system In order for the service processing system to process the service information according to the value-added service, and trigger the process of sending the processed service information to the network server, the first ciphertext transmitted by the proxy node may be used when the user agent uses the SSL/TLS protocol.
  • the decryption is performed, and the decrypted service information is sent to the service processing system, which solves the problem that the service processing system cannot decrypt the ciphertext, and the service processing system cannot provide value-added services for the user agent using the SSL/TLS protocol, thereby achieving the expansion of the value-added service.
  • Business The effect of the scope of use.
  • the proxy node is an intermediate proxy node, the user proxy, and the intermediate proxy node establish an encrypted connection, and the intermediate proxy node and the network server establish an encrypted connection as an example.
  • the service processing method may include:
  • Step 201 The intermediate proxy node receives the first ciphertext sent by the user agent, and the first ciphertext is obtained by the user agent encrypting the service information by using the first key.
  • the intermediate proxy node may be a Portal.
  • the intermediate proxy node may also be other sites, which is not limited in this embodiment.
  • the service information is used for performing service interaction with the network server, and may be specifically used for requesting service from the network server, or may be specifically used for sending service data to the network server.
  • the service information may be used to request a homepage of the network server, or may be used to request an object in the network server, where the object may be an object stored in the network server. It may also be an object stored in another server and the uniform resource identifier (English: uniform resource identifier; URI) of the object is included in the webpage of the web server.
  • URI uniform resource identifier
  • the service information at this time includes www.ottserver.com; when the web page of the OTT server includes the URI and the service information is used to request the OTT server.
  • the URI of the webpage is www.ottserver.com/picture1.gif and the user needs to obtain the picture 1 indicated by the URI, and the service information includes www.ottserver.com/picture1.gif. .
  • the service information may be obtained by the intermediate proxy node adding an agent indication to the foregoing website address.
  • the proxy indicates an intermediate proxy node used to indicate the transit service, and may be a web address of the intermediate proxy node.
  • the proxy indication may be the URL of the intermediate proxy node www.portal.com.
  • the intermediate proxy node may also convert the webpage indication information or the object indication information, Add proxy instructions to the information obtained after the conversion to obtain business information.
  • the conversion can convert the plaintext into ciphertext for transmission, which can improve the security of data transmission.
  • the intermediate proxy node Before the intermediate proxy node receives the first ciphertext sent by the user agent, the intermediate proxy node needs to establish an encrypted connection with the user agent and agree on the key in the process of establishing an encrypted connection.
  • the first key and the second key may be agreed.
  • the first key is stored in the user agent, and the user agent may use the first key to encrypt and send to the middle.
  • the plaintext of the proxy node may also use the first key to decrypt the ciphertext sent by the intermediate proxy node;
  • the second key is stored in the intermediate proxy node, and the intermediate proxy node may use the second key to encrypt the plaintext to be sent to the user proxy.
  • the second key can also be used to decrypt the ciphertext sent by the user agent.
  • the first key and the second key may be agreed upon, and the fifth key and the sixth key are agreed, and the first key and the fifth key are stored in
  • the user agent may encrypt the plaintext to be sent to the intermediate proxy node using the first key, decrypt the ciphertext sent by the intermediate proxy node using the fifth key, and store the second key and the sixth key in the intermediate proxy node.
  • the intermediate proxy node may use the second key to encrypt the plaintext to be sent to the user agent, and the sixth key to decrypt the ciphertext sent by the user agent.
  • the first key and the second key may be symmetric keys or asymmetric keys; the fifth key and the sixth key may be symmetric keys or asymmetric keys. The following is an example in which the encryption key and the decryption key of the same device are the same.
  • the encrypted connection can be a connection based on the SSL/TLS protocol. Since the establishment process of the SSL-based encrypted connection and the TLS-based encrypted connection is similar, the following describes an encrypted connection based on the TLS protocol as an example.
  • This embodiment provides two establishment manners of an encrypted connection between an intermediate proxy node and a user agent, as follows:
  • the intermediate proxy node intercepts the first access request sent by the user agent to the network server, instructs the user agent to send the first connection establishment request, and establishes an encryption with the user agent according to the first connection establishment request sent by the user agent. Connection, the first access request is used to request access to the web server.
  • the first access request may specifically request access to an object in a web server's home page or a web server.
  • the intermediate agent node establishes a transmission control protocol with the user agent (English: transmission control) Protocol; abbreviation: TCP) connection.
  • TCP transmission control Protocol
  • the TCP connection port includes port 80 and port 443. If the user agent needs to access the network server based on the HTTP protocol, the port of the TCP connection is port 80; if the user agent needs to use the high-text transmission security of the lower layer using SSL/TLS protocol
  • the protocol (English: hyper text transfer protocol over secure socket layer; abbreviation: HTTPS) accesses the network server, and the TCP connection port is port 443.
  • HTTPS hyper text transfer protocol over secure socket layer
  • the following describes the establishment of an encrypted connection between the intermediate proxy node and the user agent by taking the port of the TCP connection as port 80 and port 443 as an example.
  • instructing the user agent to send the first connection establishment request includes: instructing the user agent to send the first connection establishment request by using the redirect response.
  • the redirect response can be HTTP Redirection.
  • the location header field of the redirect response may include type information, where the type information is used to indicate a connection type that the user agent requests to establish.
  • the type information may carry HTTPS, and the HTTPS is used to indicate the HTTPS protocol; when the redirect response needs to indicate that the user agent establishes an unencrypted connection, the type information may be carried in the type information.
  • HTTP HTTP is used to indicate the HTTP protocol. This example is described by taking the HTTPS as the type information.
  • the first connection establishment request is used to request to establish an encrypted connection, and the port to be encrypted is 443.
  • the intermediate proxy node may directly send a redirect response to the user agent; or the intermediate proxy node may send the first access request to the service processing system, after receiving the first access request processed by the service processing system. Sending the processed first access request to the user agent; or, the intermediate proxy node may detect whether the first access request needs to be sent to the service processing system for processing, and when detecting that the service processing system is not required to be processed, The proxy sends a redirect response, and when it is detected that the service processing system is required to be processed, the first access request is sent to the service processing system, and after receiving the first access request processed by the service processing system, the processed first The access request is sent to the user agent.
  • the method provided in this embodiment further includes:
  • the intermediate proxy node intercepts the TCP connection request sent by the user agent to the network server;
  • the intermediate proxy node reads the information in the TCP connection request, and replaces the network server to establish a TCP connection with the user agent according to the information, and after the TCP connection is established, uses the pre-stored digital certificate corresponding to the network server to establish an encryption proxy with the user agent. Connection, encrypted proxy connection for user agent Send the first access request to the web server.
  • the information in the TCP connection request includes the source Internet Protocol (English: Internet Protocol; IP address), the source port, the destination IP address, and the destination port.
  • the source is the user agent and the destination is the network server.
  • the intermediate proxy node uses the above information to replace the network server, and establishes a TCP connection with the user agent port 443.
  • the pre-stored digital certificate corresponding to the network server is used to establish an encrypted proxy connection with the user agent, and the encryption proxy is used.
  • a connection is an encrypted connection established between an intermediate proxy node and a user agent.
  • FIG. 3 Please refer to the setup diagram of a TLS connection shown in FIG. 3, which shows a process in which a user agent establishes a TLS connection with an intermediate proxy node.
  • Step 301 The user agent sends a TLS protocol version number, a list of encryption algorithms, and a first random number to the intermediate proxy node.
  • Step 302 If the intermediate proxy node supports the TLS protocol version, then an encryption algorithm selected from the encryption algorithm list sends the TLS protocol version number, the encryption algorithm, the session identifier, and the second random number to the user agent.
  • Step 303 The intermediate proxy node sends a digital certificate corresponding to the network server to the user agent.
  • Step 304 The intermediate proxy node sends a first completion message to the user agent.
  • Step 305 The user agent verifies the digital certificate. After the verification is passed, the public key in the digital certificate is obtained, a pre-master key is generated, and the pre-master key is encrypted by using the public key, and the public key exchange information is sent to the intermediate agent. node.
  • Step 306 The user agent sends a change password description to the intermediate proxy node, and notifies the intermediate proxy node to start the negotiated parameter.
  • the user agent generates the first key according to the first random number, the second random number, the pre-master key, and the encryption algorithm.
  • step 307 the user agent sends a second completion message to the intermediate proxy node.
  • Step 308 The intermediate proxy node sends a change password description to the user agent, and notifies the user agent to start the negotiated parameter.
  • the intermediate proxy node decrypts the public key exchange information using the private key to obtain a pre-master key, and generates a second key according to the first random number, the second random number, the pre-master key, and the encryption algorithm.
  • step 309 the intermediate proxy node sends a third completion message to the user agent.
  • the intermediate proxy node may appoint an encryption key and a decryption key with the user agent in the process of establishing an encrypted proxy connection with the user agent.
  • the intermediate proxy node can use encryption.
  • the key encrypts the redirect response, and sends the encrypted ciphertext to the user agent.
  • the user agent After decrypting the ciphertext by using the decryption key, the user agent obtains a redirect response.
  • the user agent generates a first connection establishment request according to the redirect response, and sends the first connection establishment request to the intermediate proxy node, and the intermediate proxy node obtains the first connection establishment request.
  • the intermediate proxy node needs to obtain a digital certificate and a private key corresponding to the network server, and the digital certificate includes at least a public key, an owner name, and a digital signature of the certificate authority.
  • a digital signature is a hash value obtained by hashing information to verify whether the information has been tampered with.
  • the digital signature in this embodiment is used to verify whether the digital certificate has been tampered with.
  • the encrypted proxy connection is established with the user agent by using the pre-stored digital certificate corresponding to the network server, including:
  • the intermediate proxy node sends a first digital certificate to the user agent, the first digital certificate is a digital certificate issued by the certificate authority and corresponding to the network server, and the second digital certificate of the certificate authority is pre-configured in the user agent or installed The operating system of the terminal of the user agent, so that the user agent verifies the first digital certificate according to the second digital certificate, and establishes an encrypted proxy connection with the intermediate proxy node after the verification is passed; or
  • the intermediate proxy node sends a third digital certificate and a fourth digital certificate to the user agent, the third digital certificate is a digital certificate issued by an unauthorized certificate authority and corresponding to the network server, and the fourth digital certificate is a number of the non-authorized certificate authority
  • the certificate is such that the user agent verifies the third digital certificate according to the fourth digital certificate, and after the verification is passed, establishes an encrypted proxy connection with the intermediate proxy node.
  • the digital certificate corresponding to the network server may be a real digital certificate of the network server, or may be a digital certificate other than the real digital certificate, and the other digital certificate has a corresponding relationship with the network server.
  • the other digital certificate may be a proxy digital certificate or a fake digital certificate, and the specific content is as follows.
  • the certificate authority can be an authorized certificate authority or an unauthorized certificate authority.
  • the authorized certificate authority When the certificate authority is an authorized certificate authority, the authorized certificate authority issues a proxy digital certificate of the network server for the trusted intermediate agent node according to security monitoring and the like, and the agent digital certificate is the first digital certificate.
  • the authorization certificate issuing authority may issue different proxy digital certificates for each network server, and may also issue the same proxy digital certificate for multiple different network servers, which is not limited in this embodiment.
  • the proxy digital certificate of the network server may also be a sub-certificate on the digital certificate chain of the network server.
  • This sub-certificate can be issued by a network server or by another third-party authorized certificate authority.
  • the proxy digital certificate may be the same as the real digital certificate issued by the authorized certificate authority for the network server, or may be different from the real digital certificate. That is, the proxy digital certificate and the real digital certificate can have different public and private key pairs.
  • the non-authorized certificate authority issues a digital certificate corresponding to the network server for the intermediate agent node, and the digital certificate at this time is a fake digital certificate, and the fake digital certificate is the first digital certificate. .
  • the user agent verifies the digital certificate, it checks whether the root certificate of the certificate authority of the digital certificate is in the list of the trusted certificate authority (English: Certificate Authority; CA), and the root certificate is the second digital certificate. If the root certificate is located in the trusted CA list, the digital signature in the digital certificate is verified according to the public key of the root certificate. If the verification of the digital signature is successful, the verification of the digital certificate is successful; if the verification of the digital signature fails , the verification of the digital certificate fails; if the root certificate is not in the list of trusted CAs, the verification of the digital certificate fails.
  • the root certificate authority of the digital certificate is in the list of the trusted certificate authority (English: Certificate Authority; CA)
  • the root certificate is the second digital certificate. If the root certificate is located in the trusted CA list, the digital signature in the digital certificate is verified according to the public key of the root certificate. If the verification of the digital signature is successful, the verification of the digital certificate is successful; if the verification of the digital signature fails , the verification of the digital certificate fails; if the root certificate
  • the digital certificate corresponding to the network server obtained by the intermediate proxy node may be issued by a multi-level certificate authority.
  • the digital certificate corresponding to the network server obtained by the intermediate agent node is issued by the intermediate certificate authority Issuer, and the digital certificate issued by the intermediate certificate authority Issuer is issued by the advanced certificate authority Root CA.
  • the user agent searches for the digital certificate of the certificate authority step by step, and detects whether the root certificate of the certificate authority of the digital certificate is located in the trusted CA list, and if the root certificate is located in the trusted CA list, according to the root certificate
  • the public key verifies the digital signature in the lower-level digital certificate.
  • the digital signature in the lower-level digital certificate is verified according to the public key of the lower-level digital certificate until the verification of all the digital signatures is successful.
  • the verification of the certificate is successful; if the verification of one of the digital signatures fails, the verification of the digital certificate fails; if the root certificate is not in the list of trusted CAs, the verification of the digital certificate fails.
  • the root certificate of the authorized certificate authority is pre-configured in the user agent or the operating system of the terminal where the user agent is installed, that is, the authorized certificate authority
  • the root certificate is pre-configured in the list of trusted CAs; when the certificate authority is an unauthorized certificate authority, the root certificate of the non-authorized certificate authority needs to be added to the list of trusted CAs.
  • the root certificate of the non-authorized certificate authority is added to the list of trusted CAs; in the second mode of addition, the user can be prompted to install the root certificate of the non-authorized certificate authority, and the root certificate of the non-authorized certificate authority is added to the Letter CA list.
  • the intermediate proxy node may obtain a digital certificate chain sent by an unauthorized certificate authority, where the digital certificate chain includes at least a digital certificate of an unauthorized certificate authority, that is, a self-signed root certificate, that is, a fourth The digital certificate, and the counterfeit digital certificate of the network server, the intermediate agent node sends the digital certificate chain to the user agent, and the fake digital certificate is a third digital certificate.
  • the user agent When the user agent verifies the digital certificate, it reads the public key of the root certificate in the received digital certificate chain, and verifies the digital signature in the fake digital certificate according to the public key. If the verification of the digital signature is successful, the counterfeit number is The verification of the certificate is successful; if the verification of the digital signature fails, the verification of the fake digital certificate fails.
  • the fake digital certificate obtained by the intermediate proxy node may be issued by a multi-level non-authorized certificate authority, that is, the certificate chain further includes a digital certificate of a multi-level non-authorized certificate authority.
  • the digital certificate corresponding to the network server obtained by the intermediate agent node is issued by the non-authorized intermediate certificate authority Issuer, and the digital certificate of the non-authorized intermediate certificate authority Issuer is issued by the non-authorized advanced certificate authority Root CA.
  • the user agent searches for the root certificate of the unauthorized certificate authority step by step from the received digital certificate, and verifies the digital signature in the lower level digital certificate according to the public key of the root certificate.
  • the public key of the lower-level digital certificate verifies the digital signature in the lower-level digital certificate until the verification of the digital certificate is successful after all the digital signatures are successfully verified; if the verification of one of the digital signatures fails, the verification of the digital certificate fails. .
  • the intermediate proxy node receives the first connection establishment request sent by the user agent, and establishes an encrypted connection with the user agent according to the first connection establishment request sent by the user agent, where the first connection establishment request is received by the user agent.
  • the trigger signal is generated after the user triggers the webpage of the intermediate proxy node pre-stored in the user agent.
  • the webpage of the intermediate proxy node may be stored in the user agent as a homepage, a bookmark, a configuration information, or the like, or an application, a service, etc. customized for the intermediate proxy node may be installed in the user agent, and the user may directly obtain and trigger from the user agent.
  • the user triggering webpage includes at least one of the following manners: the webpage of the intermediate proxy node includes an input box, and when the user inputs the webpage address or information of the web server in the input box, the webpage is triggered, and the information may be an IP address or a domain name. Etc; the web page of the intermediate proxy node contains a hyperlink that is triggered when the user clicks on the hyperlink.
  • step 303 the intermediate proxy node sends the digital certificate of the intermediate proxy node to the user agent.
  • the redirect response includes the URL of the intermediate proxy node, or the redirect response includes the proxy URL
  • the proxy URL is obtained by the intermediate proxy node adding an agent indication to the indication information of the network server
  • the indication information is the webpage indication information, the webpage One of the object indication information of the object, the information obtained by converting the webpage indication information or the object indication information.
  • the redirect response needs to include the URL of the intermediate proxy node, so that the user proxy accesses the network server through the intermediate proxy node.
  • the redirect response may include only the URL of the intermediate proxy node, www.portal.com.
  • the redirect response includes not only the URL of the intermediate proxy node, but also the webpage indication information or the object indication information of the web server or the information obtained by converting one of the two kinds of information, and the webpage indication Information and object indication information can be obtained from the first access request.
  • the redirect response can include www.portal.com/view?
  • the intermediate proxy node further includes: after establishing an encrypted connection with the user proxy according to the first connection establishment request sent by the user proxy,
  • the intermediate proxy node receives the fifth ciphertext sent by the user agent, the fifth ciphertext is obtained by the user agent encrypting the second access request by using the first key, and the second access request is used for requesting access to the intermediate proxy node;
  • the intermediate proxy node decrypts the fifth ciphertext using the second key to obtain a second access request
  • the intermediate proxy node encrypts the webpage by using the second key to obtain the sixth ciphertext
  • the intermediate proxy node sends the sixth ciphertext to the user agent, so that the user agent decrypts the sixth ciphertext by using the first key, and obtains a webpage, where the webpage is used to trigger the user agent to send the first ciphertext.
  • the second access request may specifically request access to an object in the home page of the intermediate agent node or the intermediate agent node.
  • the user proxy further needs to obtain the webpage of the intermediate proxy node according to the URL of the intermediate proxy node, so that the user triggers the webpage after receiving the webpage, and the user agent sends the first webpage according to the trigger.
  • Connection establishment request and establishment with the intermediate proxy node The first ciphertext is sent after the secret connection.
  • the intermediate proxy node may directly obtain the webpage of the intermediate proxy node; or the intermediate proxy node may send the second access request to the service processing system, after receiving the second access request processed by the service processing system, Obtaining a webpage of the intermediate proxy node; or, the intermediate proxy node may detect whether the second access request needs to be sent to the service processing system for processing, and when detecting that the business processing system is not required to be processed, acquiring the webpage of the intermediate proxy node, when detecting When the service processing system is required to process, the second access request is sent to the service processing system, and after receiving the second access request processed by the service processing system, the webpage of the intermediate proxy node is obtained.
  • the intermediate proxy node may detect whether the URL included in the second access request is its own web address, and if the second access request includes the web address included in the second access request, if it detects that the second access request needs to be sent to the service processing system for processing.
  • the URL determines that the second access request is not required to be sent to the service processing system for processing. If it is detected that the URL included in the second access request is not its own URL, it is determined that the second access request needs to be sent to the service processing system for processing. .
  • the intermediate proxy node can also detect whether the second access request needs to be sent to the service processing system for processing, which is not limited in this embodiment.
  • Step 202 The intermediate proxy node decrypts the first ciphertext by using the second key to obtain service information.
  • the intermediate proxy node determines the second key corresponding to the first key, and decrypts the first ciphertext by using the second key to obtain service information.
  • Step 203 The intermediate proxy node sends the service information to the service processing system, so that the service processing system processes the service information according to the value-added service, and triggers a process of sending the processed service information to the network server.
  • the service processing system may determine the user agent according to the service information, determine the value-added service customized by the user agent, and process the service information according to the value-added service. Specifically, the service processing system may determine a service chain that implements the value-added service, and send the service information to a service processing unit in the service chain, where each service processing unit in the service chain processes the service information in turn, and then processes the processed information. The service information is sent to the web server.
  • the redirect response includes information obtained by converting the webpage indication information or the object indication information
  • the received service information includes the information
  • the intermediate proxy node may convert the information into a corresponding webpage.
  • the indication information or the object indication information is sent to the business processing system.
  • Step 204 The intermediate proxy node receives the processed service information sent by the service processing system.
  • Step 205 The intermediate proxy node establishes an encrypted connection with the network server, and stipulates the third key and the fourth key.
  • the intermediate proxy node parses the web address of the web server from the processed service information, and establishes an encrypted connection with the web server indicated by the webpage, and The third key and the fourth key are agreed upon.
  • the process of establishing an encrypted connection between the intermediate proxy node and the network server is similar to the process of establishing an encrypted connection between the intermediate proxy node and the user agent, and is not described here.
  • the service information includes the object indication information or the information obtained by converting the object indication information
  • the intermediate proxy node when the intermediate proxy node has acquired the webpage of the network server, that is, the intermediate proxy node has established with the network server.
  • the intermediate proxy node parses out the processed service information.
  • the web server's web address establishes an encrypted connection with the web server indicated by the web address, and stipulates the third key and the fourth key, which are not described here.
  • Step 206 The intermediate proxy node encrypts the service information by using the third key to obtain the second ciphertext.
  • the service information in this step may be service information in which the URL of the intermediate proxy node is removed. That is, the service information at this time includes only the network server indication information, or the service information includes only the object indication information.
  • Step 207 The intermediate proxy node sends the second ciphertext to the network server, so that the network server decrypts the second ciphertext by using the fourth key to obtain service information.
  • Step 208 The intermediate proxy node receives the third ciphertext sent by the network server, and the third ciphertext is obtained by the network server encrypting the service data by using the fourth key.
  • the network server obtains corresponding service data according to the service information, and encrypts the service data by using the fourth key to obtain a third ciphertext, and sends the third ciphertext to the intermediate proxy node.
  • the service data may be the home page of the web server; when the service information includes www.ottserver.com/picture1.gif, the service data may be picture 1.
  • Step 209 The intermediate proxy node decrypts the third ciphertext by using the third key to obtain service data.
  • Step 210 The intermediate proxy node sends the service data to the service processing system, so that the service processing system processes the service data according to the value-added service, and sends the processed service data to the intermediate proxy node.
  • the service processing system may receive the picture 1
  • the resolution of slice 1 is converted from the original 640*480 to 320*240, and the converted picture 1 is sent to the intermediate proxy node.
  • Step 211 The intermediate proxy node encrypts the processed service data by using the second key to obtain a fourth ciphertext.
  • the webpage may further include object indication information
  • the intermediate proxy node further needs to add an agent indication to the object indication information.
  • the web page includes the URI of picture 1
  • Step 212 The intermediate proxy node sends the fourth ciphertext to the user agent, so that the user agent decrypts the fourth ciphertext using the first key to obtain service data.
  • the service processing method receives the first ciphertext sent by the user agent, decrypts the first ciphertext by using the second key, and obtains the service information, and sends the service information to the service processing system.
  • the service processing system In order for the service processing system to process the service information according to the value-added service, and trigger the process of sending the processed service information to the network server, the first ciphertext transmitted by the proxy node may be used when the user agent uses the SSL/TLS protocol.
  • the decryption is performed, and the decrypted service information is sent to the service processing system, which solves the problem that the service processing system cannot decrypt the ciphertext, and the service processing system cannot provide value-added services for the user agent using the SSL/TLS protocol, thereby achieving the expansion of the value-added service.
  • the redirect response includes a proxy web address
  • the proxy web address is obtained by the intermediate proxy node adding an agent indication to the indication information of the web server, where the indication information is webpage indication information, object indication information of the object in the webpage, and the webpage indication information or the object indication information.
  • One of the information obtained after the conversion may directly send the webpage indication information or the object indication information or the information obtained by converting one of the two kinds of information to the user agent, without first obtaining the webpage of the intermediate proxy node.
  • the operation flow can be simplified, and the efficiency of the business processing is improved.
  • FIG. 4A shows that the intermediate proxy node is the portal, the user agent is the UA, the network server is the OTT server, and the service processing.
  • the system is GI-LAN, and the requests referred to in FIG. 4A are both HTTP requests and HTTP requests are GET requests as an example.
  • step 401 a TCP connection (port 80) is established between the UA and the Portal.
  • step 402 When the first connection establishment request is sent by the intermediate proxy node to indicate the user agent, step 402 is performed; when the first connection establishment request is triggered by the user to send the user agent, step 404 is performed.
  • Step 402 The Portal intercepts the GET request sent by the UA to the OTT server, where the GET request includes www.ottserver.com. Wherein, the GET request is the first access request.
  • Step 403 The Portal sends a redirect response to the UA and/or type information that needs to be accessed through the HTTPS protocol.
  • the HTTPS protocol is the lower layer HTTP protocol using the SSL/TLS protocol.
  • Step 404 If the portal needs to be accessed through the HTTPS protocol, the UA re-establishes a TCP connection with the Portal (port 443).
  • Step 405 a TLS handshake process between the UA and the Portal.
  • step 406 the UA sends an encrypted GET request to the Portal, and the GET request includes www.portal.com. Wherein, the GET request is a second access request.
  • step 407 the Portal decrypts the GET request and sends it to the GI-LAN. After the GI-LAN processes it, it returns to the Portal.
  • step 408 the Portal replies to the UA with an encrypted 200 ok response and returns to the webpage of www.portal.com.
  • step 410 the Portal decrypts the GET request and sends it to the GI-LAN. After the GI-LAN processes it, it returns to the Portal.
  • step 411 the Portal parses out the processed GET request from www.ottserver.com.
  • a TCP connection (port 443) is established between the Portal and the OTT Server.
  • Step 413 A TLS handshake process between the Portal and the OTT Server.
  • step 414 the Portal sends an encrypted GET request to the OTT Server, and the GET request includes www.ottserver.com.
  • step 415 the OTT Server returns an encrypted 200ok response to the Portal and returns to the webpage of www.ottserver.com.
  • step 416 the Portal decrypts the 200 ok response and sends it to the GI-LAN. After the GI-LAN processes, it returns to the Portal.
  • step 418 the Portal sends an encrypted 200ok response to the UA.
  • step 420 the Portal decrypts the GET request and sends it to the GI-LAN. After the GI-LAN processes it, it returns to the Portal.
  • step 421 the Portal parses out the processed GET request from www.ottserver.com/picture1.gif.
  • the Portal sends an encrypted GET request to the OTT server, and the GET request includes www.ottserver.com/picture1.gif.
  • step 423 the OTT server responds with a 200 ok response to the Portal encryption, and returns a picture 1.
  • step 424 the Portal decrypts the 200 ok response and sends it to the GI-LAN. After the GI-LAN process, it returns to the Portal.
  • step 425 the Portal adds a portal indication of www.portal.com to the processed 200 ok response.
  • step 426 the Portal sends an encrypted 200ok response to the UA.
  • FIG. 4B shows that the intermediate proxy node is the portal, the user agent is the UA, the network server is the OTT server, and the service processing system is the GI-LAN.
  • Step 401' the Portal intercepts the TCP connection request sent by the UA to the OTT server, and replaces the OTT Server with the UA to establish a TCP connection (port 443) according to the information in the TCP connection request.
  • Step 402' the Portal uses a TLS handshake process between the digital certificate corresponding to the OTT server and the UA.
  • the Portal intercepts the encrypted GET request sent by the UA to the OTT server, and the GET request includes www.ottserver.com. Wherein, the GET request is the first access request.
  • Step 404' the Portal sends the encrypted redirect response to the UA and/or the encrypted type information that needs to be accessed through the HTTPS protocol.
  • the HTTPS protocol is the lower layer HTTP protocol using the SSL/TLS protocol.
  • Step 405' a TCP connection (443 port) is established between the UA and the Portal. After the TCP connection is established, the UA and the Portal perform a TLS handshake process. At this point, Portal uses its own digital certificate.
  • steps 406' to 427' are the same as those of steps 405 to 426, and are not described herein.
  • the proxy node is an intermediate proxy node, the user proxy, and the intermediate proxy node establish an unencrypted connection, and the intermediate proxy node and the network server establish an encrypted connection as an example.
  • the service processing method may include:
  • Step 501 The intermediate proxy node receives the service information sent by the user agent.
  • the intermediate proxy node may be a Portal.
  • the intermediate proxy node may also be other sites, which is not limited in this embodiment. Please refer to the description of the service information in step 201, which is not described here.
  • This embodiment provides two methods for triggering a proxy node to send service information, as follows:
  • the intermediate proxy node intercepts the first access request sent by the user agent to the network server, instructing the user agent to send the second access request, and the intermediate proxy node acquires the webpage of the intermediate proxy node according to the second access request, and the webpage is Sending to the user agent, the webpage is used to trigger the user agent to send the service information, the first access request is used to request access to the network server, the second access request is used to request access to the intermediate proxy node, and the redirect response includes the URL of the intermediate proxy node.
  • the intermediate proxy node may directly obtain the webpage of the intermediate proxy node; or the intermediate proxy node may send the second access request to the service processing system, after receiving the second access request processed by the service processing system, Obtaining a webpage of the intermediate proxy node; or, the intermediate proxy node may detect whether the second access request needs to be sent to the service processing system for processing, and when detecting that the business processing system is not required to be processed, acquiring the webpage of the intermediate proxy node, when detecting When the service processing system is required to process, the second access request is sent to the service processing system, and after receiving the second access request processed by the service processing system, the webpage of the intermediate proxy node is obtained.
  • the process of detecting whether the second access request needs to be sent to the service processing system for processing refer to the description in step 201, which is not described here.
  • the intermediate proxy node intercepts the first access request sent by the user agent to the network server, instructing the user agent to send the service information, the first access request is used to request access to the network server, and the redirect response includes the proxy URL, the proxy The URL is obtained by the intermediate proxy node adding an agent indication to the indication information of the network server, and the indication information is one of the webpage indication information, the object indication information of the object in the webpage, and the information obtained by converting the webpage indication information or the object indication information.
  • the port of the TCP connection established by the intermediate proxy node and the user agent is port 80 or port 443.
  • the method provided in this embodiment further includes: the intermediate agent node intercepts the TCP connection request sent by the user agent to the network server; and the intermediate agent node reads the TCP connection.
  • the information in the request replaces the network server to establish a TCP connection with the user agent.
  • the encrypted proxy connection is established with the user agent by using the pre-stored digital certificate corresponding to the network server; the intermediate proxy node is connected through the encryption proxy. Instruct the user agent to send a second access request.
  • the process of establishing an cryptographic proxy connection between the intermediate proxy node and the user agent refer to the description in step 201, which is not described here.
  • the encrypted proxy connection is established with the user agent by using the pre-stored digital certificate corresponding to the network server, and the intermediate proxy node sends the first digital certificate to the user agent, where the first digital certificate is issued by the certificate authority and is connected to the network server.
  • the second digital certificate of the certificate authority is pre-configured in the user agent or the operating system of the terminal in which the user agent is installed, so that the user agent verifies the first digital certificate according to the second digital certificate, after the verification is passed And establishing an encrypted proxy connection with the intermediate proxy node; or, the intermediate proxy node sends a third digital certificate and a fourth digital certificate to the user agent, where the third digital certificate is a digital certificate issued by an unauthorized certificate authority and corresponding to the network server,
  • the four-digit certificate is a digital certificate of the non-authorized certificate authority, so that the user agent verifies the third digital certificate according to the fourth digital certificate, and establishes an encrypted proxy connection with the intermediate agent node after the verification is passed.
  • the intermediate proxy node may instruct the user agent to send the second access request or service information by using the redirect response.
  • the location header field of the redirect response may include type information, where the type information is used to indicate a connection type that the user agent requests to establish.
  • the HTTP is carried in the type information as an example. In this case, the user agent does not need to establish an encrypted connection with the intermediate proxy node.
  • the webpage of the intermediate proxy node may be stored in the user agent as a homepage, a bookmark, a configuration information, or the like, or an application, a service, etc. customized for the intermediate proxy node are installed in the user proxy, and the user may directly access the user agent.
  • the management node sends service information.
  • the user triggering webpage includes at least one of the following manners: the webpage of the intermediate proxy node includes an input box, and when the user inputs the webpage address or information of the web server in the input box, the webpage is triggered, and the information may be an IP address or a domain name. Etc; the web page of the intermediate proxy node contains a hyperlink that is triggered when the user clicks on the hyperlink.
  • Step 502 The intermediate proxy node sends the service information to the service processing system, so that the service processing system processes the service information according to the value-added service, and triggers a process of sending the processed service information to the network server.
  • the service processing system may determine the user agent according to the service information, determine the value-added service customized by the user agent, and process the service information according to the value-added service. Specifically, the service processing system may determine a service chain that implements the value-added service, and send the service information to a service processing unit in the service chain, where each service processing unit in the service chain processes the service information in turn, and then processes the processed information. The service information is sent to the web server.
  • Step 503 The intermediate proxy node receives the processed service information sent by the service processing system.
  • the intermediate agent node After the intermediate agent node receives the service information, the intermediate agent node needs to establish a network connection with the network server to transmit the service information.
  • the intermediate proxy node may establish an encrypted connection with the network server.
  • step 504 is performed; the intermediate proxy node may also establish a non-encrypted connection with the network server, and the intermediate proxy node directly sends the service information to the network server, and the receiving network server sends the information.
  • step 509 go to step 509.
  • Step 504 The intermediate proxy node establishes an encrypted connection with the network server, and stipulates the third key and the fourth key.
  • the intermediate proxy node parses the web address of the web server from the processed service information, and establishes an encrypted connection with the web server indicated by the webpage, and The third key and the fourth key are agreed upon.
  • the service information includes the object indication information or the information obtained by converting the object indication information
  • the intermediate proxy node when the intermediate proxy node has acquired the webpage of the network server, that is, the intermediate proxy node has established with the network server.
  • the intermediate proxy node parses out the processed service information.
  • the web server's web address establishes an encrypted connection with the web server indicated by the web address, and stipulates the third key and the fourth key, which are not described here.
  • Step 505 The intermediate proxy node encrypts the service information by using the third key to obtain the second ciphertext.
  • the service information in this step may be that the website service information of the intermediate proxy node is removed. That is, the service information at this time includes only the network server indication information, or the service information includes only the object indication information.
  • Step 506 The intermediate proxy node sends the second ciphertext to the network server, so that the network server decrypts the second ciphertext by using the fourth key to obtain service information.
  • Step 507 The intermediate proxy node receives the third ciphertext sent by the network server, and the third ciphertext is obtained by the network server encrypting the service data by using the fourth key.
  • the network server obtains corresponding service data according to the service information, and encrypts the service data by using the fourth key to obtain a third ciphertext, and sends the third ciphertext to the intermediate proxy node.
  • the service data may be the home page of the web server; when the service information includes www.ottserver.com/picture1.gif, the service data may be picture 1.
  • Step 508 The intermediate proxy node decrypts the third ciphertext by using the third key to obtain service data.
  • Step 509 The intermediate proxy node sends the service data to the service processing system, so that the service processing system processes the service data according to the value-added service, and sends the processed service data to the intermediate proxy node.
  • the service processing system may convert the resolution of the picture 1 from the original 640*480 to 320*240 after receiving the picture 1, and then send the converted picture 1 to the intermediate proxy node. .
  • Step 510 The intermediate proxy node sends the processed service data to the user agent.
  • the webpage may further include object indication information
  • the intermediate proxy node further needs to add an agent indication to the object indication information.
  • the web page includes the URI of picture 1
  • the redirect response includes a proxy URL
  • the proxy URL is obtained by the intermediate proxy node adding an agent indication to the indication information of the network server, where the indication information is the webpage indication information, and the object in the webpage.
  • One of the object indication information, the information obtained by converting the webpage indication information or the object indication information may directly send the webpage indication information or the object indication information to the user agent or convert one of the two kinds of information to obtain
  • the information can be simplified without first obtaining the webpage of the intermediate proxy node, and then triggering the webpage of the intermediate proxy node to obtain the webpage indication information or the object indication information or the information obtained by converting one of the above two kinds of information, which can simplify the operation. Processes improve the efficiency of business processing.
  • the flow of the service processing method is described below by taking the proxy node as an intermediate proxy node, the user agent and the intermediate proxy node establishing an unencrypted connection, and the intermediate proxy node and the network server establishing an encrypted connection as an example.
  • FIG. 6A shows that the intermediate proxy node is the portal, the user agent is the UA, the network server is the OTT server, and the service processing system is the GI-LAN, which is related to FIG. 6A.
  • the requests are all HTTP requests and the HTTP request is a GET request as an example.
  • step 601 a TCP connection (port 80) is established between the UA and the Portal.
  • Step 602 The Portal intercepts the GET request sent by the UA to the OTT server, where the GET request includes www.ottserver.com. Wherein, the GET request is the first access request.
  • the Portal sends a redirect response to the UA and/or type information that needs to be accessed through the HTTPS protocol.
  • the HTTPS protocol is the lower layer HTTP protocol using the SSL/TLS protocol.
  • step 604 the UA sends a GET request to the Portal, and the GET request includes www.portal.com. Wherein, the GET request is a second access request.
  • step 605 the Portal sends the GET request to the GI-LAN, and the GI-LAN processes and returns to the Portal.
  • step 606 the Portal replies with a 200ok response to the UA and returns to the webpage of www.portal.com.
  • step 608 the Portal sends the GET request to the GI-LAN, and the GI-LAN processes and returns to the Portal.
  • step 609 the Portal parses out the processed GET request from www.ottserver.com.
  • a TCP connection (port 443) is established between the Portal and the OTT Server.
  • Step 611 a TLS handshake process between the Portal and the OTT server.
  • step 612 the Portal sends an encrypted GET request to the OTT Server, and the GET request includes www.ottserver.com.
  • step 613 the OTT Server returns an encrypted 200ok response to the Portal and returns to the webpage of www.ottserver.com.
  • Step 614 the Portal decrypts the 200ok response and sends it to the GI-LAN, and the GI-LAN processes and then returns. Return to the Portal.
  • step 616 the Portal sends a 200ok response to the UA.
  • step 618 the Portal sends the GET request to the GI-LAN, and the GI-LAN processes and returns to the Portal.
  • step 619 the Portal parses the processed GET request from www.ottserver.com/picture1.gif.
  • step 620 the Portal sends an encrypted GET request to the OTT server, and the GET request includes www.ottserver.com/picture1.gif.
  • step 621 the OTT server returns an encrypted 200ok response to the Portal, and returns a picture 1.
  • step 622 the Portal decrypts the 200 ok response and sends it to the GI-LAN. After the GI-LAN processes, it returns to the Portal.
  • step 623 the Portal adds a portal indication of www.portal.com to the processed 200 ok response.
  • step 624 the Portal sends a 200ok response to the UA.
  • FIG. 6B shows that the intermediate proxy node is the portal, the user agent is the UA, the network server is the OTT server, and the service processing system is the GI-LAN.
  • step 601 the portal intercepts the TCP connection request sent by the UA to the OTT server, and replaces the OTT server with the UA to establish a TCP connection (port 443) according to the information in the TCP connection request.
  • Step 602' the Portal uses a TLS handshake process between the digital certificate corresponding to the OTT server and the UA.
  • the Portal intercepts the encrypted GET request sent by the UA to the OTT server, and the GET request includes www.ottserver.com. Wherein, the GET request is the first access request.
  • Step 604' the Portal sends the encrypted redirect response to the UA and/or the encrypted type information that needs to be accessed through the HTTPS protocol.
  • the HTTPS protocol is the lower layer HTTP protocol using the SSL/TLS protocol.
  • step 605' a TCP connection (port 80) is established between the UA and the Portal.
  • steps 606' to 626' are the same as those of steps 604 to 624, and are not described herein.
  • the proxy node is a front-end proxy node located between the user agent and the intermediate proxy node.
  • the service processing method may include:
  • Step 701 The front-end proxy node receives the first ciphertext sent by the user agent, and the first ciphertext is obtained by the user agent encrypting the service information by using the first key.
  • the front-end proxy node is a proxy node located between the user agent and the intermediate proxy node.
  • the front-end proxy node may be located between the user agent and the service processing system, and the service processing system is located between the front-end proxy node and the intermediate proxy node.
  • the intermediate proxy node may be a Portal.
  • the intermediate proxy node may also be other sites, which is not limited in this embodiment.
  • the encrypted connection can be a connection based on the SSL/TLS protocol. Since the establishment process of the SSL-based encrypted connection and the TLS-based encrypted connection is similar, the following describes an encrypted connection based on the TLS protocol as an example.
  • the method further includes:
  • the front-end proxy node intercepts a second connection establishment request sent by the user agent to the intermediate proxy node, and the second connection establishment request includes a destination IP address of the intermediate proxy node;
  • the front-end proxy node establishes an encrypted connection with the user agent according to the destination IP address and the node information of the pre-stored intermediate proxy node.
  • the user agent needs to establish a port with the intermediate proxy node. For details on how to establish a TCP connection on a port or port 443, see the description in step 201.
  • the second connection establishment request is sent by the intermediate proxy node after intercepting the first access request sent by the user agent to the network server, and the first access request is used to request access to the network server, or the second connection is established.
  • the request is sent by the user agent after receiving the trigger signal triggered by the user, and the trigger signal is generated after the user triggers the webpage of the intermediate proxy node pre-stored in the user agent.
  • the intermediate proxy node intercepts the first access request sent by the user agent to the network server, instructing the user agent to send a second connection establishment request, and the front-end proxy node intercepts the user agent to send to the intermediate proxy node.
  • the second connection establishment request After the user agent establishes a TCP connection with the intermediate proxy node, the intermediate proxy node intercepts the first access request sent by the user agent to the network server, instructing the user agent to send a second connection establishment request, and the front-end proxy node intercepts the user agent to send to the intermediate proxy node.
  • the second connection establishment request is the first access request sent by the user agent to the network server, instructing the user agent to send a second connection establishment request, and the front-end proxy node intercepts the user agent to send to the intermediate proxy node.
  • the second connection establishment request needs to carry the destination IP address of the destination of the second connection establishment request
  • the second connection establishment request includes the destination IP address of the intermediate proxy node
  • the front-end proxy node may be configured from the second connection establishment request. Obtaining the destination IP address, and then establishing an encrypted connection with the user agent by using the destination IP address and the node information of the pre-stored intermediate proxy node.
  • the front-end proxy node uses the information of the intermediate proxy node to establish an encrypted connection with the user agent, the user agent cannot perceive the existence of the front-end proxy node.
  • the second connection establishment request is that the intermediate agent node intercepts the first access request sent by the user agent to the network server through the encrypted proxy connection
  • the encrypted proxy connection sent by the user agent is that the intermediate proxy node intercepts the TCP connection request sent by the user agent to the network server, reads the information in the TCP connection request, and replaces the network server with the user agent to establish a TCP connection according to the information, and establishes a TCP connection in the TCP connection.
  • the pre-stored digital certificate corresponding to the network server is established with the user agent.
  • the webpage of the intermediate proxy node may be stored in the user agent as a homepage, a bookmark, configuration information, or the like, or the user agent is installed in the user agent.
  • the user can retrieve and trigger the web page directly from the user agent.
  • the webpage of the intermediate proxy node includes an input box.
  • the webpage is triggered, and the information may be an IP address or a domain name; the webpage of the intermediate proxy node includes a hyperlink, when The page is triggered when the user clicks on the hyperlink.
  • the front-end proxy node establishes an encrypted connection with the user agent according to the destination IP address and the node information of the pre-stored intermediate proxy node, including:
  • the node information includes a digital certificate and a private key
  • the front-end proxy node sends the digital certificate to the user agent, receives the encrypted information sent by the user agent according to the public key carried by the digital certificate, and decrypts the encrypted information by using the private key to obtain the pre-master key. And establish an encrypted connection with the user agent using the destination IP address; or,
  • the node information includes a digital certificate
  • the front-end proxy node sends the digital certificate to the user agent, receives the encrypted information sent by the user agent according to the public key carried by the digital certificate, sends the encrypted information to the intermediate agent node, and receives the intermediate agent node to use the private key.
  • a pre-master key sent after decrypting the encrypted information, and establishing an encrypted connection with the user agent using the destination IP address;
  • the pre-master key is used to generate the first key and the second key.
  • the node information includes at least a digital certificate and a private key
  • the specific establishment process is detailed in the process shown in FIG. 3.
  • the TLS protocol version number, the encryption algorithm, and the second random number in step 303 are generated by the front-end proxy node.
  • the digital certificate in step 304 is a digital certificate of the intermediate proxy node.
  • the front-end proxy node decrypts the public key exchange information using the private key of the intermediate proxy node to generate a second key.
  • the node information includes at least a digital certificate
  • the specific establishment process is detailed in the process shown in FIG. 3.
  • the TLS protocol version number, the encryption algorithm, and the second random number in step 303 are generated by the front-end proxy node.
  • the digital certificate in step 304 is a digital certificate of the intermediate proxy node.
  • the front-end proxy node sends the public key exchange information to the intermediate proxy node, and the intermediate proxy node decrypts the public key exchange information by using the private key to obtain the pre-master key, and sends the pre-master key to the front-end proxy node, and the front-end proxy node according to
  • the first random number, the second random number, the pre-master key, and the encryption algorithm generate a second key.
  • the front-end proxy node can obtain the digital certificate and the key from the third-party or intermediate proxy node. This embodiment does not limit the manner of obtaining.
  • the redirect response when the second connection establishment request is that the intermediate proxy node intercepts the first access request, when the redirect response indicates that the user agent sends the redirect response, the redirect response includes the URL of the intermediate proxy node; or the redirect response includes the proxy
  • the website URL is obtained by the intermediate agent node adding an agent indication to the indication information of the network server, and the indication information is in the information of the webpage indication information, the object indication information of the object in the webpage, and the information obtained by converting the webpage indication information or the object indication information.
  • the location header field of the redirect response may include type information, where the type information is used to indicate the connection type that the user agent requests to establish.
  • the HTTPS is carried in the type information as an example, and the second connection establishment request is used. Used to request to establish an encrypted connection, and the port for encrypted connection is port 443.
  • the front-end proxy node when the redirecting response includes the URL of the intermediate proxy node, the front-end proxy node, after establishing an encrypted connection with the user agent according to the destination IP address and the node information of the pre-stored intermediate proxy node, further includes:
  • the front-end proxy node receives the fifth ciphertext sent by the user agent, the fifth ciphertext is obtained by the user agent encrypting the second access request by using the first key, and the second access request is used for requesting access to the intermediate proxy node;
  • the front-end proxy node decrypts the fifth ciphertext using the second key to obtain a second access request
  • the front-end proxy node sends the second access request to the service processing system, so that the service processing system processes the second access request according to the value-added service, and sends the processed second access request to the intermediate proxy node;
  • the front-end proxy node encrypts the webpage sent by the service processing system by using the second key to obtain the sixth ciphertext, and the webpage is sent by the intermediate proxy node to the service processing system;
  • the front-end proxy node sends the sixth ciphertext to the user agent, so that the user agent decrypts the sixth ciphertext by using the first key, and obtains a webpage, where the webpage is used to trigger the user agent to send the first ciphertext.
  • the user proxy further needs to obtain the webpage of the intermediate proxy node according to the URL of the intermediate proxy node, so that the user triggers the webpage after receiving the webpage, and the user agent sends the second webpage according to the trigger.
  • the connection establishment request is sent and the first ciphertext is sent after establishing an encrypted connection with the front-end proxy node.
  • the front-end proxy node may directly send the second access request to the service processing system for processing; or the front-end proxy node may detect whether the second access request needs to be sent to the service processing system for processing, when it is detected that it is unnecessary When the service processing system processes, the second access request is sent to the intermediate proxy node, and when it is detected that the service processing system is required to be processed, the second access request is sent to the service processing system.
  • the front-end proxy node detects whether the URL included in the second access request is the URL of the intermediate proxy node, and detects the URL included in the second access request, when detecting whether the second access request needs to be sent to the service processing system for processing. If it is the URL of the intermediate proxy node, it is determined that the second access request does not need to be sent to the service processing system for processing. If it is detected that the URL included in the second access request is not the URL of the intermediate proxy node, it is determined that the second access request needs to be sent. Process the business processing system. Of course, the front-end proxy node can also detect whether the second access request needs to be sent to the service processing system for processing, which is not limited in this embodiment.
  • the service processing system may send the processed second access request to the intermediate proxy node, the intermediate proxy node obtains its own webpage, and sends the webpage to the service processing system, and the service processing system further follows the value-added service to the intermediate proxy node.
  • the web page is processed, and the processed web page is sent to the front-end proxy node.
  • the service processing system processes the second access request and the webpage of the intermediate proxy node The process is similar to the process of processing the service information in the service processing system in step 203, and details are not described herein.
  • Step 702 The front-end proxy node decrypts the first ciphertext by using the second key to obtain service information.
  • the front-end proxy node determines the second key corresponding to the first key, and decrypts the first ciphertext by using the second key to obtain service information.
  • Step 703 The front-end proxy node sends the service information to the service processing system, so that the service processing system processes the service information according to the value-added service, and triggers a process of sending the processed service information to the network server.
  • the service processing system may determine the user agent according to the service information, determine the value-added service customized by the user agent, and process the service information according to the value-added service. Specifically, the service processing system may determine a service chain that implements the value-added service, and send the service information to a service processing unit in the service chain, where each service processing unit in the service chain processes the service information in turn, and then processes the processed information. The service information is sent to the intermediate agent node.
  • the intermediate proxy node parses the web address of the web server from the processed service information, and establishes an encrypted connection with the web server indicated by the webpage, and The third key and the fourth key are agreed upon, and after the service information is encrypted by using the third key, the encrypted service information is sent to the network server.
  • the process of establishing an encrypted connection between the intermediate proxy node and the network server is similar to the process of establishing an encrypted connection between the intermediate proxy node and the user agent, and is not described here.
  • the intermediate proxy node when the service information includes the object indication information or the information obtained by converting the object indication information, in the first implementation manner, when the intermediate proxy node has acquired the webpage of the network server, that is, the intermediate proxy node has established with the network server.
  • the encrypted connection at this time, the intermediate proxy node can directly encrypt the service information by using the third key, and send the obtained second ciphertext to the network server; in the second implementation manner, when the intermediate proxy node does not acquire the network server
  • the home agent node resolves the web address of the web server from the processed service information, establishes an encrypted connection with the web server indicated by the web address, and stipulates the third key and the fourth key, which are not described here.
  • the service information encrypted by the intermediate proxy node may be the service information of the website address of the intermediate proxy node. That is, the service information at this time includes only the network server indication information, or the service information includes only the object indication information.
  • Step 704 The front-end proxy node receives the service data sent by the service processing system.
  • the network server decrypts the second ciphertext by using the fourth key, obtains the service information, obtains the corresponding service data according to the service information, and encrypts the service data by using the fourth key to obtain the third ciphertext, and the third
  • the ciphertext is sent to the intermediate proxy node.
  • the service data may be the home page of the web server; when the service information includes www.ottserver.com/picture1.gif, the service data may be picture 1.
  • the intermediate proxy node uses the third key to decrypt the third ciphertext, obtains the service data, and sends the service data to the service processing system for processing, and the service processing system sends the processed service data to the front-end proxy node.
  • the service processing system may convert the resolution of the picture 1 from the original 640*480 to 320*240 after receiving the picture 1, and then send the converted picture 1 to the intermediate proxy node. .
  • the webpage may further include object indication information, and the intermediate proxy node further needs to add an agent indication to the object indication information.
  • Step 705 The front-end proxy node encrypts the service data by using the second key to obtain the seventh ciphertext.
  • Step 706 The front-end proxy node sends the seventh ciphertext to the user agent, so that the user agent decrypts the seventh ciphertext by using the first key to obtain service data.
  • the service processing method receives the first ciphertext sent by the user agent, decrypts the first ciphertext by using the second key, and obtains the service information, and sends the service information to the service processing system.
  • the service processing system In order for the service processing system to process the service information according to the value-added service, and trigger the process of sending the processed service information to the network server, the first ciphertext transmitted by the proxy node may be used when the user agent uses the SSL/TLS protocol.
  • the decryption is performed, and the decrypted service information is sent to the service processing system, which solves the problem that the service processing system cannot decrypt the ciphertext, and the service processing system cannot provide value-added services for the user agent using the SSL/TLS protocol, thereby achieving the expansion of the value-added service.
  • the redirect response includes a proxy web address
  • the proxy web address is obtained by the intermediate proxy node adding an agent indication to the indication information of the web server, where the indication information is webpage indication information, object indication information of the object in the webpage, and the webpage indication information or the object indication information.
  • One of the information obtained after the conversion may directly send the webpage indication information or the object indication information or the information obtained by converting one of the two kinds of information to the user agent, without first obtaining the webpage of the intermediate proxy node.
  • the operation flow can be simplified, and the efficiency of the business processing is improved.
  • FIG. 8A shows that the intermediate proxy node is the portal, the user agent is the UA, the front-end proxy node is the Proxy, the network server is the OTT server, and the service processing system is the GI- The LAN, the request involved in FIG. 8A are all HTTP requests and the HTTP request is a GET request as an example.
  • step 801 a TCP connection (port 80) is established between the UA and the Portal.
  • step 802 when the second connection establishment request is sent by the intermediate proxy node to the user agent, step 802 is performed; when the second connection establishment request is triggered by the user to send the user agent, step 804 is performed.
  • the Portal intercepts the GET request sent by the UA to the OTT server, and the GET request includes www.ottserver.com. Wherein, the GET request is the first access request.
  • the Portal sends a redirect response to the UA and/or type information that needs to be accessed through the HTTPS protocol.
  • the HTTPS protocol is the lower layer HTTP protocol using the SSL/TLS protocol.
  • Step 804 If the portal needs to be accessed through the HTTPS protocol, the Proxy intercepts the TCP connection between the UA and the Portal, and establishes a TCP connection (443 port) with the UA by using the destination IP address of the Portal.
  • step 805 a TCP connection (port 80) is established between the Proxy and the Portal.
  • Step 806 a TLS handshake process between the UA and the Proxy.
  • the Proxy obtains the digital certificate and the private key of the Portal in advance, and the Proxy decrypts the public key exchange information according to the private key to obtain the pre-master key.
  • the Proxy obtains the digital certificate of the Portal in advance, the private key is not obtained, and the step 806 includes Step 806', step 806' is to send the public key exchange information to the portal by the Proxy, and the Portal uses the private key to decrypt the public key exchange information, and then sends the pre-master key to the Proxy.
  • step 807 the UA sends an encrypted GET request to the Proxy, and the GET request includes www.portal.com. Wherein, the GET request is a second access request.
  • step 808 the Proxy decrypts the GET request and sends it to the GI-LAN.
  • step 809 the GI-LAN sends the processed GET request to the Portal.
  • step 810 the Portal replies to the GI-LAN with an encrypted 200ok response and returns to the webpage of www.portal.com.
  • step 811 the GI-LAN replies to the Proxy with an encrypted 200 ok response and returns to the web page of www.portal.com.
  • step 812 the Proxy returns an encrypted 200ok response to the UA and returns to the webpage of www.portal.com.
  • step 814 the Proxy decrypts the GET request and sends it to the GI-LAN.
  • step 815 the GI-LAN sends the processed GET request to the Portal.
  • step 816 the Portal parses out the processed GET request from www.ottserver.com.
  • a TCP connection (port 443) is established between the Portal and the OTT server.
  • Step 818 the TLS handshake process between the Portal and the OTT Server.
  • step 819 the Portal sends an encrypted GET request to the OTT server, and the GET request includes www.ottserver.com.
  • step 820 the OTT Server returns an encrypted 200ok response to the Portal and returns to the webpage of www.ottserver.com.
  • step 822 the GI-LAN sends the processed 200 ok response to the Proxy.
  • step 823 the Proxy sends an encrypted 200ok response to the UA.
  • step 825 the Proxy decrypts the GET request and sends it to the GI-LAN.
  • step 826 the GI-LAN sends the processed GET request to the Portal.
  • step 827 the Portal parses the processed GET request from www.ottserver.com/picture1.gif.
  • step 828 the Portal sends an encrypted GET request to the OTT server, and the GET request includes www.ottserver.com/picture1.gif.
  • step 829 the OTT server responds with a 200 ok response to the Portal encryption, and returns a picture 1.
  • step 831 the GI-LAN sends the processed 200ok response to the Proxy.
  • step 832 the Portal sends an encrypted 200ok response to the UA.
  • FIG. 8B shows that the intermediate proxy node is the portal, the user agent is the UA, the front-end proxy node is the Proxy, the network server is the OTT server, and the service processing system is the GI- LAN.
  • the portal intercepts the TCP connection request sent by the UA to the OTT server, and replaces the OTT server with the UA to establish a TCP connection (port 443) according to the information in the TCP connection request.
  • Step 802' the Portal uses a TLS handshake process between the digital certificate corresponding to the OTT server and the UA.
  • the Portal intercepts the GET request sent by the UA to the OTT server, and the GET request includes www.ottserver.com. Wherein, the GET request is the first access request.
  • Step 804' the Portal sends the encrypted redirect response and/or the encrypted type information that needs to be accessed through the HTTPS protocol to the UA.
  • the HTTPS protocol is the lower layer HTTP protocol using the SSL/TLS protocol.
  • steps 805' to 833' are the same as those of steps 804 to 832, and are not described herein.
  • FIG. 9 is a schematic structural diagram of a service processing apparatus according to an embodiment of the present invention.
  • the service processing device may include:
  • the first receiving module 901 is configured to receive a first ciphertext sent by the user agent, where the first ciphertext is encrypted by the user agent by using the first key to encrypt the service information;
  • the first decryption module 902 is configured to decrypt the first ciphertext received by the first receiving module 901 by using the second key to obtain service information.
  • the first sending module 903 is configured to send the service information obtained by decrypting the first decrypting module 902 to the service processing system, so that the service processing system processes the service information according to the value-added service, and triggers sending the processed service information to The process of the web server;
  • the first key and the second key are keys agreed by the user agent and the proxy node when establishing an encrypted connection.
  • the service processing apparatus receives the first ciphertext sent by the user agent, decrypts the first ciphertext by using the second key, and obtains service information, and sends the service information to the service processing system.
  • the user agent may use SSL/TLS.
  • the first ciphertext transmitted by the proxy node is decrypted, and the decrypted service information is sent to the service processing system, which solves the problem that the service processing system cannot decrypt the ciphertext, and the service processing system cannot use the SSL/TLS protocol.
  • the user agent provides value-added services and achieves the effect of expanding the use of value-added services.
  • FIG. 10 is a schematic structural diagram of still another service processing apparatus according to an embodiment of the present invention.
  • the service processing device may include:
  • the first receiving module 1001 is configured to receive a first ciphertext sent by the user agent, where the first ciphertext is encrypted by the user agent by using the first key to encrypt the service information;
  • the first decryption module 1002 is configured to decrypt the first ciphertext received by the first receiving module 1001 by using the second key to obtain service information.
  • the first sending module 1003 is configured to send the service information obtained by decrypting the first decryption module 1002 to the service processing system, so that the service processing system processes the service information according to the value-added service, and triggers sending the processed service information to The process of the web server;
  • the first key and the second key are keys agreed by the user agent and the proxy node when establishing an encrypted connection.
  • the proxy node is an intermediate proxy node:
  • the device further includes:
  • the second receiving module 1004 is configured to: after the first sending module 1003 sends the service information to the service processing system, receive the processed service information sent by the service processing system;
  • the key agreement module 1005 is configured to establish an encrypted connection with the network server, and stipulate the third key and the fourth key;
  • the first encryption module 1006 is configured to encrypt the service information by using the third key agreed by the key agreement module 1005 to obtain the second ciphertext;
  • the second sending module 1007 is configured to send the second ciphertext encrypted by the first cryptographic module 1006 to the network server, so that the network server decrypts the second ciphertext by using the fourth key to obtain the service information.
  • the device further includes:
  • the third receiving module 1008 is configured to: after the second sending module 1007 sends the second ciphertext to the network server, receive the third ciphertext sent by the network server, where the third ciphertext is used by the network server to use the fourth key pair service data. Encrypted to get;
  • a second decryption module 1009 configured to decrypt, by using the third key, the third receiving module 1008 Third ciphertext, obtaining business data;
  • the third sending module 1010 is configured to send the service data decrypted by the second decrypting module 1009 to the service processing system, so that the service processing system processes the service data according to the value-added service, and sends the processed service data to the intermediate agent node. ;
  • the second encryption module 1011 is configured to encrypt the processed service data by using the second key to obtain a fourth ciphertext
  • the fourth sending module 1012 is configured to send the fourth ciphertext encrypted by the second ciphering module 1011 to the user agent, so that the user agent decrypts the fourth ciphertext by using the first key to obtain service data.
  • the device further includes:
  • the first establishing module 1013 is configured to: before the first receiving module 1001 receives the first ciphertext sent by the user agent, intercept the first access request sent by the user agent to the network server, and instruct the user agent to send the first connection establishment request, according to the user
  • the first connection establishment request sent by the proxy establishes an encrypted connection with the user agent, and the first access request is used to request access to the network server; or
  • the second establishing module 1014 is configured to receive, after the first receiving module 1001 receives the first ciphertext sent by the user agent, the first connection establishment request sent by the user agent, according to the first connection establishment request sent by the user agent, and the user agent An encrypted connection is established.
  • the first connection establishment request is sent by the user agent after receiving the trigger signal triggered by the user, and the trigger signal is generated after the user triggers the webpage of the intermediate proxy node pre-stored in the user agent.
  • invention also includes
  • the request obtaining module 1030 is configured to intercept the TCP connection request sent by the user agent to the network server before the first establishing module 1013 intercepts the first access request sent by the user agent to the network server;
  • the fourth establishing module 1031 is configured to read the information of the network server in the TCP connection request, establish a TCP connection with the user agent according to the information replacement network server, and use the pre-stored digital certificate and the user corresponding to the network server after the TCP connection is established.
  • the proxy establishes an encrypted proxy connection, and the encrypted proxy connection is used by the user agent to send a first access request to the web server.
  • the fourth establishing module 1031 is specifically configured to:
  • the first digital certificate is a digital certificate issued by the certificate authority and corresponding to the network server
  • the second digital certificate of the certificate authority is pre-configured in the user agent or the terminal with the user agent installed
  • the user agent is configured to verify the first digital certificate according to the second digital certificate, and after the verification is passed, establish an encrypted proxy connection with the intermediate proxy node;
  • the third digital certificate is a non-authorization certificate
  • the fourth digital certificate is a digital certificate of the non-authorized certificate authority, so that the user agent verifies the third digital certificate according to the fourth digital certificate, and after the verification is passed, the intermediate agent
  • the node establishes an encrypted proxy connection.
  • the first establishing module 1013 is specifically configured to: by using a redirect response, instruct the user agent to send the first connection establishment request.
  • the redirect response includes the URL of the intermediate proxy node, or,
  • the redirecting response includes a proxy web address, and the proxy web address is obtained by the intermediate proxy node adding an agent indication to the indication information of the web server, and the indication information is the webpage indication information, the object indication information of the object in the webpage, and the webpage indication information or the object indication information is converted. One of the information obtained.
  • the device when the redirect response includes the URL of the intermediate proxy node, the device further includes:
  • the fourth receiving module 1015 is configured to: after the first establishing module 1013 establishes an encrypted connection with the user agent according to the first connection establishment request sent by the user agent, receive the fifth ciphertext sent by the user agent, and the fifth ciphertext is represented by the user. Encrypting the second access request by using the first key, and using the second access request for requesting access to the intermediate proxy node;
  • the third decryption module 1016 is configured to decrypt the fifth ciphertext received by the fifth receiving module 1015 by using the second key to obtain a second access request.
  • a webpage obtaining module 1017 configured to acquire a webpage of the intermediate proxy node
  • the third encryption module 1018 is configured to use the second key to encrypt the webpage acquired by the webpage obtaining module 1016 to obtain a sixth ciphertext;
  • the fifth sending module 1019 is configured to send the sixth ciphertext encrypted by the third ciphering module 1018 to the user agent, so that the user agent decrypts the sixth ciphertext by using the first key, and obtains a webpage, where the webpage is used to trigger the user agent. Send the first ciphertext.
  • the proxy node is a front-end proxy node located between the user agent and the intermediate proxy node:
  • the device further includes:
  • the fifth receiving module 1020 is configured to: after the first sending module 1003 sends the service information to the service processing system, receive the service data sent by the service processing system;
  • the fourth encryption module 1021 is configured to encrypt the service data received by the fifth receiving module 1020 by using the second key to obtain a seventh ciphertext;
  • the sixth sending module 1022 is configured to send the seventh ciphertext encrypted by the fourth ciphering module 1021 to the user agent, so that the user agent decrypts the seventh ciphertext by using the first key to obtain service data.
  • the device further includes:
  • the request interception module 1023 is configured to: before the first receiving module 1001 receives the first ciphertext sent by the user agent, intercept the second connection establishment request sent by the user agent to the intermediate proxy node, where the second connection establishment request includes the purpose of the intermediate proxy node IP address;
  • the third establishing module 1024 is configured to establish an encrypted connection with the user agent according to the destination IP address and the node information of the pre-stored intermediate proxy node.
  • the second connection establishment request is sent by the intermediate proxy node after intercepting the first access request sent by the user agent to the network server, and the first access request is used to request access to the network server, or the second connection is established.
  • the request is sent by the user agent after receiving the trigger signal triggered by the user, and the trigger signal is generated after the user triggers the webpage of the intermediate proxy node pre-stored in the user agent.
  • the second connection establishment request is that the intermediate proxy node intercepts the first access request sent by the user agent to the network server by using the encrypted proxy connection, and then indicates that the user agent sends the encrypted proxy connection, and the encrypted proxy connection is the intermediate proxy node intercepts the user agent to the network server.
  • Sending a TCP connection request reading the information of the network server in the TCP connection request, establishing a TCP connection with the user agent according to the information replacement network server, and establishing a pre-stored digital certificate corresponding to the network server and the user agent after the TCP connection is established. of.
  • the second connection establishment request is that the intermediate proxy node intercepts the first access request, and indicates, by the redirect response, the user agent sends the
  • the redirect response includes the URL of the intermediate proxy node; or,
  • the redirecting response includes a proxy web address, and the proxy web address is obtained by the intermediate proxy node adding an agent indication to the indication information of the web server, and the indication information is the webpage indication information, the object indication information of the object in the webpage, and the webpage indication information or the object indication information is converted. One of the information obtained.
  • the redirect response includes a URL of the intermediate proxy node, the device, and the method further includes:
  • the sixth receiving module 1025 is configured to: after the third establishing module 1024 establishes an encrypted connection with the user agent according to the destination IP address and the node information of the pre-stored intermediate proxy node, receive the fifth ciphertext sent by the user agent, and the fifth ciphertext
  • the second access request is encrypted by the user agent using the first key, and the second access request is used to request access to the intermediate proxy node;
  • a fourth decryption module 1026 configured to decrypt the fifth ciphertext received by the sixth receiving module 1025 by using the second key, to obtain a second access request
  • the seventh sending module 1027 is configured to send the second access request that is decrypted by the fourth decrypting module 1026 to the service processing system, so that the service processing system performs the second access request according to the value-added service. And sending the processed second access request to the intermediate proxy node;
  • the fifth encryption module 1028 is configured to send a webpage sent by the second key encryption service processing system to obtain a sixth ciphertext, where the webpage is sent by the intermediate proxy node to the service processing system;
  • the eighth sending module 1029 is configured to send the sixth ciphertext encrypted by the fifth ciphering module 1028 to the user agent, so that the user agent decrypts the sixth ciphertext by using the first key, and obtains a webpage, where the webpage is used to trigger the user agent. Send the first ciphertext.
  • the third establishing module 1024 is specifically configured to:
  • the node information includes a digital certificate and a private key, and the digital certificate is sent to the user agent, and the encrypted information sent by the user agent according to the public key carried by the digital certificate is received, and the encrypted key is decrypted by using the private key to obtain the pre-master key, and the destination IP is used.
  • the address establishes an encrypted connection with the user agent; or,
  • the node information includes a digital certificate, and the digital certificate is sent to the user agent, and the encrypted information sent by the user agent according to the public key carried by the digital certificate is received, and the encrypted information is sent to the intermediate agent node, and the intermediate agent node is used to decrypt the encrypted information by using the private key.
  • the pre-master key is used to generate the first key and the second key.
  • the service processing apparatus receives the first ciphertext sent by the user agent, decrypts the first ciphertext by using the second key, and obtains service information, and sends the service information to the service processing system.
  • the service processing system In order for the service processing system to process the service information according to the value-added service, and trigger the process of sending the processed service information to the network server, the first ciphertext transmitted by the proxy node may be used when the user agent uses the SSL/TLS protocol.
  • the decryption is performed, and the decrypted service information is sent to the service processing system, which solves the problem that the service processing system cannot decrypt the ciphertext, and the service processing system cannot provide value-added services for the user agent using the SSL/TLS protocol, thereby achieving the expansion of the value-added service.
  • the redirect response includes a proxy web address
  • the proxy web address is obtained by the intermediate proxy node adding an agent indication to the indication information of the web server, where the indication information is webpage indication information, object indication information of the object in the webpage, and the webpage indication information or the object indication information.
  • One of the information obtained after the conversion may directly send the network server indication information or the object indication information to the user agent, without first obtaining the webpage of the intermediate proxy node, and then triggering the webpage of the intermediate proxy node to obtain the network server indication information or Object indication information can simplify the operation process and improve the efficiency of business processing.
  • FIG. 11 is a schematic structural diagram of a service processing apparatus according to an embodiment of the present invention.
  • the service processing apparatus may include a bus 1101, and a processor 1102, a memory 1103, a transmitter 1104, and a receiver 1105 connected to the bus.
  • the memory 1103 is configured to store a plurality of instructions, and the instructions are configured to be executed by the processor 1102;
  • the receiver 1105 is configured to receive the first ciphertext sent by the user agent, where the first ciphertext is obtained by the user agent using the first key to encrypt the service information.
  • the processor 1102 is configured to decrypt the first ciphertext received by the receiver 1105 by using the second key to obtain service information.
  • the transmitter 1104 is configured to send the service information decrypted by the processor 1102 to the service processing system, so that the service processing system processes the service information according to the value-added service, and triggers a process of sending the processed service information to the network server.
  • the first key and the second key are keys agreed by the user agent and the proxy node when establishing an encrypted connection.
  • the service processing apparatus receives the first ciphertext sent by the user agent, decrypts the first ciphertext by using the second key, and obtains service information, and sends the service information to the service processing system.
  • the service processing system In order for the service processing system to process the service information according to the value-added service, and trigger the process of sending the processed service information to the network server, the first ciphertext transmitted by the proxy node may be used when the user agent uses the SSL/TLS protocol.
  • the decryption is performed, and the decrypted service information is sent to the service processing system, which solves the problem that the service processing system cannot decrypt the ciphertext, and the service processing system cannot provide value-added services for the user agent using the SSL/TLS protocol, thereby achieving the expansion of the value-added service.
  • the embodiment of the present invention further provides a service processing apparatus, which may include a bus 1101, and a processor 1102, a memory 1103, a transmitter 1104, and a receiver 1105 connected to the bus.
  • a service processing apparatus which may include a bus 1101, and a processor 1102, a memory 1103, a transmitter 1104, and a receiver 1105 connected to the bus.
  • the memory 1103 is configured to store a plurality of instructions, and the instructions are configured to be executed by the processor 1102;
  • the receiver 1105 is configured to receive the first ciphertext sent by the user agent, where the first ciphertext is obtained by the user agent using the first key to encrypt the service information.
  • the processor 1102 is configured to decrypt the first ciphertext received by the receiver 1105 by using the second key to obtain service information.
  • the transmitter 1104 is configured to send the service information decrypted by the processor 1102 to the service processing system, so that the service processing system processes the service information according to the value-added service, and triggers the processed service.
  • the first key and the second key are keys agreed by the user agent and the proxy node when establishing an encrypted connection.
  • the proxy node is an intermediate proxy node.
  • the receiver 1105 is further configured to: after the transmitter 1104 sends the service information to the service processing system, receive the processed service information sent by the service processing system;
  • the processor 1102 is further configured to establish an encrypted connection with the network server, and stipulate a third key and a fourth key; and encrypt the service information by using the third key to obtain a second ciphertext;
  • the transmitter 1104 is further configured to send the second ciphertext encrypted by the processor 1102 to the network server, so that the network server decrypts the second ciphertext by using the fourth key to obtain service information.
  • the receiver 1105 is further configured to: after the transmitter 1104 sends the second ciphertext to the network server, receive the third ciphertext sent by the network server, where the third ciphertext is used by the network server to use the fourth key pair service.
  • the data is encrypted and obtained;
  • the processor 1102 is further configured to use the third key to decrypt the third ciphertext received by the receiver 1105 to obtain service data.
  • the transmitter 1104 is further configured to send the service data decrypted by the processor 1102 to the service processing system, so that the service processing system processes the service data according to the value-added service, and sends the processed service data to the intermediate agent node;
  • the processor 1102 is further configured to use the second key to encrypt the processed service data to obtain a fourth ciphertext
  • the transmitter 1104 is further configured to send the fourth ciphertext encrypted by the processor 1102 to the user agent, so that the user agent decrypts the fourth ciphertext by using the first key to obtain service data.
  • the receiver 1105 is further configured to: before receiving the first ciphertext sent by the user agent, intercept the first access request sent by the user agent to the network server, where the transmitter 1104 is further configured to instruct the user agent to send the first connection.
  • the processor 1102 is further configured to establish an encrypted connection with the user agent according to the first connection establishment request sent by the user agent, where the first access request is used to request access to the network server; or
  • the receiver 1105 is further configured to: before receiving the first ciphertext sent by the user agent, receive a first connection establishment request sent by the user agent, where the processor 1102 is further configured to: according to the first connection establishment request sent by the user agent, to the user The proxy establishes an encrypted connection, and the first connection establishment request is sent by the user agent after receiving the trigger signal triggered by the user, and the trigger signal is generated after the user triggers the webpage of the intermediate proxy node pre-stored in the user agent.
  • the receiver 1105 is further configured to: before intercepting the first access request sent by the user agent to the network server, intercept the TCP connection request sent by the user agent to the network server;
  • the processor 1102 is further configured to read information of the network server in the TCP connection request, establish a TCP connection with the user agent according to the information replacement network server, and use the pre-stored digital certificate and user agent corresponding to the network server after the TCP connection is established.
  • An cryptographic proxy connection is established, and the cryptographic proxy connection is provided for the user agent to send a first access request to the web server.
  • the transmitter 1104 is further configured to send, to the user agent, a first digital certificate, where the first digital certificate is a digital certificate issued by the certificate authority and corresponding to the network server, and the second digital certificate of the certificate authority is pre-configured in the In the operating system of the user agent or the terminal in which the user agent is installed, so that the user agent verifies the first digital certificate according to the second digital certificate, and after the verification is passed, establishes an encrypted proxy connection with the intermediate proxy node; or
  • the transmitter 1104 is further configured to send a third digital certificate and a fourth digital certificate to the user agent, where the third digital certificate is a digital certificate issued by an unauthorized certificate authority and corresponding to the network server, and the fourth digital certificate is an unauthorized certificate authority
  • the digital certificate is such that the user agent verifies the third digital certificate according to the fourth digital certificate, and after the verification is passed, establishes an encrypted proxy connection with the intermediate proxy node.
  • the transmitter 1104 is specifically configured to instruct the user agent to send the first access request by using a redirect response.
  • the redirect response includes the URL of the intermediate proxy node, or,
  • the redirecting response includes a proxy web address, and the proxy web address is obtained by the intermediate proxy node adding an agent indication to the indication information of the web server, and the indication information is the webpage indication information, the object indication information of the object in the webpage, and the webpage indication information or the object indication information is converted. One of the information obtained.
  • the redirect response includes the URL of the intermediate proxy node.
  • the receiver 1105 is further configured to: after the processor 1102 establishes an encrypted connection with the user agent according to the first connection establishment request sent by the user agent, receive the fifth ciphertext sent by the user agent, and the fifth ciphertext is used by the user agent.
  • the key is obtained by encrypting the second access request, and the second access request is used for requesting access to the intermediate proxy node;
  • the processor 1102 is further configured to use the second key to decrypt the fifth ciphertext received by the receiver 1105, obtain a second access request, obtain a webpage of the intermediate proxy node, and encrypt the webpage by using the second key to obtain the sixth ciphertext. ;
  • the transmitter 1104 is further configured to send the sixth ciphertext encrypted by the processor 1102 to the user agent, so that the user agent decrypts the sixth ciphertext by using the first key, and obtains a webpage, where the webpage is used to trigger the user agent. Send the first ciphertext.
  • the proxy node is a front-end proxy node between the user agent and the intermediate proxy node, and further includes:
  • the receiver 1105 is further configured to: after the transmitter 1104 sends the service information to the service processing system, receive the service data sent by the service processing system;
  • the processor 1102 is further configured to use the second key to encrypt the service data received by the receiver 1105 to obtain a seventh ciphertext;
  • the transmitter 1104 is further configured to send the seventh ciphertext encrypted by the processor 1102 to the user agent, so that the user agent decrypts the seventh ciphertext by using the first key to obtain service data.
  • the receiver 1105 is further configured to: before receiving the first ciphertext sent by the user agent, intercept the second connection establishment request sent by the user agent to the intermediate proxy node, where the second connection establishment request includes the destination IP address of the intermediate proxy node. address;
  • the processor 1102 is configured to establish an encrypted connection with the user agent according to the destination IP address and the node information of the pre-stored intermediate proxy node.
  • the second connection establishment request is sent by the intermediate proxy node after intercepting the first access request sent by the user agent to the network server, and the first access request is used to request access to the network server, or the second connection is established.
  • the request is sent by the user agent after receiving the trigger signal triggered by the user, and the trigger signal is generated after the user triggers the webpage of the intermediate proxy node pre-stored in the user agent.
  • the second connection establishment request is that the intermediate proxy node intercepts the first access request sent by the user agent to the network server by using the encrypted proxy connection, and then indicates that the user agent sends the encrypted proxy connection, and the encrypted proxy connection is the intermediate proxy node intercepts the user agent to the network server.
  • Sending a TCP connection request reading the information of the network server in the TCP connection request, establishing a TCP connection with the user agent according to the information replacement network server, and establishing a pre-stored digital certificate corresponding to the network server and the user agent after the TCP connection is established. of.
  • the redirecting response when the second connection establishment request is that the intermediate proxy node intercepts the first access request, and the redirecting response indicates that the user agent sends the redirect request, the redirect response includes the URL of the intermediate proxy node;
  • the redirecting response includes a proxy web address, and the proxy web address is obtained by the intermediate proxy node adding an agent indication to the indication information of the web server, and the indication information is the webpage indication information, the object indication information of the object in the webpage, and the webpage indication information or the object indication information is converted. One of the information obtained.
  • the redirect response includes the URL of the intermediate proxy node
  • the receiver 1105 is further configured to, at the processor 1102, the destination IP address and the pre-stored intermediate proxy section.
  • Point node information after establishing an encrypted connection with the user agent, receiving a fifth ciphertext sent by the user agent, the fifth ciphertext is obtained by the user agent encrypting the second access request by using the first key, and the second access request is used for Requesting access to an intermediate proxy node;
  • the processor 1102 is further configured to use the second key to decrypt the fifth ciphertext received by the receiver 1105, to obtain a second access request.
  • the transmitter 1104 is further configured to send the second access request that is decrypted by the processor 1102 to the service processing system, so that the service processing system processes the second access request according to the value-added service, and sends the processed second access request request.
  • the transmitter 1104 is further configured to send the second access request that is decrypted by the processor 1102 to the service processing system, so that the service processing system processes the second access request according to the value-added service, and sends the processed second access request request.
  • the processor 1102 is further configured to use the second key to encrypt the webpage sent by the service processing system to obtain a sixth ciphertext, where the webpage is sent by the intermediate proxy node to the service processing system;
  • the transmitter 1104 is further configured to send the sixth ciphertext encrypted by the processor 1102 to the user agent, so that the user agent decrypts the sixth ciphertext by using the first key, and obtains a webpage, where the webpage is used to trigger the user agent to send the first Cipher text.
  • the node information includes a digital certificate and a private key
  • the transmitter 1104 is configured to send the digital certificate to the user agent
  • the receiver 1105 is configured to receive the encrypted information sent by the user agent according to the public key carried by the digital certificate.
  • the processor 1102 is specifically configured to decrypt the encrypted information by using a private key to obtain a pre-master key, and establish an encrypted connection with the user agent by using the destination IP address; or
  • the node information includes a digital certificate
  • the transmitter 1104 is specifically configured to send the digital certificate to the user agent
  • the receiver 1105 is specifically configured to receive the encrypted information sent by the user agent according to the public key carried by the digital certificate, and the transmitter 1104 is further used to Sending the encrypted information to the intermediate proxy node
  • the receiver 1105 is further configured to receive the pre-master key sent by the intermediate proxy node to decrypt the encrypted information by using the private key
  • the processor 1102 is specifically configured to use the destination IP address and the user agent. Establish an encrypted connection;
  • the pre-master key is used to generate the first key and the second key.
  • the service processing apparatus receives the first ciphertext sent by the user agent, decrypts the first ciphertext by using the second key, and obtains service information, and sends the service information to the service processing system.
  • the service processing system In order for the service processing system to process the service information according to the value-added service, and trigger the process of sending the processed service information to the network server, the first ciphertext transmitted by the proxy node may be used when the user agent uses the SSL/TLS protocol.
  • the decryption is performed, and the decrypted service information is sent to the service processing system, which solves the problem that the service processing system cannot decrypt the ciphertext, and the service processing system cannot provide value-added services for the user agent using the SSL/TLS protocol, thereby achieving the expansion of the value-added service.
  • the redirect response includes a proxy web address
  • the proxy web address is obtained by the intermediate proxy node adding an agent indication to the indication information of the web server, where the indication information is webpage indication information, object indication information of the object in the webpage, and the webpage indication information or the object indication information.
  • One of the information obtained after the conversion may directly send the network server indication information or the object indication information to the user agent, without first obtaining the webpage of the intermediate proxy node, and then triggering the webpage of the intermediate proxy node to obtain the network server indication information or Object indication information can simplify the operation process and improve the efficiency of business processing.
  • the disclosed systems, devices, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit may be only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined. Or it can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the unit described as a separate component may or may not be physically separated, and the component displayed as a unit may or may not be a physical unit, that is, may be located in one place, or It can also be distributed to multiple network elements. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product.
  • the technical solution of the present invention which is essential or contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product, which is stored in a storage medium, including
  • the instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明公开了一种业务处理方法及装置，涉及通信领域，所述方法包括：代理节点接收用户代理发送的第一密文，第一密文由用户代理使用第一密钥对业务信息进行加密得到；代理节点使用第二密钥解密第一密文，得到业务信息；代理节点将业务信息发送给业务处理系统，以使业务处理系统将业务信息按照增值业务进行处理，并触发将处理后的业务信息发送给网络服务器的流程；其中，第一密钥和第二密钥是用户代理和代理节点在建立加密连接时约定的密钥。本发明解决了业务处理系统无法解密密文，导致业务处理系统无法为使用SSL/TLS协议的用户代理提供增值业务的问题，达到了扩大增值业务的使用范围的效果。

Description

业务处理方法及装置
本申请要求于2015年01月14日提交中国专利局、申请号为PCT/CN2015/070664、发明名称为“业务处理方法及装置”的专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及通信领域，特别涉及一种业务处理方法及装置。
背景技术
中间代理节点是一种门户网站站点，相当于因特网入网的网关。门户网站一般都有搜索引擎，供用户查找自己所要访问的其它网站。通常，中间代理节点提供一个包含输入框的网页，用户在输入框中输入所要访问的网站的网址，由中间代理节点转发用户触发的网站访问请求，并将网站的应答数据转发给用户。其中，中间代理节点可以是Portal。
安全套接层(英文：security socket layer；简称：SSL)协议及其继任者传输层安全(英文：transport layer security；简称，TLS)协议用于为网络通信提供加密、身份认证及数据完整性等服务，已被广泛地应用于浏览器与网络服务器之间的安全通信。其中，SSL/TLS协议位于传输层的传输控制协议(英文：transmission control protocol；简称：TCP)协议和应用层的超文本传送协议(英文：hypertext transfer protocol；简称：HTTP)之间。
相关技术提供的一种业务处理方法包括：用户代理(英文：user agent；简称：UA)通过中间代理节点与因特网建立网络连接，用户代理向中间代理节点发送业务信息，中间代理节点将业务信息发送给网络服务器；中间代理节点接收网络服务器返回的业务数据，再将业务数据发送给该用户代理。其中，业务信息可以用于请求网络服务器的网页，也可以用于请求网络服务器中的对象。
在中间代理节点存在的场景下，当在传输层使用SSL/TLS协议时，用户代理和中间代理节点、中间代理节点和网络服务器之间传输的是加密后得到的密文，由于位于用户代理和网络服务器之间的业务处理系统无法解密密文，导致 业务处理系统无法为用户代理提供增值业务。其中，业务处理系统可以是GI接口-局域网(英文：GI-Local Area Network；简称：GI-LAN)，GI-LAN是指在GI接口之后，因特网之前的网络，由具有不同功能的业务使能单元组成。其中，不同的业务使能单元可以串接形成业务链，业务链用于提供增值业务。比如，具有缓存功能的业务使能单元和具有防火墙功能的业务使能单元依次串接形成视频业务的业务链。
发明内容
为了解决业务处理系统无法解密密文，导致业务处理系统无法为使用SSL/TLS协议的用户代理提供增值业务的问题，本发明实施例提供了一种业务处理方法及装置。所述技术方案如下：
第一方面，提供了一种业务处理方法，所述方法包括：
代理节点接收用户代理发送的第一密文，所述第一密文由所述用户代理使用第一密钥对业务信息进行加密得到；
所述代理节点使用第二密钥解密所述第一密文，得到所述业务信息；
所述代理节点将所述业务信息发送给业务处理系统，以使所述业务处理系统将所述业务信息按照增值业务进行处理，并触发将处理后的所述业务信息发送给网络服务器的流程；
其中，所述第一密钥和所述第二密钥是所述用户代理和所述代理节点在建立加密连接时约定的密钥。
在第一方面的第一种可能的实现方式中，所述代理节点是中间代理节点，所述代理节点将所述业务信息发送给业务处理系统之后，还包括：
所述中间代理节点接收所述业务处理系统发送的处理后的所述业务信息；
所述中间代理节点与所述网络服务器建立加密连接，并约定第三密钥和第四密钥；
所述中间代理节点使用所述第三密钥加密所述业务信息，得到第二密文；
所述中间代理节点将所述第二密文发送给所述网络服务器，以使所述网络服务器使用所述第四密钥解密所述第二密文，得到所述业务信息。
根据第一方面的第一种可能的实现方式，在第一方面的第二种可能的实现方式中，所述中间代理节点将所述第二密文发送给所述网络服务器之后，还包括：
所述中间代理节点接收所述网络服务器发送的第三密文，所述第三密文由所述网络服务器使用所述第四密钥对业务数据进行加密得到；
所述中间代理节点使用所述第三密钥解密所述第三密文，得到所述业务数据；
所述中间代理节点将所述业务数据发送给所述业务处理系统，以使所述业务处理系统将所述业务数据按照增值业务进行处理，将处理后的所述业务数据发送给所述中间代理节点；
所述中间代理节点使用所述第二密钥加密处理后的所述业务数据，得到第四密文；
所述中间代理节点将所述第四密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第四密文，得到所述业务数据。
根据第一方面的第一种可能的实现方式或第一方面的第二种可能的实现方式，在第一方面的第三种可能的实现方式中，所述代理节点接收用户代理发送的第一密文之前，还包括：
所述中间代理节点截获所述用户代理向所述网络服务器发送的第一访问请求，指示所述用户代理发送第一连接建立请求，根据所述用户代理发送的所述第一连接建立请求，与所述用户代理建立所述加密连接，所述第一访问请求用于请求访问所述网络服务器；或，
所述中间代理节点接收所述用户代理发送的第一连接建立请求，根据所述用户代理发送的所述第一连接建立请求，与所述用户代理建立所述加密连接，所述第一连接建立请求是所述用户代理在接收到用户触发的触发信号后发送的，所述触发信号是用户触发所述用户代理中预存的所述中间代理节点的网页后生成的。
根据第一方面的第三种可能的实现方式，在第一方面的第四种可能的实现方式中，所述指示所述用户代理发送第一连接建立请求，包括：
通过重定向响应指示所述用户代理发送所述第一连接建立请求。
根据第一方面的第四种可能的实现方式，在第一方面的第五种可能的实现方式中，
所述重定向响应包括所述中间代理节点的网址，或，
所述重定向响应包括代理网址，所述代理网址由所述中间代理节点对所述网络服务器的指示信息添加代理指示得到，所述指示信息为网页指示信息、网 页中对象的对象指示信息、对所述网页指示信息或所述对象指示信息进行转换后得到的信息中的一种。
根据第一方面的第五种可能的实现方式，在第一方面的第六种可能的实现方式中，当所述重定向响应包括所述中间代理节点的网址时，所述中间代理节点根据所述用户代理发送的所述第一连接建立请求，与所述用户代理建立所述加密连接之后，还包括：
所述中间代理节点接收所述用户代理发送的第五密文，所述第五密文由所述用户代理使用所述第一密钥对第二访问请求进行加密得到，所述第二访问请求用于请求访问所述中间代理节点；
所述中间代理节点使用所述第二密钥解密所述第五密文，得到所述第二访问请求；
所述中间代理节点获取所述中间代理节点的网页；
所述中间代理节点使用所述第二密钥加密所述网页，得到第六密文；
所述中间代理节点将所述第六密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第六密文，得到所述网页，所述网页用于触发所述用户代理发送所述第一密文。
在第一方面的第七种可能的实现方式中，所述代理节点是位于所述用户代理和中间代理节点之间的前端代理节点，所述代理节点将所述业务信息发送给业务处理系统之后，还包括：
所述前端代理节点接收所述业务处理系统发送的业务数据；
所述前端代理节点使用所述第二密钥加密所述业务数据，得到第七密文；
所述前端代理节点将所述第七密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第七密文，得到所述业务数据。
根据第一方面的第七种可能的实现方式，在第一方面的第八种可能的实现方式中，所述代理节点接收用户代理发送的第一密文之前，还包括：
所述前端代理节点截获所述用户代理向中间代理节点发送的第二连接建立请求，所述第二连接建立请求包括所述中间代理节点的目的因特网协议IP地址；
所述前端代理节点根据所述目的IP地址和预存的所述中间代理节点的节点信息，与所述用户代理建立所述加密连接。
根据第一方面的第八种可能的实现方式，在第一方面的第九种可能的实现 方式中，
所述第二连接建立请求是所述中间代理节点截获所述用户代理向所述网络服务器发送的第一访问请求后，通过重定向响应指示所述用户代理发送的，所述第一访问请求用于请求访问所述网络服务器，或，
所述第二连接建立请求是所述用户代理在接收到用户触发的触发信号后发送的，所述触发信号是用户触发所述用户代理中预存的所述中间代理节点的网页后生成的。
根据第一方面的第九种可能的实现方式，在第一方面的第十种可能的实现方式中，当所述第二连接建立请求是所述中间代理节点截获所述第一访问请求后，通过重定向响应指示所述用户代理发送的时，
所述重定向响应包括所述中间代理节点的网址；或，
所述重定向响应包括代理网址，所述代理网址由所述中间代理节点对所述网络服务器的指示信息添加代理指示得到，所述指示信息为网页指示信息、网页中对象的对象指示信息、对所述网页指示信息或所述对象指示信息进行转换后得到的信息中的一种。
根据第一方面的第十种可能的实现方式，在第一方面的第十一种可能的实现方式中，当所述重定向响应包括所述中间代理节点的网址时，
所述前端代理节点根据所述目的IP地址和预存的所述中间代理节点的节点信息，与所述用户代理建立所述加密连接之后，还包括：
所述前端代理节点接收所述用户代理发送的第五密文，所述第五密文由所述用户代理使用所述第一密钥对第二访问请求进行加密得到，所述第二访问请求用于请求访问所述中间代理节点；
所述前端代理节点使用所述第二密钥解密所述第五密文，得到所述第二访问请求；
所述前端代理节点将所述第二访问请求发送给所述业务处理系统，以使所述业务处理系统将所述第二访问请求按照增值业务进行处理，将处理后的所述第二访问请求请求发送给所述中间代理节点；
所述前端代理节点使用所述第二密钥加密所述业务处理系统发送的网页，得到第六密文，所述网页由所述中间代理节点发送给所述业务处理系统；
所述前端代理节点将所述第六密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第六密文，得到所述网页，所述网页用于触发所 述用户代理发送所述第一密文。
根据第一方面的第八种可能的实现方式或第一方面的第九种可能的实现方式或第一方面的第十种可能的实现方式或第一方面的第十一种可能的实现方式，在第一方面的第十二种可能的实现方式中，所述前端代理节点根据所述目的IP地址和预存的所述中间代理节点的节点信息，与所述用户代理建立所述加密连接，包括：
所述节点信息包括数字证书和私钥，所述前端代理节点将所述数字证书发送给所述用户代理，接收所述用户代理根据所述数字证书携带的公钥发送的加密信息，使用所述私钥对所述加密信息进行解密得到预主密钥，并使用所述目的IP地址与所述用户代理建立所述加密连接；或，
所述节点信息包括数字证书，所述前端代理节点将所述数字证书发送给所述用户代理，接收所述用户代理根据所述数字证书携带的公钥发送的加密信息，将所述加密信息发送给所述中间代理节点，接收所述中间代理节点使用私钥对所述加密信息进行解密后发送的预主密钥，并使用所述目的IP地址与所述用户代理建立所述加密连接；
其中，所述预主密钥用于生成所述第一密钥和所述第二密钥。
根据第一方面的第三种可能的实现方式，在第一方面的第十三种可能的实现方式中，
所述中间代理节点截获所述用户代理向所述网络服务器发送的第一访问请求之前，还包括：
所述中间代理节点截获所述用户代理向所述网络服务器发送的传输控制协议TCP连接请求；
所述中间代理节点读取所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接，在所述TCP连接建立完成后，利用预存的与所述网络服务器对应的数字证书与所述用户代理建立加密代理连接，所述加密代理连接供所述用户代理向所述网络服务器发送所述第一访问请求。
根据第一方面的第十三种可能的实现方式，在第一方面的第十四种可能的实现方式中，所述利用预存的与所述网络服务器对应的数字证书与所述用户代理建立加密代理连接，包括：
所述中间代理节点向所述用户代理发送第一数字证书，所述第一数字证书 是证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述证书颁发机构的第二数字证书预先配置在所述用户代理中或安装有所述用户代理的终端的操作系统中，以使所述用户代理根据所述第二数字证书验证所述第一数字证书，在验证通过后，与所述中间代理节点建立所述加密代理连接；或，
所述中间代理节点向所述用户代理发送第三数字证书和第四数字证书，所述第三数字证书是非授权证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述第四数字证书是所述非授权证书颁发机构的数字证书，以使所述用户代理根据所述第四数字证书验证所述第三数字证书，在验证通过后，与所述中间代理节点建立所述加密代理连接。
根据第一方面的第九种可能的实现方式，在第一方面的第十五种可能的实现方式中，所述第二连接建立请求是所述中间代理节点通过加密代理连接截获所述用户代理向所述网络服务器发送的所述第一访问请求后，指示所述用户代理发送的，所述加密代理连接是所述中间代理节点截获所述用户代理向所述网络服务器发送的TCP连接请求，读取所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接，在所述TCP连接建立完成后，利用预存的与所述网络服务器对应的数字证书与所述用户代理建立的。
第二方面，提供了一种业务处理装置，用于代理节点中，所述装置包括：
第一接收模块，用于接收用户代理发送的第一密文，所述第一密文由所述用户代理使用第一密钥对业务信息进行加密得到；
第一解密模块，用于使用第二密钥解密所述第一接收模块接收到的所述第一密文，得到所述业务信息；
第一发送模块，用于将所述第一解密模块解密后得到的所述业务信息发送给业务处理系统，以使所述业务处理系统将所述业务信息按照增值业务进行处理，并触发将处理后的所述业务信息发送给网络服务器的流程；
其中，所述第一密钥和所述第二密钥是所述用户代理和所述代理节点在建立加密连接时约定的密钥。
在第二方面的第一种可能的实现方式中，所述代理节点是中间代理节点，所述装置，还包括：
第二接收模块，用于在所述第一发送模块将所述业务信息发送给业务处理系统之后，接收所述业务处理系统发送的处理后的所述业务信息；
密钥约定模块，用于与所述网络服务器建立加密连接，并约定第三密钥和第四密钥；
第一加密模块，用于使用所述密钥约定模块约定的所述第三密钥加密所述业务信息，得到第二密文；
第二发送模块，用于将所述第一加密模块加密后的所述第二密文发送给所述网络服务器，以使所述网络服务器使用所述第四密钥解密所述第二密文，得到所述业务信息。
根据第二方面的第一种可能的实现方式，在第二方面的第二种可能的实现方式中，所述装置，还包括：
第三接收模块，用于在所述第二发送模块将所述第二密文发送给所述网络服务器之后，接收所述网络服务器发送的第三密文，所述第三密文由所述网络服务器使用所述第四密钥对业务数据进行加密得到；
第二解密模块，用于使用所述第三密钥解密所述第三接收模块接收到的所述第三密文，得到所述业务数据；
第三发送模块，用于将所述第二解密模块解密后的所述业务数据发送给所述业务处理系统，以使所述业务处理系统将所述业务数据按照增值业务进行处理，将处理后的所述业务数据发送给所述中间代理节点；
第二加密模块，用于使用所述第二密钥加密处理后的所述业务数据，得到第四密文；
第四发送模块，用于将所述第二加密模块加密后的所述第四密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第四密文，得到所述业务数据。
根据第二方面的第一种可能的实现方式或第二方面的第二种可能的实现方式，在第二方面的第三种可能的实现方式中，所述装置，还包括：
第一建立模块，用于在所述第一接收模块接收用户代理发送的第一密文之前，截获所述用户代理向所述网络服务器发送的第一访问请求，指示所述用户代理发送第一连接建立请求，根据所述用户代理发送的所述第一连接建立请求，与所述用户代理建立所述加密连接，所述第一访问请求用于请求访问所述网络服务器；或，
第二建立模块，用于在所述第一接收模块接收用户代理发送的第一密文之前，接收所述用户代理发送的第一连接建立请求，根据所述用户代理发送的所 述第一连接建立请求，与所述用户代理建立所述加密连接，所述第一连接建立请求是所述用户代理在接收到用户触发的触发信号后发送的，所述触发信号是用户触发所述用户代理中预存的所述中间代理节点的网页后生成的。
根据根据第二方面的第三种可能的实现方式，在第二方面的第四种可能的实现方式中，所述第一建立模块，具体用于通过重定向响应指示所述用户代理发送所述第一连接建立请求。
根据第二方面的第四种可能的实现方式，在第二方面的第五种可能的实现方式中，
所述重定向响应包括所述中间代理节点的网址，或，
所述重定向响应包括代理网址，所述代理网址由所述中间代理节点对所述网络服务器的指示信息添加代理指示得到，所述指示信息为网页指示信息、网页中对象的对象指示信息、对所述网页指示信息或所述对象指示信息进行转换后得到的信息中的一种。
根据第二方面的第五种可能的实现方式，在第二方面的第六种可能的实现方式中，当所述重定向响应包括所述中间代理节点的网址时，所述装置，还包括：
第四接收模块，用于在所述第一建立模块根据所述用户代理发送的所述第一连接建立请求，与所述用户代理建立所述加密连接之后，接收所述用户代理发送的第五密文，所述第五密文由所述用户代理使用所述第一密钥对第二访问请求进行加密得到，所述第二访问请求用于请求访问所述中间代理节点；
第三解密模块，用于使用所述第二密钥解密所述第五接收模块接收到的所述第五密文，得到所述第二访问请求；
网页获取模块，用于获取所述中间代理节点的网页；
第三加密模块，用于使用所述第二密钥加密所述网页获取模块获取的所述网页，得到第六密文；
第五发送模块，用于将所述第三加密模块加密后的所述第六密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第六密文，得到所述网页，所述网页用于触发所述用户代理发送所述第一密文。
在第二方面的第七种可能的实现方式中，所述代理节点是位于所述用户代理和中间代理节点之间的前端代理节点，所述装置，还包括：
第五接收模块，用于在所述第一发送模块将所述业务信息发送给业务处理 系统之后，接收所述业务处理系统发送的业务数据；
第四加密模块，用于使用所述第二密钥加密所述第五接收模块接收到的所述业务数据，得到第七密文；
第六发送模块，用于将所述第四加密模块加密后的所述第七密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第七密文，得到所述业务数据。
根据第二方面的第七种可能的实现方式，在第二方面的第八种可能的实现方式中，所述装置，还包括：
请求截获模块，用于在所述第一接收模块接收用户代理发送的第一密文之前，截获所述用户代理向中间代理节点发送的第二连接建立请求，所述第二连接建立请求包括所述中间代理节点的目的因特网协议IP地址，所述第二连接建立请求是所述中间代理节点截获所述用户代理向所述网络服务器发送的第一访问请求后，通过重定向响应指示所述用户代理发送的，所述第一访问请求用于请求访问所述网络服务器，或，所述第二连接建立请求是所述用户代理在接收到用户触发的触发信号后发送的，所述触发信号是用户触发所述用户代理中预存的所述中间代理节点的网页后生成的；
第三建立模块，用于根据所述目的IP地址和预存的所述中间代理节点的节点信息，与所述用户代理建立所述加密连接。
根据第二方面的第八种可能的实现方式，在第二方面的第九种可能的实现方式中，
所述第二连接建立请求是所述中间代理节点截获所述用户代理向所述网络服务器发送的第一访问请求后，指示所述用户代理发送的，所述第一访问请求用于请求访问所述网络服务器，或，
所述第二连接建立请求是所述用户代理在接收到用户触发的触发信号后发送的，所述触发信号是用户触发所述用户代理中预存的所述中间代理节点的网页后生成的。
根据第二方面的第九种可能的实现方式，在第二方面的第十种可能的实现方式中，当所述第二连接建立请求是所述中间代理节点截获所述第一访问请求后，通过重定向响应指示所述用户代理发送的时，
所述重定向响应包括所述中间代理节点的网址；或，
所述重定向响应包括代理网址，所述代理网址由所述中间代理节点对所述 网络服务器的指示信息添加代理指示得到，所述指示信息为网页指示信息、网页中对象的对象指示信息、对所述网页指示信息或所述对象指示信息进行转换后得到的信息中的一种。
根据第二方面的第十种可能的实现方式，在第二方面的第十一种可能的实现方式中，当所述重定向响应包括所述中间代理节点的网址时，所述装置，还包括：
第六接收模块，用于在所述第三建立模块根据所述目的IP地址和预存的所述中间代理节点的节点信息，与所述用户代理建立所述加密连接之后，接收所述用户代理发送的第五密文，所述第五密文由所述用户代理使用所述第一密钥对第二访问请求进行加密得到，所述第二访问请求用于请求访问所述中间代理节点；
第四解密模块，用于使用所述第二密钥解密所述第六接收模块接收到的所述第五密文，得到所述第二访问请求；
第七发送模块，用于将所述第四解密模块解密后的所述第二访问请求发送给所述业务处理系统，以使所述业务处理系统将所述第二访问请求按照增值业务进行处理，将处理后的所述第二访问请求请求发送给所述中间代理节点；
第五加密模块，用于所述第二密钥加密所述业务处理系统发送的网页，得到第六密文，所述网页由所述中间代理节点发送给所述业务处理系统；
第八发送模块，用于将所述第五加密模块加密后的所述第六密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第六密文，得到所述网页，所述网页用于触发所述用户代理发送所述第一密文。
根据第二方面的第八种可能的实现方式或第二方面的第九种可能的实现方式或第二方面的第十种可能的实现方式或第二方面的第十一种可能的实现方式，在第二方面的第十二种可能的实现方式中，所述第三建立模块，具体用于
所述节点信息包括数字证书和私钥，将所述数字证书发送给所述用户代理，接收所述用户代理根据所述数字证书携带的公钥发送的加密信息，使用所述私钥对所述加密信息进行解密得到预主密钥，并使用所述目的IP地址与所述用户代理建立所述加密连接；或，
所述节点信息包括数字证书，将所述数字证书发送给所述用户代理，接收所述用户代理根据所述数字证书携带的公钥发送的加密信息，将所述加密信息 发送给所述中间代理节点，接收所述中间代理节点使用私钥对所述加密信息进行解密后发送的预主密钥，并使用所述目的IP地址与所述用户代理建立所述加密连接；
其中，所述预主密钥用于生成所述第一密钥和所述第二密钥。
根据第二方面的第三种可能的实现方式，在第二方面的第十三种可能的实现方式中，所述装置，还包括：
请求获取模块，用于所述第一建立模块截获所述用户代理向所述网络服务器发送的第一访问请求之前，截获所述用户代理向所述网络服务器发送的传输控制协议TCP连接请求；
第四建立模块，用于读取所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接，在所述TCP连接建立完成后，利用预存的与所述网络服务器对应的数字证书与所述用户代理建立加密代理连接，所述加密代理连接供所述用户代理向所述网络服务器发送所述第一访问请求。
根据第二方面的第十三种可能的实现方式，在第二方面的第十四种可能的实现方式中，所述第四建立模块，具体用于：
向所述用户代理发送第一数字证书，所述第一数字证书是证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述证书颁发机构的第二数字证书预先配置在所述用户代理中或安装有所述用户代理的终端的操作系统中，以使所述用户代理根据所述第二数字证书验证所述第一数字证书，在验证通过后，与所述中间代理节点建立所述加密代理连接；或，
向所述用户代理发送第三数字证书和第四数字证书，所述第三数字证书是非授权证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述第四数字证书是所述非授权证书颁发机构的数字证书，以使所述用户代理根据所述第四数字证书验证所述第三数字证书，在验证通过后，与所述中间代理节点建立所述加密代理连接。
根据第二方面的第九种可能的实现方式，在第二方面的第十五种可能的实现方式中，所述第二连接建立请求是所述中间代理节点通过加密代理连接截获所述用户代理向所述网络服务器发送的所述第一访问请求后，指示所述用户代理发送的，所述加密代理连接是所述中间代理节点截获所述用户代理向所述网络服务器发送的TCP连接请求，读取所述TCP连接请求中的信息，根据所述 信息顶替所述网络服务器与所述用户代理建立TCP连接，在所述TCP连接建立完成后，利用预存的与所述网络服务器对应的数字证书与所述用户代理建立的。
第三方面，提供了一种业务处理装置，用于代理节点中，所述装置包括：总线，以及连接到所述总线的处理器、存储器、发射器和接收器。其中，所述存储器用于存储若干个指令，所述指令被配置成由所述处理器执行；
所述接收器，用于接收用户代理发送的第一密文，所述第一密文由所述用户代理使用第一密钥对业务信息进行加密得到；
所述处理器，用于使用第二密钥解密所述接收器接收到的所述第一密文，得到所述业务信息；
所述发射器，用于将所述处理器解密后的所述业务信息发送给业务处理系统，以使所述业务处理系统将所述业务信息按照增值业务进行处理，并触发将处理后的所述业务信息发送给网络服务器的流程；
其中，所述第一密钥和所述第二密钥是所述用户代理和所述代理节点在建立加密连接时约定的密钥。
在第三方面的第一种可能的实现方式中，所述代理节点是中间代理节点，
所述接收器，还用于在所述发射器将所述业务信息发送给业务处理系统之后，接收所述业务处理系统发送的处理后的所述业务信息；
所述处理器，还用于与所述网络服务器建立加密连接，并约定第三密钥和第四密钥；使用所述第三密钥加密所述业务信息，得到第二密文；
所述发射器，还用于将所述处理器加密后的所述第二密文发送给所述网络服务器，以使所述网络服务器使用所述第四密钥解密所述第二密文，得到所述业务信息。
根据第三方面的第一种可能的实现方式，在第三方面的第二种可能的实现方式中，
所述接收器，还用于在所述发射器将所述第二密文发送给所述网络服务器之后，接收所述网络服务器发送的第三密文，所述第三密文由所述网络服务器使用所述第四密钥对业务数据进行加密得到；
所述处理器，还用于使用所述第三密钥解密所述接收器接收到的所述第三密文，得到所述业务数据；
所述发射器，还用于将所述处理器解密后的所述业务数据发送给所述业务 处理系统，以使所述业务处理系统将所述业务数据按照增值业务进行处理，将处理后的所述业务数据发送给所述中间代理节点；
所述处理器，还用于使用所述第二密钥加密处理后的所述业务数据，得到第四密文；
所述发射器，还用于将所述处理器加密后的所述第四密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第四密文，得到所述业务数据。
根据第三方面的第一种可能的实现方式或第三方面的第二种可能的实现方式，在第三方面的第三种可能的实现方式中，
所述接收器，还用于在接收用户代理发送的第一密文之前，截获所述用户代理向所述网络服务器发送的第一访问请求，所述发射器，还用于指示所述用户代理发送第一连接建立请求，所述处理器，还用于根据所述用户代理发送的所述第一连接建立请求，与所述用户代理建立所述加密连接，所述第一访问请求用于请求访问所述网络服务器；或，
所述接收器，还用于在接收用户代理发送的第一密文之前，接收所述用户代理发送的第一连接建立请求，所述处理器，还用于根据所述用户代理发送的所述第一连接建立请求，与所述用户代理建立所述加密连接，所述第一连接建立请求是所述用户代理在接收到用户触发的触发信号后发送的，所述触发信号是用户触发所述用户代理中预存的所述中间代理节点的网页后生成的。
根据第三方面的第三种可能的实现方式，在第三方面的第四种可能的实现方式中，所述发射器，具体用于通过重定向响应指示所述用户代理发送所述第一连接建立请求。
根据第三方面的第四种可能的实现方式，在第三方面的第五种可能的实现方式中，
所述重定向响应包括所述中间代理节点的网址，或，
所述重定向响应包括代理网址，所述代理网址由所述中间代理节点对所述网络服务器的指示信息添加代理指示得到，所述指示信息为网页指示信息、网页中对象的对象指示信息、对所述网页指示信息或所述对象指示信息进行转换后得到的信息中的一种。
根据第三方面的第五种可能的实现方式，在第三方面的第六种可能的实现方式中，当所述重定向响应包括所述中间代理节点的网址时，
所述接收器，还用于在所述处理器根据所述用户代理发送的所述第一连接建立请求，与所述用户代理建立所述加密连接之后，接收所述用户代理发送的第五密文，所述第五密文由所述用户代理使用所述第一密钥对第二访问请求进行加密得到，所述第二访问请求用于请求访问所述中间代理节点；
所述处理器，还用于使用所述第二密钥解密所述接收器接收到的所述第五密文，得到所述第二访问请求；获取所述中间代理节点的网页；使用所述第二密钥加密所述网页，得到第六密文；
所述发射器，还用于将所述所述处理器加密后的第六密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第六密文，得到所述网页，所述网页用于触发所述用户代理发送所述第一密文。
在第三方面的第七种可能的实现方式中，所述代理节点是位于所述用户代理和中间代理节点之间的前端代理节点，还包括：
所述接收器，还用于在所述发射器将所述业务信息发送给业务处理系统之后，接收所述业务处理系统发送的业务数据；
所述处理器，还用于使用所述第二密钥加密所述接收器接收到的所述业务数据，得到第七密文；
所述发射器，还用于将所述处理器加密后的所述第七密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第七密文，得到所述业务数据。
根据第三方面的第七种可能的实现方式，在第三方面的第八种可能的实现方式中，
所述接收器，还用于在接收用户代理发送的第一密文之前，截获所述用户代理向中间代理节点发送的第二连接建立请求，所述第二连接建立请求包括所述中间代理节点的目的因特网协议IP地址；
所述处理器，用于根据所述目的IP地址和预存的所述中间代理节点的节点信息，与所述用户代理建立所述加密连接。
根据第三方面的第八种可能的实现方式，在第三方面的第九种可能的实现方式中，
所述第二连接建立请求是所述中间代理节点截获所述用户代理向所述网络服务器发送的第一访问请求后，指示所述用户代理发送的，所述第一访问请求用于请求访问所述网络服务器，或，
所述第二连接建立请求是所述用户代理在接收到用户触发的触发信号后发送的，所述触发信号是用户触发所述用户代理中预存的所述中间代理节点的网页后生成的。
根据第三方面的第九种可能的实现方式，在第三方面的第十种可能的实现方式中，当所述第二连接建立请求是所述中间代理节点截获所述第一访问请求后，通过重定向响应指示所述用户代理发送的时，
所述重定向响应包括所述中间代理节点的网址；或，
所述重定向响应包括代理网址，所述代理网址由所述中间代理节点对所述网络服务器的指示信息添加代理指示得到，所述指示信息为网页指示信息、网页中对象的对象指示信息、对所述网页指示信息或所述对象指示信息进行转换后得到的信息中的一种。
根据第三方面的第十种可能的实现方式，在第三方面的第十一种可能的实现方式中，当所述重定向响应包括所述中间代理节点的网址时，
所述接收器，还用于在所述处理器根据所述目的IP地址和预存的所述中间代理节点的节点信息，与所述用户代理建立所述加密连接之后，接收所述用户代理发送的第五密文，所述第五密文由所述用户代理使用所述第一密钥对第二访问请求进行加密得到，所述第二访问请求用于请求访问所述中间代理节点；
所述处理器，还用于使用所述第二密钥解密所述接收器接收到的所述第五密文，得到所述第二访问请求；
所述发射器，还用于将所述处理器解密后的所述第二访问请求发送给所述业务处理系统，以使所述业务处理系统将所述第二访问请求按照增值业务进行处理，将处理后的所述第二访问请求请求发送给所述中间代理节点；
所述处理器，还用于使用所述第二密钥加密所述业务处理系统发送的网页，得到第六密文，所述网页由所述中间代理节点发送给所述业务处理系统；
所述发射器，还用于将所述处理器加密后的所述第六密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第六密文，得到所述网页，所述网页用于触发所述用户代理发送所述第一密文。
根据第三方面的第八种可能的实现方式或第三方面的第九种可能的实现方式或第三方面的第十种可能的实现方式或第三方面的第十一种可能的实现方式，在第三方面的第十二种可能的实现方式中，
所述节点信息包括数字证书和私钥，所述发射器，具体用于将所述数字证书发送给所述用户代理，所述接收器，具体用于接收所述用户代理根据所述数字证书携带的公钥发送的加密信息，所述处理器，具体用于使用所述私钥对所述加密信息进行解密得到预主密钥，并使用所述目的IP地址与所述用户代理建立所述加密连接；或，
所述节点信息包括数字证书，所述发射器，具体用于将所述数字证书发送给所述用户代理，所述接收器，具体用于接收所述用户代理根据所述数字证书携带的公钥发送的加密信息，所述发射器，还用于将所述加密信息发送给所述中间代理节点，所述接收器，还用于接收所述中间代理节点使用私钥对所述加密信息进行解密后发送的预主密钥，所述处理器，具体用于使用所述目的IP地址与所述用户代理建立所述加密连接；
其中，所述预主密钥用于生成所述第一密钥和所述第二密钥。
根据第三方面的第三种可能的实现方式，在第三方面的第十三种可能的实现方式中，
所述接收器，还用于截获所述用户代理向所述网络服务器发送的第一访问请求之前，截获所述用户代理向所述网络服务器发送的传输控制协议TCP连接请求；
所述处理器，还用于读取所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接，在所述TCP连接建立完成后，利用预存的与所述网络服务器对应的数字证书与所述用户代理建立加密代理连接，所述加密代理连接供所述用户代理向所述网络服务器发送所述第一访问请求。
根据第三方面的第十三种可能的实现方式，在第三方面的第十四种可能的实现方式中，
所述发射器，还用于向所述用户代理发送第一数字证书，所述第一数字证书是证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述证书颁发机构的第二数字证书预先配置在所述用户代理中或安装有所述用户代理的终端的操作系统中，以使所述用户代理根据所述第二数字证书验证所述第一数字证书，在验证通过后，与所述中间代理节点建立所述加密代理连接；或，
所述发射器，还用于向所述用户代理发送第三数字证书和第四数字证书，所述第三数字证书是非授权证书颁发机构颁发的且与所述网络服务器对应的 数字证书，所述第四数字证书是所述非授权证书颁发机构的数字证书，以使所述用户代理根据所述第四数字证书验证所述第三数字证书，在验证通过后，与所述中间代理节点建立所述加密代理连接。
根据第三方面的第九种可能的实现方式，在第三方面的第十五种可能的实现方式中，所述第二连接建立请求是所述中间代理节点通过加密代理连接截获所述用户代理向所述网络服务器发送的所述第一访问请求后，指示所述用户代理发送的，所述加密代理连接是所述中间代理节点截获所述用户代理向所述网络服务器发送的TCP连接请求，读取所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接，在所述TCP连接建立完成后，利用预存的与所述网络服务器对应的数字证书与所述用户代理建立的。
本发明实施例提供的技术方案的有益效果是：
通过接收用户代理发送的第一密文，第一密文由用户代理使用第一密钥对业务信息进行加密得到；使用第二密钥解密第一密文，得到业务信息；将业务信息发送给业务处理系统，以使业务处理系统将业务信息按照增值业务进行处理，并触发将处理后的业务信息发送给网络服务器的流程，可以在用户代理使用SSL/TLS协议时，通过代理节点对传输的第一密文进行解密，并将解密后的业务信息发送给业务处理系统，解决了业务处理系统无法解密密文，导致业务处理系统无法为使用SSL/TLS协议的用户代理提供增值业务的问题，达到了扩大增值业务的使用范围的效果。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本发明实施例提供的一种业务处理方法的方法流程图；
图2是本发明实施例提供的又一种业务处理方法的方法流程图；
图3是本发明实施例提供的一种TLS连接的建立示意图；
图4A是本发明实施例提供的第一种业务处理方法的应用流程图；
图4B是本发明实施例提供的第二种业务处理方法的应用流程图；
图5是本发明实施例提供的又一种加密连接的建立示意图；
图6A是本发明实施例提供的第三种业务处理方法的应用流程图；
图6B是本发明实施例提供的第四种业务处理方法的应用流程图；
图7是本发明实施例提供的又一种加密连接的建立示意图；
图8A是本发明实施例提供的第五种业务处理方法的应用流程图；
图8B是本发明实施例提供的第六种业务处理方法的应用流程图；
图9是本发明实施例提供的一种业务处理装置的结构示意图；
图10是本发明实施例提供的又一种业务处理装置的结构示意图；
图11是本发明实施例提供的一种业务处理装置的结构示意图。
具体实施方式
为使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明实施方式作进一步地详细描述。
请参见图1，其示出了本发明实施例提供的一种业务处理方法的方法流程图。该业务处理方法，可以包括：
步骤101，代理节点接收用户代理发送的第一密文，第一密文由用户代理使用第一密钥对业务信息进行加密得到。
步骤102，代理节点使用第二密钥解密第一密文，得到业务信息。
步骤103，代理节点将业务信息发送给业务处理系统，以使业务处理系统将业务信息按照增值业务进行处理，并触发将处理后的业务信息发送给网络服务器的流程。
其中，第一密钥和第二密钥是用户代理和代理节点在建立加密连接时约定的密钥。
综上所述，本发明实施例提供的业务处理方法，通过接收用户代理发送的第一密文；使用第二密钥解密第一密文，得到业务信息；将业务信息发送给业务处理系统，以使业务处理系统将业务信息按照增值业务进行处理，并触发将处理后的业务信息发送给网络服务器的流程，可以在用户代理使用SSL/TLS协议时，通过代理节点对传输的第一密文进行解密，并将解密后的业务信息发送给业务处理系统，解决了业务处理系统无法解密密文，导致业务处理系统无法为使用SSL/TLS协议的用户代理提供增值业务的问题，达到了扩大增值业务 的使用范围的效果。
请参见图2，其示出了本发明实施例提供的又一种业务处理方法的方法流程图。本实施例以代理节点是中间代理节点、用户代理和中间代理节点建立加密连接、中间代理节点和网络服务器建立加密连接为例进行说明，该业务处理方法，可以包括：
步骤201，中间代理节点接收用户代理发送的第一密文，第一密文由用户代理使用第一密钥对业务信息进行加密得到。
本实施例中，中间代理节点可以是Portal。当然，中间代理节点还可以是其它站点，本实施例不作限定。
业务信息用于与网络服务器进行业务交互，可以具体用于向网络服务器请求业务，也可以具体用于向网络服务器发送业务数据。其中，当业务信息用于向网络服务器请求业务时，业务信息可以用于请求网络服务器的主页，也可以用于请求网络服务器中的对象(object)，该对象可以是网络服务器中存储的对象，也可以是其它服务器中存储的对象且该对象的统一资源标示符(英文：uniform resource identifier；简称：URI)包含在网络服务器的网页中。
比如，当网络服务器是OTT服务器且业务信息用于向OTT服务器请求OTT服务器的主页时，此时业务信息包括www.ottserver.com；当OTT服务器的网页包括URI且业务信息用于向OTT服务器请求该URI所指示的对象时，假设网页包括的URI为www.ottserver.com/picture1.gif且用户需要获取访问该URI所指示的图片1，此时业务信息包括www.ottserver.com/picture1.gif。
可选的，业务信息可以由中间代理节点对上述网址添加代理指示得到。其中，代理指示用于指示中转业务的中间代理节点，可以是中间代理节点的网址。比如，当中间代理节点是portal时，代理指示可以是中间代理节点的网址www.portal.com。
在添加代理指示，当业务信息用于请求网络服务器提供的主页时，指示信息是网页指示信息，即网络服务器的网址，此时业务信息可以是www.portal.com/view？q＝www.ottserver.com；当业务信息用于请求网络服务器中的对象时，指示信息是对象指示信息，即对象的URI，此时业务信息可以是www.portal.com/view？q＝www.ottserver.com/picture1.gif。
可选的，中间代理节点还可以对网页指示信息或对象指示信息进行转换， 并对转换后得到的信息添加代理指示，得到业务信息。通过转换可以将明文转换为密文进行传输，可以提高数据传输的安全性。比如，www.ottserver.com可以用www.abcd1234指代，此时www.portal.com/view？q＝www.abcd1234为www.portal.com/view？q＝www.ottserver.com。
在中间代理节点接收用户代理发送的第一密文之前，中间代理节点需要与用户代理建立加密连接，并在建立加密连接的过程中约定密钥。
当同一个设备的加密密钥和解密密钥相同时，可以约定第一密钥和第二密钥，第一密钥存储于用户代理中，用户代理可以使用第一密钥加密将要发送给中间代理节点的明文，也可以使用第一密钥解密中间代理节点发送的密文；第二密钥存储于中间代理节点中，中间代理节点可以使用第二密钥加密将要发送给用户代理的明文，也可以使用第二密钥解密用户代理发送的密文。当同一个设备的加密密钥和解密密钥不同时，可以约定第一密钥和第二密钥，并约定第五密钥和第六密钥，第一密钥和第五密钥存储于用户代理中，用户代理可以使用第一密钥加密将要发送给中间代理节点的明文，使用第五密钥解密中间代理节点发送的密文；第二密钥和第六密钥存储于中间代理节点中，中间代理节点可以使用第二密钥加密将要发送给用户代理的明文，使用第六密钥解密用户代理发送的密文。其中，第一密钥和第二密钥可以是对称密钥，也可以是不对称密钥；第五密钥和第六密钥可以是对称密钥，也可以是不对称密钥。下文以同一个设备的加密密钥和解密密钥相同为例进行说明。
加密连接可以是基于SSL/TLS协议的连接。由于基于SSL协议的加密连接和基于TLS协议的加密连接的建立过程类似，下文以基于TLS协议的加密连接为例进行说明。
本实施例提供了中间代理节点与用户代理之间的加密连接的两种建立方式，具体如下：
在第一种建立方式中，中间代理节点截获用户代理向网络服务器发送的第一访问请求，指示用户代理发送第一连接建立请求，根据用户代理发送的第一连接建立请求，与用户代理建立加密连接，第一访问请求用于请求访问网络服务器。
其中，第一访问请求可以具体请求访问网络服务器的主页或网络服务器中的对象。
中间代理节点与用户代理建立传输控制协议(英文：transmission control  protocol；简称：TCP)连接。其中，TCP连接的端口包括80端口和443端口，若用户代理需要基于HTTP协议访问网络服务器，则TCP连接的端口为80端口；若用户代理需要基于下层使用了SSL/TLS协议的超文本传输安全协议(英文：hyper text transfer protocol over secure socket layer；简称：HTTPS)访问网络服务器，则TCP连接的端口为443端口。下面分别以TCP连接的端口是80端口和443端口为例，对中间代理节点与用户代理之间的加密连接的建立方式进行说明。
第一，当中间代理节点与用户代理建立的TCP连接的端口是80端口时，指示所述用户代理发送第一连接建立请求，包括：通过重定向响应指示用户代理发送第一连接建立请求。
重定向响应可以是HTTP Redirection。可选的，重定向响应的location头域中可以包括类型信息，该类型信息用于指示用户代理请求建立的连接类型。比如，当重定向响应需要指示用户代理建立加密连接时，可以在类型信息中携带HTTPS，HTTPS用于指示HTTPS协议；当重定向响应需要指示用户代理建立非加密连接时，可以在类型信息中携带HTTP，HTTP用于指示HTTP协议。本实施例以类型信息中携带HTTPS为例进行说明，此时第一连接建立请求用于请求建立加密连接，且加密连接的端口为443端口。
需要说明的是，中间代理节点可以直接向用户代理发送重定向响应；或，中间代理节点可以将第一访问请求发送给业务处理系统，在接收到经业务处理系统处理后的第一访问请求后，将该处理后的第一访问请求发送给用户代理；或，中间代理节点可以检测是否需要将第一访问请求发送给业务处理系统进行处理，当检测出不需要业务处理系统处理时，向用户代理发送重定向响应，当检测出需要业务处理系统处理时，将第一访问请求发送给业务处理系统，在接收到经业务处理系统处理后的第一访问请求后，将该处理后的第一访问请求发送给用户代理。
第二，当中间代理节点与用户代理建立的TCP连接的端口是443端口时，本实施例提供的方法，还包括：
1)中间代理节点截获用户代理向网络服务器发送的TCP连接请求；
2)中间代理节点读取TCP连接请求中的信息，根据该信息顶替网络服务器与用户代理建立TCP连接，在TCP连接建立完成后，利用预存的与网络服务器对应的数字证书与用户代理建立加密代理连接，加密代理连接供用户代理 向网络服务器发送第一访问请求。
其中，TCP连接请求中的信息包括源端因特网协议(英文：Internet Protocol；简称：IP)地址，源端端口，目的端IP地址，目的端端口，源端为用户代理，目的端为网络服务器。中间代理节点利用上述信息顶替网络服务器，与用户代理建立端口是443端口的TCP连接，在TCP连接建立完成后，再利用预存的与网络服务器对应的数字证书与用户代理建立加密代理连接，加密代理连接是指中间代理节点顶替网络服务器，与用户代理之间建立的加密连接。
请参考图3所示的一种TLS连接的建立示意图，其示出了用户代理与中间代理节点建立TLS连接的过程。
步骤301，用户代理向中间代理节点发送TLS协议版本号、加密算法列表和第一随机数。
步骤302，若中间代理节点支持该TLS协议版本，则从加密算法列表中选择的一个加密算法，向用户代理发送TLS协议版本号、加密算法、会话标识和第二随机数。
步骤303，中间代理节点向用户代理发送与网络服务器对应的数字证书。
步骤304，中间代理节点向用户代理发送第一完成消息。
步骤305，用户代理对数字证书进行验证，在验证通过后，获取数字证书中的公钥，生成预主密钥，并使用公钥加密预主密钥，将得到公钥交换信息发送给中间代理节点。
步骤306，用户代理向中间代理节点发送更改密码说明，通知中间代理节点启动协商好的参数。
此时，用户代理根据第一随机数、第二随机数、预主密钥和加密算法生成第一密钥。
步骤307，用户代理向中间代理节点发送第二完成消息。
步骤308，中间代理节点向用户代理发送更改密码说明，通知用户代理启动协商好的参数。
此时，中间代理节点使用私钥解密公钥交换信息，得到预主密钥，根据第一随机数、第二随机数、预主密钥和加密算法生成第二密钥。
步骤309，中间代理节点向用户代理发送第三完成消息。
本实施例中，中间代理节点可以在与用户代理建立加密代理连接的过程中，与用户代理约定加密密钥和解密密钥。此时，中间代理节点可以使用加密 密钥对重定向响应进行加密，将加密得到的密文发送给用户代理，用户代理使用解密密钥对密文进行解密后，得到重定向响应。用户代理根据重定向响应生成第一连接建立请求，将第一连接建立请求发送给中间代理节点，中间代理节点得到第一连接建立请求。
需要说明的是，中间代理节点在与用户代理建立加密代理连接之前，还需要获取与网络服务器对应的数字证书和私钥，数字证书至少包括公钥、拥有者名称和证书颁发机构的数字签名，数字签名是指对信息进行哈希运算得到的哈希值，用于验证信息是否被篡改。本实施例中的数字签名用于验证数字证书是否被篡改。
因此，利用预存的与网络服务器对应的数字证书与用户代理建立加密代理连接，包括：
1)中间代理节点向用户代理发送第一数字证书，第一数字证书是证书颁发机构颁发的且与网络服务器对应的数字证书，证书颁发机构的第二数字证书预先配置在用户代理中或安装有用户代理的终端的操作系统中，以使用户代理根据第二数字证书验证第一数字证书，在验证通过后，与中间代理节点建立加密代理连接；或，
2)中间代理节点向用户代理发送第三数字证书和第四数字证书，第三数字证书是非授权证书颁发机构颁发的且与网络服务器对应的数字证书，第四数字证书是非授权证书颁发机构的数字证书，以使用户代理根据第四数字证书验证第三数字证书，在验证通过后，与中间代理节点建立加密代理连接。
其中，与网络服务器对应的数字证书可以是网络服务器的真实数字证书，也可以是除真实数字证书之外的其他数字证书，该其他数字证书与网络服务器之间存在对应关系。本实施例中，其他数字证书可以是代理数字证书，也可以是假冒的数字证书，具体内容如下所述。
在第一种实现方式中，证书颁发机构可以是授权证书颁发机构，也可以是非授权证书颁发机构。
当证书颁发机构是授权证书颁发机构时，授权证书颁发机构根据安全监控等需要为可信的中间代理节点颁发网络服务器的代理数字证书，该代理数字证书即第一数字证书。其中，授权证书颁发机构可以为每个网络服务器颁发不同的代理数字证书，也可以为多个不同的网络服务器颁发相同的代理数字证书，本实施例不作限定。
其中，网络服务器的代理数字证书也可以是网络服务器的数字证书链上的子证书。该子证书可以由网络服务器颁发，也可以由其他第三方授权证书颁发机构颁发。
本实施例中，代理数字证书可以与授权证书颁发机构为网络服务器颁发的真实数字证书相同，也可以与真实数字证书不同。即，代理数字证书与真实数字证书可以拥有不同的公钥和私钥对。
当证书颁发机构是非授权证书颁发机构时，非授权证书颁发机构为中间代理节点颁发与网络服务器对应的数字证书，此时的数字证书是假冒的数字证书，该假冒的数字证书即第一数字证书。
在用户代理验证数字证书时，会检测该数字证书的证书颁发机构的根证书是否位于可信认证中心(英文：Certificate Authority；简称：CA)列表中，根证书即第二数字证书。若该根证书位于可信CA列表中，则根据该根证书的公钥验证数字证书中的数字签名，若对数字签名的验证成功，则对数字证书的验证成功；若对数字签名的验证失败，则对数字证书的验证失败；若该根证书不在可信CA列表中，则对数字证书的验证失败。
可选的，中间代理节点获取到的与网络服务器对应的数字证书可以是多级证书颁发机构颁发的。比如，中间代理节点获取到的与网络服务器对应的数字证书是中级证书颁发机构Issuer颁发的，中级证书颁发机构Issuer的数字证书是高级证书颁发机构Root CA颁发的。此时，用户代理逐级寻找证书颁发机构的数字证书，检测该数字证书的证书颁发机构的根证书是否位于可信CA列表中，若该根证书位于可信CA列表中，则根据该根证书的公钥验证下级数字证书中的数字签名，若对数字签名的验证成功，则根据下级数字证书的公钥验证下下级数字证书中的数字签名，直至对所有的数字签名验证成功后，对数字证书的验证成功；若对其中一个数字签名的验证失败，则对数字证书的验证失败；若该根证书不在可信CA列表中，则对数字证书的验证失败。
需要说明的是，当证书颁发机构是授权证书颁发机构时，该授权证书颁发机构的根证书预先配置在用户代理中或安装有用户代理的终端的操作系统中，即，该授权证书颁发机构的根证书预先配置在可信CA列表中；当证书颁发机构是非授权证书颁发机构时，还需要将该非授权证书颁发机构的根证书添加到可信CA列表中。
在一种添加方式中，可以与操作系统厂家或用户代理的厂家进行协商，将 非授权证书颁发机构的根证书添加到可信CA列表中；在第二种添加方式中，可以提示用户安装非授权证书颁发机构的根证书，通过该非授权证书颁发机构的根证书添加到可信CA列表中。
在第二种实现方式中，中间代理节点可以获取非授权证书颁发机构发送的数字证书链，该数字证书链至少包括非授权证书颁发机构的数字证书，即自签名的根证书，也即第四数字证书，以及网络服务器的假冒的数字证书，中间代理节点将该数字证书链发送给用户代理，该假冒的数字证书即第三数字证书。
在用户代理验证数字证书时，会读取接收到的数字证书链中根证书的公钥，根据该公钥验证假冒的数字证书中的数字签名，若对数字签名的验证成功，则对假冒的数字证书的验证成功；若对数字签名的验证失败，则对假冒的数字证书的验证失败。
可选的，中间代理节点获取到的假冒的数字证书可以是多级非授权证书颁发机构颁发的，即，证书链还包括多级非授权证书颁发机构的数字证书。比如，中间代理节点获取到的与网络服务器对应的数字证书是非授权的中级证书颁发机构Issuer颁发的，非授权的中级证书颁发机构Issuer的数字证书是非授权的高级证书颁发机构Root CA颁发的。此时，用户代理从接收到的数字证书中逐级寻找非授权的证书颁发机构的根证书，根据根证书的公钥验证下级数字证书中的数字签名，若对数字签名的验证成功，则根据下级数字证书的公钥验证下下级数字证书中的数字签名，直至对所有的数字签名验证成功后，对数字证书的验证成功；若对其中一个数字签名的验证失败，则对数字证书的验证失败。
在第二种建立方式中，中间代理节点接收用户代理发送的第一连接建立请求，根据用户代理发送的第一连接建立请求，与用户代理建立加密连接，第一连接建立请求是用户代理在接收到用户触发的触发信号后发送的，触发信号是用户触发用户代理中预存的中间代理节点的网页后生成的。
中间代理节点的网页可以作为主页、书签、配置信息等方式存储在用户代理中，或，用户代理中安装有为中间代理节点定制的应用程序、业务等，用户可以直接从用户代理中获取并触发该网页。其中，用户触发网页包括以下方式中的至少一种：中间代理节点的网页包含输入框，当用户在输入框中输入网络服务器的网址或信息时，触发该网页，该信息可以是IP地址或域名等；中间代理节点的网页包含超链接，当用户点击超链接时，触发该网页。
中间代理节点与用户代理建立TLS连接的流程与图3所示的流程类似，不 同的是，在步骤303中，中间代理节点向用户代理发送的是中间代理节点的数字证书。
本实施例中，重定向响应包括中间代理节点的网址，或，重定向响应包括代理网址，代理网址由中间代理节点对网络服务器的指示信息添加代理指示得到，指示信息为网页指示信息、网页中对象的对象指示信息、对网页指示信息或对象指示信息进行转换后得到的信息中的一种。
其中，重定向响应需要包括中间代理节点的网址，以便用户代理通过中间代理节点访问网络服务器。在第一种实现方式中，重定向响应可以只包括中间代理节点的网址www.portal.com。在第二种实现方式中，重定向响应不仅包括中间代理节点的网址，还包括网络服务器的网页指示信息或对象指示信息或对上述两种信息中的一种进行转换后得到的信息，网页指示信息和对象指示信息可以从第一访问请求中获取到。比如，当网页指示信息是网络服务器的网址www.ottserver.com时，重定向响应可以包括www.portal.com/view？q＝www.ottserver.com；当对象指示信息是www.ottserver.com/picture1.gif时，重定向响应可以包括www.portal.com/view？q＝www.ottserver.com/picture1.gif。
可选的，当重定向响应包括中间代理节点的网址时，中间代理节点根据用户代理发送的第一连接建立请求，与用户代理建立加密连接之后，还包括：
1)中间代理节点接收用户代理发送的第五密文，第五密文由用户代理使用第一密钥对第二访问请求进行加密得到，第二访问请求用于请求访问中间代理节点；
2)中间代理节点使用第二密钥解密第五密文，得到第二访问请求；
3)中间代理节点获取中间代理节点的网页；
4)中间代理节点使用第二密钥加密网页，得到第六密文；
5)中间代理节点将第六密文发送给用户代理，以使用户代理使用第一密钥解密第六密文，得到网页，网页用于触发用户代理发送第一密文。
其中，第二访问请求可以具体请求访问中间代理节点的主页或中间代理节点中的对象。
若重定向响应只包括中间代理节点的网址，则用户代理还需要根据中间代理节点的网址获取中间代理节点的网页，以便用户在接收到网页后，触发该网页，用户代理根据该触发发送第一连接建立请求，并在与中间代理节点建立加 密连接之后发送第一密文。
需要说明的是，中间代理节点可以直接获取中间代理节点的网页；或，中间代理节点可以将第二访问请求发送给业务处理系统，在接收到经业务处理系统处理后的第二访问请求后，获取中间代理节点的网页；或，中间代理节点可以检测是否需要将第二访问请求发送给业务处理系统进行处理，当检测出不需要业务处理系统处理时，获取中间代理节点的网页，当检测出需要业务处理系统处理时，将第二访问请求发送给业务处理系统，在接收到经业务处理系统处理后的第二访问请求后，获取中间代理节点的网页。
其中，中间代理节点在检测是否需要将第二访问请求发送给业务处理系统进行处理时，可以检测第二访问请求包括的网址是否是自身的网址，若检测出第二访问请求包括的网址是自身的网址，则确定不需要将第二访问请求发送给业务处理系统进行处理，若检测出第二访问请求包括的网址不是自身的网址，则确定需要将第二访问请求发送给业务处理系统进行处理。当然，中间代理节点还可以通过其它方法检测是否需要将第二访问请求发送给业务处理系统进行处理，本实施例不作限定。
步骤202，中间代理节点使用第二密钥解密第一密文，得到业务信息。
中间代理节点确定与第一密钥对应的第二密钥，再使用第二密钥解密第一密文，得到业务信息。
步骤203，中间代理节点将业务信息发送给业务处理系统，以使业务处理系统将业务信息按照增值业务进行处理，并触发将处理后的业务信息发送给网络服务器的流程。
本实施例中，业务处理系统在接收到业务信息后，可以根据业务信息确定用户代理，再确定该用户代理定制的增值业务，将业务信息按照该增值业务进行处理。具体地，业务处理系统可以确定实现该增值业务的业务链，将业务信息发送给该业务链中的业务处理单元，由业务链中的各个业务处理单元依次处理该业务信息，再将处理后的业务信息发送给网络服务器。
需要说明的是，当重定向响应包括的是对网页指示信息或对象指示信息进行转换后得到的信息，此时接收到的业务信息包括该信息，中间代理节点可以将该信息转换为对应的网页指示信息或对象指示信息，再将转换后的信息发送给业务处理系统。
步骤204，中间代理节点接收业务处理系统发送的处理后的业务信息。
步骤205，中间代理节点与网络服务器建立加密连接，并约定第三密钥和第四密钥。
当业务信息包括网页指示信息或对网页指示信息进行转换后得到的信息时，中间代理节点从处理后的业务信息中解析出网络服务器的网址，与该网址所指示的网络服务器建立加密连接，并约定第三密钥和第四密钥。其中，中间代理节点和网络服务器建立加密连接的过程与中间代理节点和用户代理建立加密连接的过程类似，此处不赘述。
当业务信息包括对象指示信息或对对象指示信息进行转换后得到的信息时，在第一种实现方式中，当中间代理节点已经获取过网络服务器的网页，即，中间代理节点已经与网络服务器建立了加密连接，此时可以不执行步骤205，直接执行步骤206；在第二种实现方式中，当中间代理节点未获取过网络服务器的主页时，中间代理节点从处理后的业务信息中解析出网络服务器的网址，与该网址所指示的网络服务器建立加密连接，并约定第三密钥和第四密钥，此处不赘述。
步骤206，中间代理节点使用第三密钥加密业务信息，得到第二密文。
本步骤中的业务信息可以是去除了中间代理节点的网址的业务信息。即，此时的业务信息只包括网络服务器指示信息，或，业务信息只包括对象指示信息。
步骤207，中间代理节点将第二密文发送给网络服务器，以使网络服务器使用第四密钥解密第二密文，得到业务信息。
步骤208，中间代理节点接收网络服务器发送的第三密文，第三密文由网络服务器使用第四密钥对业务数据进行加密得到。
网络服务器根据业务信息获取对应的业务数据，并使用第四密钥加密该业务数据，得到第三密文，将第三密文发送给中间代理节点。比如，当业务信息包括www.ottserver.com时，业务数据可以是网络服务器的主页；当业务信息包括www.ottserver.com/picture1.gif时，业务数据可以是图片1。
步骤209，中间代理节点使用第三密钥解密第三密文，得到业务数据。
步骤210，中间代理节点将业务数据发送给业务处理系统，以使业务处理系统将业务数据按照增值业务进行处理，将处理后的业务数据发送给中间代理节点。
比如，当业务数据是图片1，业务处理系统可以在接收到图片1后，将图 片1的分辨率由原来的640*480转换为320*240，再将转换后的图片1发送给中间代理节点。
步骤211，中间代理节点使用第二密钥加密处理后的业务数据，得到第四密文。
其中，当业务数据是网络服务器的网页时，该网页中还可以包括对象指示信息，此时中间代理节点还需要对对象指示信息添加代理指示。比如，当网页包括图片1的URI时，中间代理节点可以对www.ottserver.com/picture1.gif添加中间代理节点的网址www.portal.com，得到www.portal.com/view？q＝www.ottserver.com/picture1.gif。
步骤212，中间代理节点将第四密文发送给用户代理，以使用户代理使用第一密钥解密第四密文，得到业务数据。
综上所述，本发明实施例提供的业务处理方法，通过接收用户代理发送的第一密文；使用第二密钥解密第一密文，得到业务信息；将业务信息发送给业务处理系统，以使业务处理系统将业务信息按照增值业务进行处理，并触发将处理后的业务信息发送给网络服务器的流程，可以在用户代理使用SSL/TLS协议时，通过代理节点对传输的第一密文进行解密，并将解密后的业务信息发送给业务处理系统，解决了业务处理系统无法解密密文，导致业务处理系统无法为使用SSL/TLS协议的用户代理提供增值业务的问题，达到了扩大增值业务的使用范围的效果。
另外，重定向响应包括代理网址，代理网址由中间代理节点对网络服务器的指示信息添加代理指示得到，指示信息为网页指示信息、网页中对象的对象指示信息、对网页指示信息或对象指示信息进行转换后得到的信息中的一种，可以直接向用户代理发送网页指示信息或对象指示信息或对上述两种信息中的一种进行转换后得到的信息，而不需要先获取中间代理节点的网页，再触发中间代理节点的网页来获取网页指示信息或对象指示信息或对上述两种信息中的一种进行转换后得到的信息，可以简化操作流程，提高了业务处理的效率。
下面以代理节点是中间代理节点，用户代理和中间代理节点建立加密连接、中间代理节点和网络服务器建立加密连接为例，对业务处理方法的流程进行描述。请参考图4A所示的第一种业务处理方法的应用流程图，图4A以中间代理节点是Portal、用户代理是UA、网络服务器是OTT Server、业务处理 系统是GI-LAN、图4A中涉及的请求都是HTTP请求且以HTTP请求为GET请求为例。
步骤401，UA和Portal之间建立TCP连接(80端口)。
其中，当第一连接建立请求由中间代理节点指示用户代理发送时，执行步骤402；当第一连接建立请求由用户触发用户代理发送时，执行步骤404。
步骤402，Portal截获UA向OTT Server发送的GET请求，GET请求包括www.ottserver.com。其中，GET请求是第一访问请求。
步骤403，Portal向UA发送重定向响应和/或需要通过HTTPS协议访问的类型信息。其中，HTTPS协议是下层使用了SSL/TLS协议的HTTP协议。
其中，当重定向响应包括www.portal.com时，执行步骤404；当重定向响应包括www.portal.com/view？q＝www.ottserver.com时，执行步骤409。
步骤404，若Portal需要通过HTTPS协议访问，UA与Portal重新建立TCP连接(443端口)。
步骤405，UA和Portal之间TLS握手过程。
步骤406，UA向Portal发送加密的GET请求，GET请求包括www.portal.com。其中，GET请求是第二访问请求。
步骤407，Portal解密GET请求后发送给GI-LAN，GI-LAN处理后再返回给Portal。
步骤408，Portal向UA回复加密的200ok响应，返回www.portal.com的网页。
步骤409，UA向Portal发送加密的GET请求，GET请求包括www.portal.com/view？q＝www.ottserver.com。
步骤410，Portal解密GET请求后发送给GI-LAN，GI-LAN处理后再返回给Portal。
步骤411，Portal从处理后的GET请求解析出www.ottserver.com。
步骤412，Portal和OTT Server之间建立TCP连接(端口443)。
步骤413，Portal和OTT Server之间TLS握手过程。
步骤414，Portal向OTT Server发送加密的GET请求，GET请求包括www.ottserver.com。
步骤415，OTT Server向Portal回复加密的200ok响应，返回www.ottserver.com的网页。
步骤416，Portal解密200ok响应后发送到GI-LAN，GI-LAN处理后再返回给Portal。
步骤417，Portal对处理后的200ok响应添加www.portal.com的portal指示：如www.portal.com/view？q＝www.ottserver.com/picture1.gif。
步骤418，Portal向UA发送加密的200ok响应。
步骤419，UA向Portal发送加密的GET请求，GET请求包括www.portal.com/view？q＝www.ottserver.com/picture1.gif。
步骤420，Portal解密GET请求后发送给GI-LAN，GI-LAN处理后再返回给Portal。
步骤421，Portal从处理后的GET请求解析出www.ottserver.com/picture1.gif。
步骤422，Portal向OTT Server发送加密的GET请求，GET请求包括www.ottserver.com/picture1.gif。
步骤423，OTT Server向Portal加密的回复200ok响应，返回图片1。
步骤424，Portal解密200ok响应后发送给GI-LAN，GI-LAN处理后再返回给Portal。
步骤425，Portal对处理后的200ok响应添加www.portal.com的portal指示。
步骤426，Portal向UA发送加密的200ok响应。
请参考图4B所示的第二种业务处理方法的应用流程图，图4B以中间代理节点是Portal、用户代理是UA、网络服务器是OTT Server、业务处理系统是GI-LAN。
步骤401’，Portal截获UA向OTT Server发送的TCP连接请求，根据TCP连接请求中的信息顶替OTT Server与UA之间建立TCP连接(443端口)。
步骤402’，Portal利用与OTT Server对应的数字证书与UA之间TLS握手过程。
步骤403’，Portal截获UA向OTT Server发送的加密的GET请求，GET请求包括www.ottserver.com。其中，GET请求是第一访问请求。
步骤404’，Portal向UA发送加密后的重定向响应和/或需要通过HTTPS协议访问的加密后的类型信息。其中，HTTPS协议是下层使用了SSL/TLS协议的HTTP协议。
步骤405’，UA和Portal之间建立TCP连接(443端口)，TCP连接建立完成后，UA与Portal之间进行TLS握手过程。此时Portal使用的是自己的数字证书。
其中，当重定向响应包括www.portal.com时，执行步骤406’；当重定向响应包括www.portal.com/view？q＝www.ottserver.com时，执行步骤409’。
步骤406’至步骤427’的内容与步骤405至步骤426的内容相同此处不赘述。
请参见图5，其示出了本发明实施例提供的又一种业务处理方法的方法流程图。本实施例以代理节点是中间代理节点、用户代理和中间代理节点建立非加密连接、中间代理节点和网络服务器建立加密连接为例进行说明，该业务处理方法，可以包括：
步骤501，中间代理节点接收用户代理发送的业务信息。
本实施例中，中间代理节点可以是Portal。当然，中间代理节点还可以是其它站点，本实施例不作限定。请参考步骤201中关于业务信息的描述，此处不赘述。
本实施例提供了两种触发代理节点发送业务信息的方式，具体如下：
在第一种触发方式中，中间代理节点截获用户代理向网络服务器发送的第一访问请求，指示用户代理发送第二访问请求，中间代理节点根据第二访问请求获取中间代理节点的网页，将网页发送给用户代理，网页用于触发用户代理发送业务信息，第一访问请求用于请求访问网络服务器，第二访问请求用于请求访问中间代理节点，重定向响应包括中间代理节点的网址。
需要说明的是，中间代理节点可以直接获取中间代理节点的网页；或，中间代理节点可以将第二访问请求发送给业务处理系统，在接收到经业务处理系统处理后的第二访问请求后，获取中间代理节点的网页；或，中间代理节点可以检测是否需要将第二访问请求发送给业务处理系统进行处理，当检测出不需要业务处理系统处理时，获取中间代理节点的网页，当检测出需要业务处理系统处理时，将第二访问请求发送给业务处理系统，在接收到经业务处理系统处理后的第二访问请求后，获取中间代理节点的网页。其中，中间代理节点在检测是否需要将第二访问请求发送给业务处理系统进行处理的流程详见步骤201中的描述，此处不赘述。
在第二种触发方式中，中间代理节点截获用户代理向网络服务器发送的第一访问请求，指示用户代理发送业务信息，第一访问请求用于请求访问网络服务器，重定向响应包括代理网址，代理网址由中间代理节点对网络服务器的指示信息添加代理指示得到，指示信息为网页指示信息、网页中对象的对象指示信息、对网页指示信息或对象指示信息进行转换后得到的信息中的一种。
本实施例中，中间代理节点与用户代理建立的TCP连接的端口是80端口或443端口。当中间代理节点与用户代理建立的TCP连接的端口是443端口时，本实施例提供的方法，还包括：中间代理节点截获用户代理向网络服务器发送的TCP连接请求；中间代理节点读取TCP连接请求中的信息，根据该信息顶替网络服务器与用户代理建立TCP连接，在TCP连接建立完成后，利用预存的与网络服务器对应的数字证书与用户代理建立加密代理连接；中间代理节点通过加密代理连接指示用户代理发送第二访问请求。中间代理节点与用户代理建立加密代理连接的流程详见步骤201中的描述，此处不赘述。
可选的，利用预存的与网络服务器对应的数字证书与用户代理建立加密代理连接，包括：中间代理节点向用户代理发送第一数字证书，第一数字证书是证书颁发机构颁发的且与网络服务器对应的数字证书，证书颁发机构的第二数字证书预先配置在用户代理中或安装有用户代理的终端的操作系统中，以使用户代理根据第二数字证书验证第一数字证书，在验证通过后，与中间代理节点建立加密代理连接；或，中间代理节点向用户代理发送第三数字证书和第四数字证书，第三数字证书是非授权证书颁发机构颁发的且与网络服务器对应的数字证书，第四数字证书是非授权证书颁发机构的数字证书，以使用户代理根据第四数字证书验证第三数字证书，在验证通过后，与中间代理节点建立加密代理连接。中间代理节点根据与网络服务器对应的数字证书与用户代理建立加密代理连接的流程详见步骤201中的描述，此处不赘述。
其中，中间代理节点可以通过重定向响应指示用户代理发送第二访问请求或业务信息。可选的，重定向响应的location头域中可以包括类型信息，该类型信息用于指示用户代理请求建立的连接类型。本实施例以类型信息中携带HTTP为例进行说明，此时用户代理无需和中间代理节点再建立加密连接。
可选的，中间代理节点的网页可以作为主页、书签、配置信息等方式存储在用户代理中，或，用户代理中安装有为中间代理节点定制的应用程序、业务等，用户可以直接从用户代理中获取并触发该网页，此时，用户代理向中间代 理节点发送业务信息。其中，用户触发网页包括以下方式中的至少一种：中间代理节点的网页包含输入框，当用户在输入框中输入网络服务器的网址或信息时，触发该网页，该信息可以是IP地址或域名等；中间代理节点的网页包含超链接，当用户点击超链接时，触发该网页。
步骤502，中间代理节点将业务信息发送给业务处理系统，以使业务处理系统将业务信息按照增值业务进行处理，并触发将处理后的业务信息发送给网络服务器的流程。
本实施例中，业务处理系统在接收到业务信息后，可以根据业务信息确定用户代理，再确定该用户代理定制的增值业务，将业务信息按照该增值业务进行处理。具体地，业务处理系统可以确定实现该增值业务的业务链，将业务信息发送给该业务链中的业务处理单元，由业务链中的各个业务处理单元依次处理该业务信息，再将处理后的业务信息发送给网络服务器。
步骤503，中间代理节点接收业务处理系统发送的处理后的业务信息。
在中间代理节点接收到业务信息之后，中间代理节点需要与网络服务器建立网络连接，以传输该业务信息。其中，中间代理节点可以与网络服务器建立加密连接，此时执行步骤504；中间代理节点也可以与网络服务器建立非加密连接，此时中间代理节点直接将业务信息发送给网络服务器，接收网络服务器发送的业务数据，再执行步骤509。
步骤504，中间代理节点与网络服务器建立加密连接，并约定第三密钥和第四密钥。
当业务信息包括网页指示信息或对网页指示信息进行转换后得到的信息时，中间代理节点从处理后的业务信息中解析出网络服务器的网址，与该网址所指示的网络服务器建立加密连接，并约定第三密钥和第四密钥。
当业务信息包括对象指示信息或对对象指示信息进行转换后得到的信息时，在第一种实现方式中，当中间代理节点已经获取过网络服务器的网页，即，中间代理节点已经与网络服务器建立了加密连接，此时可以不执行步骤504，直接执行步骤505；在第二种实现方式中，当中间代理节点未获取过网络服务器的主页时，中间代理节点从处理后的业务信息中解析出网络服务器的网址，与该网址所指示的网络服务器建立加密连接，并约定第三密钥和第四密钥，此处不赘述。
步骤505，中间代理节点使用第三密钥加密业务信息，得到第二密文。
本步骤中的业务信息可以是去除了中间代理节点的网址业务信息。即，此时的业务信息只包括网络服务器指示信息，或，业务信息只包括对象指示信息。
步骤506，中间代理节点将第二密文发送给网络服务器，以使网络服务器使用第四密钥解密第二密文，得到业务信息。
步骤507，中间代理节点接收网络服务器发送的第三密文，第三密文由网络服务器使用第四密钥对业务数据进行加密得到。
网络服务器根据业务信息获取对应的业务数据，并使用第四密钥加密该业务数据，得到第三密文，将第三密文发送给中间代理节点。比如，当业务信息包括www.ottserver.com时，业务数据可以是网络服务器的主页；当业务信息包括www.ottserver.com/picture1.gif时，业务数据可以是图片1。
步骤508，中间代理节点使用第三密钥解密第三密文，得到业务数据。
步骤509，中间代理节点将业务数据发送给业务处理系统，以使业务处理系统将业务数据按照增值业务进行处理，将处理后的业务数据发送给中间代理节点。
比如，当业务数据是图片1，业务处理系统可以在接收到图片1后，将图片1的分辨率由原来的640*480转换为320*240，再将转换后的图片1发送给中间代理节点。
步骤510，中间代理节点将处理后的业务数据发送给用户代理。
其中，当业务数据是网络服务器的网页时，该网页中还可以包括对象指示信息，此时中间代理节点还需要对对象指示信息添加代理指示。比如，当网页包括图片1的URI时，中间代理节点可以对www.ottserver.com/picture1.gif添加中间代理节点的网址，得到www.portal.com/view？q＝www.ottserver.com/picture1.gif。
综上所述，本发明实施例提供的业务处理方法，重定向响应包括代理网址，代理网址由中间代理节点对网络服务器的指示信息添加代理指示得到，指示信息为网页指示信息、网页中对象的对象指示信息、对网页指示信息或对象指示信息进行转换后得到的信息中的一种，可以直接向用户代理发送网页指示信息或对象指示信息或对上述两种信息中的一种进行转换后得到的信息，而不需要先获取中间代理节点的网页，再触发中间代理节点的网页来获取网页指示信息或对象指示信息或对上述两种信息中的一种进行转换后得到的信息，可以简化操作流程，提高了业务处理的效率。
下面以代理节点是中间代理节点，用户代理和中间代理节点建立非加密连接、中间代理节点和网络服务器建立加密连接为例，对业务处理方法的流程进行描述。请参考图6A所示的第三种业务处理方法的应用流程图，图6A以中间代理节点是Portal、用户代理是UA、网络服务器是OTT Server、业务处理系统是GI-LAN、图6A中涉及的请求都是HTTP请求且以HTTP请求为GET请求为例。
步骤601，UA和Portal之间建立TCP连接(80端口)。
步骤602，Portal截获UA向OTT Server发送的GET请求，GET请求包括www.ottserver.com。其中，GET请求是第一访问请求。
步骤603，Portal向UA发送重定向响应和/或需要通过HTTPS协议访问的类型信息。其中，HTTPS协议是下层使用了SSL/TLS协议的HTTP协议。
其中，当重定向响应包括www.portal.com时，执行步骤604；当重定向响应包括www.portal.com/view？q＝www.ottserver.com时，执行步骤607。
步骤604，UA向Portal发送GET请求，GET请求包括www.portal.com。其中，GET请求是第二访问请求。
步骤605，Portal将GET请求发送给GI-LAN，GI-LAN处理后再返回给Portal。
步骤606，Portal向UA回复200ok响应，返回www.portal.com的网页。
步骤607，UA向Portal发送GET请求，GET请求包括www.portal.com/view？q＝www.ottserver.com。
步骤608，Portal将GET请求发送给GI-LAN，GI-LAN处理后再返回给Portal。
步骤609，Portal从处理后的GET请求解析出www.ottserver.com。
步骤610，Portal和OTT Server之间建立TCP连接(端口443)。
步骤611，Portal和OTT Server之间TLS握手过程。
步骤612，Portal向OTT Server发送加密的GET请求，GET请求包括www.ottserver.com。
步骤613，OTT Server向Portal回复加密的200ok响应，返回www.ottserver.com的网页。
步骤614，Portal解密200ok响应后发送到GI-LAN，GI-LAN处理后再返 回给Portal。
步骤615，Portal对处理后的200ok响应添加www.portal.com的portal指示：如www.portal.com/view？q＝www.ottserver.com/picture1.gif。
步骤616，Portal向UA发送200ok响应。
步骤617，UA向Portal发送GET请求，GET请求包括www.portal.com/view？q＝www.ottserver.com/picture1.gif。
步骤618，Portal将GET请求发送给GI-LAN，GI-LAN处理后再返回给Portal。
步骤619，Portal从处理后的GET请求解析出www.ottserver.com/picture1.gif。
步骤620，Portal向OTT Server发送加密的GET请求，GET请求包括www.ottserver.com/picture1.gif。
步骤621，OTT Server向Portal回复加密的200ok响应，返回图片1。
步骤622，Portal解密200ok响应后发送给GI-LAN，GI-LAN处理后再返回给Portal。
步骤623，Portal对处理后的200ok响应添加www.portal.com的portal指示。
步骤624，Portal向UA发送200ok响应。
请参考图6B所示的第四种业务处理方法的应用流程图，图6B以中间代理节点是Portal、用户代理是UA、网络服务器是OTT Server、业务处理系统是GI-LAN。
步骤601’，Portal截获UA向OTT Server发送的TCP连接请求，根据TCP连接请求中的信息顶替OTT Server与UA之间建立TCP连接(443端口)。
步骤602’，Portal利用与OTT Server对应的数字证书与UA之间TLS握手过程。
步骤603’，Portal截获UA向OTT Server发送的加密的GET请求，GET请求包括www.ottserver.com。其中，GET请求是第一访问请求。
步骤604’，Portal向UA发送加密后的重定向响应和/或需要通过HTTPS协议访问的加密后的类型信息。其中，HTTPS协议是下层使用了SSL/TLS协议的HTTP协议。
步骤605’，UA和Portal之间建立TCP连接(80端口)。
其中，当重定向响应包括www.portal.com时，执行步骤606’；当重定向响应包括www.portal.com/view？q＝www.ottserver.com时，执行步骤609’。
步骤606’至步骤626’的内容与步骤604至步骤624的内容相同此处不赘述。
请参见图7，其示出了本发明实施例提供的又一种业务处理方法的方法流程图。本实施例以代理节点是位于用户代理和中间代理节点中间的前端代理节点为例进行说明，该业务处理方法，可以包括：
步骤701，前端代理节点接收用户代理发送的第一密文，第一密文由用户代理使用第一密钥对业务信息进行加密得到。
前端代理节点是位于用户代理和中间代理节点之间的代理节点。具体地，前端代理节点可以位于用户代理和业务处理系统之间，业务处理系统位于前端代理节点和中间代理节点之间。本实施例中，中间代理节点可以是Portal。当然，中间代理节点还可以是其它站点，本实施例不作限定。
请参考步骤201中关于业务信息和第一密钥的描述，此处不赘述。
加密连接可以是基于SSL/TLS协议的连接。由于基于SSL协议的加密连接和基于TLS协议的加密连接的建立过程类似，下文以基于TLS协议的加密连接为例进行说明。
具体地，代理节点接收用户代理发送的第一密文之前，还包括：
1)前端代理节点截获用户代理向中间代理节点发送的第二连接建立请求，第二连接建立请求包括中间代理节点的目的IP地址；
2)前端代理节点根据目的IP地址和预存的中间代理节点的节点信息，与用户代理建立加密连接。
在第一种建立方式中，当第二连接建立请求由中间代理节点指示用户代理发送时，在用户代理向中间代理节点发送第二连接建立请求之前，用户代理需要和中间代理节点建立端口是80端口或443端口的TCP连接，建立过程详见步骤201中的描述，此处不赘述。
可选的，第二连接建立请求是中间代理节点截获用户代理向网络服务器发送的第一访问请求后，指示用户代理发送的，第一访问请求用于请求访问网络服务器，或，第二连接建立请求是用户代理在接收到用户触发的触发信号后发送的，触发信号是用户触发用户代理中预存的中间代理节点的网页后生成的。
在用户代理与中间代理节点建立TCP连接之后，中间代理节点截获用户代理向网络服务器发送的第一访问请求，指示用户代理发送第二连接建立请求，前端代理节点再截获用户代理向中间代理节点发送第二连接建立请求。
由于第二连接建立请求中需要携带该第二连接建立请求的目的地的目的IP地址，因此，第二连接建立请求包括中间代理节点的目的IP地址，前端代理节点可以从第二连接建立请求中获取该目的IP地址，再利用该目的IP地址以及预存的中间代理节点的节点信息与用户代理建立加密连接。此时，由于前端代理节点使用的是中间代理节点的信息与用户代理建立了加密连接，因此，用户代理不能感知到前端代理节点的存在。
需要说明的是，当中间代理节点与用户代理建立的TCP连接的端口是443端口，第二连接建立请求是中间代理节点通过加密代理连接截获用户代理向网络服务器发送的第一访问请求后，指示用户代理发送的，加密代理连接是中间代理节点截获用户代理向网络服务器发送的TCP连接请求，读取TCP连接请求中的信息，根据该信息顶替网络服务器与用户代理建立TCP连接，在TCP连接建立完成后，利用预存的与网络服务器对应的数字证书与用户代理建立的。中间代理节点与用户代理建立加密代理连接的流程以及中间代理节点根据与网络服务器对应的数字证书与用户代理建立加密代理连接的流程详见步骤201中的描述，此处不赘述。
在第二种建立方式中，当第二连接建立请求由用户触发用户代理发送时，中间代理节点的网页可以作为主页、书签、配置信息等方式存储在用户代理中，或，用户代理中安装有为中间代理节点定制的应用程序、业务等，用户可以直接从用户代理中获取并触发该网页。其中，中间代理节点的网页包含输入框，当用户在输入框中输入网络服务器的网址或信息时，触发该网页，该信息可以是IP地址或域名等；中间代理节点的网页包含超链接，当用户点击超链接时，触发该网页。
具体地，前端代理节点根据目的IP地址和预存的中间代理节点的节点信息，与用户代理建立加密连接，包括：
1)节点信息包括数字证书和私钥，前端代理节点将数字证书发送给用户代理，接收用户代理根据数字证书携带的公钥发送的加密信息，使用私钥对加密信息进行解密得到预主密钥，并使用目的IP地址与用户代理建立加密连接；或，
2)节点信息包括数字证书，前端代理节点将数字证书发送给用户代理，接收用户代理根据数字证书携带的公钥发送的加密信息，将加密信息发送给中间代理节点，接收中间代理节点使用私钥对加密信息进行解密后发送的预主密钥，并使用目的IP地址与用户代理建立加密连接；
其中，预主密钥用于生成第一密钥和第二密钥。
在第一种实现方式中，节点信息至少包括数字证书和私钥，具体建立过程详见图3所示的流程。其中，步骤303中的TLS协议版本号、加密算法和第二随机数由前端代理节点生成。步骤304中的数字证书是中间代理节点的数字证书。步骤309中前端代理节点使用中间代理节点的私钥解密公钥交换信息，生成第二密钥。
在第二种实现方式中，节点信息至少包括数字证书，具体建立过程详见图3所示的流程。其中，步骤303中的TLS协议版本号、加密算法和第二随机数由前端代理节点生成。步骤304中的数字证书是中间代理节点的数字证书。步骤309中前端代理节点将公钥交换信息发送给中间代理节点，中间代理节点使用私钥解密公钥交换信息，得到预主密钥，将预主密钥发送给前端代理节点，前端代理节点根据第一随机数、第二随机数、预主密钥和加密算法生成第二密钥。
其中，前端代理节点可以从第三方或中间代理节点获取到数字证书和密钥，本实施例不对获取方式作限定。
本实施例中，当第二连接建立请求是中间代理节点截获第一访问请求后，通过重定向响应指示用户代理发送的时，重定向响应包括中间代理节点的网址；或，重定向响应包括代理网址，代理网址由中间代理节点对网络服务器的指示信息添加代理指示得到，指示信息为网页指示信息、网页中对象的对象指示信息、对网页指示信息或对象指示信息进行转换后得到的信息中的一种。
其中，重定向响应的location头域中可以包括类型信息，该类型信息用于指示用户代理请求建立的连接类型，本实施例以类型信息中携带HTTPS为例进行说明，此时第二连接建立请求用于请求建立加密连接，且加密连接的端口为443端口。
可选的，当重定向响应包括中间代理节点的网址时，前端代理节点根据目的IP地址和预存的中间代理节点的节点信息，与用户代理建立加密连接之后，还包括：
1)前端代理节点接收用户代理发送的第五密文，第五密文由用户代理使用第一密钥对第二访问请求进行加密得到，第二访问请求用于请求访问中间代理节点；
2)前端代理节点使用第二密钥解密第五密文，得到第二访问请求；
3)前端代理节点将第二访问请求发送给业务处理系统，以使业务处理系统将第二访问请求按照增值业务进行处理，将处理后的第二访问请求请求发送给中间代理节点；
4)前端代理节点使用第二密钥加密业务处理系统发送的网页，得到第六密文，网页由中间代理节点发送给业务处理系统；
5)前端代理节点将第六密文发送给用户代理，以使用户代理使用第一密钥解密第六密文，得到网页，网页用于触发用户代理发送第一密文。
若重定向响应只包括中间代理节点的网址，则用户代理还需要根据中间代理节点的网址获取中间代理节点的网页，以便用户在接收到网页后，触发该网页，用户代理根据该触发发送第二连接建立请求，并在与前端代理节点建立加密连接之后发送第一密文。
需要说明的是，前端代理节点可以直接将第二访问请求发送给业务处理系统进行处理；或，前端代理节点可以检测是否需要将第二访问请求发送给业务处理系统进行处理，当检测出不需要业务处理系统处理时，将第二访问请求发送给中间代理节点，当检测出需要业务处理系统处理时，将第二访问请求发送给业务处理系统。
其中，前端代理节点在检测是否需要将第二访问请求发送给业务处理系统进行处理时，可以检测第二访问请求包括的网址是否是中间代理节点的网址，若检测出第二访问请求包括的网址是中间代理节点的网址，则确定不需要将第二访问请求发送给业务处理系统进行处理，若检测出第二访问请求包括的网址不是中间代理节点的网址，则确定需要将第二访问请求发送给业务处理系统进行处理。当然，前端代理节点还可以通过其它方法检测是否需要将第二访问请求发送给业务处理系统进行处理，本实施例不作限定。
进一步地，业务处理系统可以将处理后的第二访问请求发送给中间代理节点，中间代理节点获取自身的网页，将该网页发送给业务处理系统，业务处理系统再按照增值业务对中间代理节点的网页进行处理，将处理后的网页发送给前端代理节点。其中，业务处理系统处理第二访问请求和中间代理节点的网页 的流程与步骤203中业务处理系统处理业务信息的流程类似，此处不赘述。
步骤702，前端代理节点使用第二密钥解密第一密文，得到业务信息。
前端代理节点确定与第一密钥对应的第二密钥，再使用第二密钥解密第一密文，得到业务信息。
步骤703，前端代理节点将业务信息发送给业务处理系统，以使业务处理系统将业务信息按照增值业务进行处理，并触发将处理后的业务信息发送给网络服务器的流程。
本实施例中，业务处理系统在接收到业务信息后，可以根据业务信息确定用户代理，再确定该用户代理定制的增值业务，将业务信息按照该增值业务进行处理。具体地，业务处理系统可以确定实现该增值业务的业务链，将业务信息发送给该业务链中的业务处理单元，由业务链中的各个业务处理单元依次处理该业务信息，再将处理后的业务信息发送给中间代理节点。
当业务信息包括网页指示信息或对网页指示信息进行转换后得到的信息时，中间代理节点从处理后的业务信息中解析出网络服务器的网址，与该网址所指示的网络服务器建立加密连接，并约定第三密钥和第四密钥，使用第三密钥加密业务信息后，将加密后的业务信息发送给网络服务器。其中，中间代理节点和网络服务器建立加密连接的过程与中间代理节点和用户代理建立加密连接的过程类似，此处不赘述。
当业务信息包括对象指示信息或对对象指示信息进行转换后得到的信息时，在第一种实现方式中，当中间代理节点已经获取过网络服务器的网页，即，中间代理节点已经与网络服务器建立了加密连接，此时中间代理节点可以直接使用第三密钥加密业务信息，将得到的第二密文发送给网络服务器；在第二种实现方式中，当中间代理节点未获取过网络服务器的主页时，中间代理节点从处理后的业务信息中解析出网络服务器的网址，与该网址所指示的网络服务器建立加密连接，并约定第三密钥和第四密钥，此处不赘述。
需要说明的是，中间代理节点加密的业务信息可以是去除了中间代理节点的网址的业务信息。即，此时的业务信息只包括网络服务器指示信息，或，业务信息只包括对象指示信息。
步骤704，前端代理节点接收业务处理系统发送的业务数据。
网络服务器使用第四密钥解密第二密文，得到业务信息，根据业务信息获取对应的业务数据，并使用第四密钥加密该业务数据，得到第三密文，将第三 密文发送给中间代理节点。比如，当业务信息包括www.ottserver.com时，业务数据可以是网络服务器的主页；当业务信息包括www.ottserver.com/picture1.gif时，业务数据可以是图片1。
中间代理节点使用第三密钥解密第三密文，得到业务数据，将业务数据发送给业务处理系统进行处理，业务处理系统再将处理后的业务数据发送给前端代理节点。比如，当业务数据是图片1，业务处理系统可以在接收到图片1后，将图片1的分辨率由原来的640*480转换为320*240，再将转换后的图片1发送给中间代理节点。
当业务数据是网络服务器的网页时，该网页中还可以包括对象指示信息，此时中间代理节点还需要对对象指示信息添加代理指示。比如，当网页包括图片1的URI时，中间代理节点可以对www.ottserver.com/picture1.gif添加中间代理节点的网址，得到www.portal.com/view？q＝www.ottserver.com/picture1.gif。
步骤705，前端代理节点使用第二密钥加密业务数据，得到第七密文。
步骤706，前端代理节点将第七密文发送给用户代理，以使用户代理使用第一密钥解密第七密文，得到业务数据。
综上所述，本发明实施例提供的业务处理方法，通过接收用户代理发送的第一密文；使用第二密钥解密第一密文，得到业务信息；将业务信息发送给业务处理系统，以使业务处理系统将业务信息按照增值业务进行处理，并触发将处理后的业务信息发送给网络服务器的流程，可以在用户代理使用SSL/TLS协议时，通过代理节点对传输的第一密文进行解密，并将解密后的业务信息发送给业务处理系统，解决了业务处理系统无法解密密文，导致业务处理系统无法为使用SSL/TLS协议的用户代理提供增值业务的问题，达到了扩大增值业务的使用范围的效果。
另外，重定向响应包括代理网址，代理网址由中间代理节点对网络服务器的指示信息添加代理指示得到，指示信息为网页指示信息、网页中对象的对象指示信息、对网页指示信息或对象指示信息进行转换后得到的信息中的一种，可以直接向用户代理发送网页指示信息或对象指示信息或对上述两种信息中的一种进行转换后得到的信息，而不需要先获取中间代理节点的网页，再触发中间代理节点的网页来获取网页指示信息或对象指示信息或对上述两种信息中的一种进行转换后得到的信息，可以简化操作流程，提高了业务处理的效率。
下面以代理节点是前端代理节点，用户代理和前端代理节点建立加密连接、中间代理节点和网络服务器建立加密连接为例，对业务处理方法的流程进行描述。请参考图8A所示的第五种业务处理方法的应用流程图，图8A以中间代理节点是Portal、用户代理是UA、前端代理节点是Proxy、网络服务器是OTT Server、业务处理系统是GI-LAN、图8A中涉及的请求都是HTTP请求且以HTTP请求为GET请求为例。
步骤801，UA和Portal之间建立TCP连接(80端口)。
其中，当第二连接建立请求由中间代理节点指示用户代理发送时，执行步骤802；当第二连接建立请求由用户触发用户代理发送时，执行步骤804。
步骤802，Portal截获UA向OTT Server发送的GET请求，GET请求包括www.ottserver.com。其中，GET请求是第一访问请求。
步骤803，Portal向UA发送重定向响应和/或需要通过HTTPS协议访问的类型信息。其中，HTTPS协议是下层使用了SSL/TLS协议的HTTP协议。
步骤804，若Portal需要通过HTTPS协议访问，Proxy拦截UA和Portal的TCP连接，使用Portal的目的IP地址与UA建立TCP连接(443端口)。
步骤805，Proxy和Portal之间建立TCP连接(80端口)。
步骤806，UA和Proxy之间TLS握手过程。
其中，当Proxy预先获取到Portal的数字证书和私钥，Proxy根据私钥解密公钥交换信息得到预主密钥；当Proxy预先获取到Portal的数字证书，未获取到私钥，步骤806还包括步骤806’，步骤806’为Proxy将公钥交换信息发送给Portal，Portal使用私钥解密公钥交换信息后，向Proxy发送预主密钥。
其中，当重定向响应包括www.portal.com时，执行步骤807；当重定向响应包括www.portal.com/view？q＝www.ottserver.com时，执行步骤813。
步骤807，UA向Proxy发送加密的GET请求，GET请求包括www.portal.com。其中，GET请求是第二访问请求。
步骤808，Proxy解密GET请求后发送给GI-LAN。
步骤809，GI-LAN将处理后的GET请求发送给Portal。
步骤810，Portal向GI-LAN回复加密的200ok响应，返回www.portal.com的网页。
步骤811，GI-LAN向Proxy回复加密的200ok响应，返回www.portal.com的网页。
步骤812，Proxy向UA回复加密的200ok响应，返回www.portal.com的网页。
步骤813，UA向Proxy发送加密的GET请求，GET请求包括www.portal.com/view？q＝www.ottserver.com。
步骤814，Proxy解密GET请求后发送给GI-LAN。
步骤815，GI-LAN将处理后的GET请求发送给Portal。
步骤816，Portal从处理后的GET请求解析出www.ottserver.com。
步骤817，Portal和OTT Server之间建立TCP连接(端口443)。
步骤818，Portal和OTT Server之间TLS握手过程。
步骤819，Portal向OTT Server发送加密的GET请求，GET请求包括www.ottserver.com。
步骤820，OTT Server向Portal回复加密的200ok响应，返回www.ottserver.com的网页。
步骤821，Portal解密200ok响应后，对200ok响应添加www.portal.com的portal指示：如www.portal.com/view？q＝www.ottserver.com/picture1.gif，将添加后的200ok响应发送到GI-LAN。
步骤822，GI-LAN将处理后的200ok响应发送给Proxy。
步骤823，Proxy向UA发送加密的200ok响应。
步骤824，UA向Proxy发送加密的GET请求，GET请求包括www.portal.com/view？q＝www.ottserver.com/picture1.gif。
步骤825，Proxy解密GET请求后发送给GI-LAN。
步骤826，GI-LAN将处理后的GET请求发送给Portal。
步骤827，Portal从处理后的GET请求解析出www.ottserver.com/picture1.gif。
步骤828，Portal向OTT Server发送加密的GET请求，GET请求包括www.ottserver.com/picture1.gif。
步骤829，OTT Server向Portal加密的回复200ok响应，返回图片1。
步骤830，Portal解密200ok响应，对200ok响应添加www.portal.com的portal指示：如www.portal.com/view？q＝www.ottserver.com/picture1.gif，将添加后的200ok响应发送给GI-LAN。
步骤831，GI-LAN将处理后的200ok响应发送给Proxy。
步骤832，Portal向UA发送加密的200ok响应。
请参考图8B所示的第六种业务处理方法的应用流程图，图8B以中间代理节点是Portal、用户代理是UA、前端代理节点是Proxy、网络服务器是OTT Server、业务处理系统是GI-LAN。
步骤801’，Portal截获UA向OTT Server发送的TCP连接请求，根据TCP连接请求中的信息顶替OTT Server与UA之间建立TCP连接(443端口)。
步骤802’，Portal利用与OTT Server对应的数字证书与UA之间TLS握手过程。
步骤803’，Portal截获UA向OTT Server发送的GET请求，GET请求包括www.ottserver.com。其中，GET请求是第一访问请求。
步骤804’，Portal向UA发送加密后的重定向响应和/或需要通过HTTPS协议访问的加密后的类型信息。其中，HTTPS协议是下层使用了SSL/TLS协议的HTTP协议。
步骤805’至步骤833’的内容与步骤804至步骤832的内容相同此处不赘述。
请参考图9，其示出了本发明实施例提供的一种业务处理装置的结构示意图。该业务处理装置，可以包括：
第一接收模块901，用于接收用户代理发送的第一密文，第一密文由用户代理使用第一密钥对业务信息进行加密得到；
第一解密模块902，用于使用第二密钥解密第一接收模块901接收到的第一密文，得到业务信息；
第一发送模块903，用于将第一解密模块902解密后得到的业务信息发送给业务处理系统，以使业务处理系统将业务信息按照增值业务进行处理，并触发将处理后的业务信息发送给网络服务器的流程；
其中，第一密钥和第二密钥是用户代理和代理节点在建立加密连接时约定的密钥。
综上所述，本发明实施例提供的业务处理装置，通过接收用户代理发送的第一密文；使用第二密钥解密第一密文，得到业务信息；将业务信息发送给业务处理系统，以使业务处理系统将业务信息按照增值业务进行处理，并触发将处理后的业务信息发送给网络服务器的流程，可以在用户代理使用SSL/TLS 协议时，通过代理节点对传输的第一密文进行解密，并将解密后的业务信息发送给业务处理系统，解决了业务处理系统无法解密密文，导致业务处理系统无法为使用SSL/TLS协议的用户代理提供增值业务的问题，达到了扩大增值业务的使用范围的效果。
请参考图10，其示出了本发明实施例提供的又一种业务处理装置的结构示意图。该业务处理装置，可以包括：
第一接收模块1001，用于接收用户代理发送的第一密文，第一密文由用户代理使用第一密钥对业务信息进行加密得到；
第一解密模块1002，用于使用第二密钥解密第一接收模块1001接收到的第一密文，得到业务信息；
第一发送模块1003，用于将第一解密模块1002解密后得到的业务信息发送给业务处理系统，以使业务处理系统将业务信息按照增值业务进行处理，并触发将处理后的业务信息发送给网络服务器的流程；
其中，第一密钥和第二密钥是用户代理和代理节点在建立加密连接时约定的密钥。
在第一种应用场景中，代理节点是中间代理节点：
可选的，装置，还包括：
第二接收模块1004，用于在第一发送模块1003将业务信息发送给业务处理系统之后，接收业务处理系统发送的处理后的业务信息；
密钥约定模块1005，用于与网络服务器建立加密连接，并约定第三密钥和第四密钥；
第一加密模块1006，用于使用密钥约定模块1005约定的第三密钥加密业务信息，得到第二密文；
第二发送模块1007，用于将第一加密模块1006加密后的第二密文发送给网络服务器，以使网络服务器使用第四密钥解密第二密文，得到业务信息。
可选的，装置，还包括：
第三接收模块1008，用于在第二发送模块1007将第二密文发送给网络服务器之后，接收网络服务器发送的第三密文，第三密文由网络服务器使用第四密钥对业务数据进行加密得到；
第二解密模块1009，用于使用第三密钥解密第三接收模块1008接收到的 第三密文，得到业务数据；
第三发送模块1010，用于将第二解密模块1009解密后的业务数据发送给业务处理系统，以使业务处理系统将业务数据按照增值业务进行处理，将处理后的业务数据发送给中间代理节点；
第二加密模块1011，用于使用第二密钥加密处理后的业务数据，得到第四密文；
第四发送模块1012，用于将第二加密模块1011加密后的第四密文发送给用户代理，以使用户代理使用第一密钥解密第四密文，得到业务数据。
可选的，装置，还包括：
第一建立模块1013，用于在第一接收模块1001接收用户代理发送的第一密文之前，截获用户代理向网络服务器发送的第一访问请求，指示用户代理发送第一连接建立请求，根据用户代理发送的第一连接建立请求，与用户代理建立加密连接，第一访问请求用于请求访问网络服务器；或，
第二建立模块1014，用于在第一接收模块1001接收用户代理发送的第一密文之前，接收用户代理发送的第一连接建立请求，根据用户代理发送的第一连接建立请求，与用户代理建立加密连接，第一连接建立请求是用户代理在接收到用户触发的触发信号后发送的，触发信号是用户触发用户代理中预存的中间代理节点的网页后生成的。
可选的，装置，还包括
请求获取模块1030，用于第一建立模块1013截获用户代理向网络服务器发送的第一访问请求之前，截获用户代理向网络服务器发送的TCP连接请求；
第四建立模块1031，用于读取TCP连接请求中网络服务器的信息，根据信息顶替网络服务器与用户代理建立TCP连接，在TCP连接建立完成后，利用预存的与网络服务器对应的数字证书与用户代理建立加密代理连接，加密代理连接供用户代理向网络服务器发送第一访问请求。
可选的，第四建立模块1031，具体用于：
向用户代理发送第一数字证书，第一数字证书是证书颁发机构颁发的且与网络服务器对应的数字证书，证书颁发机构的第二数字证书预先配置在用户代理中或安装有用户代理的终端的操作系统中，以使用户代理根据第二数字证书验证第一数字证书，在验证通过后，与中间代理节点建立加密代理连接；或，
向用户代理发送第三数字证书和第四数字证书，第三数字证书是非授权证 书颁发机构颁发的且与网络服务器对应的数字证书，第四数字证书是非授权证书颁发机构的数字证书，以使用户代理根据第四数字证书验证第三数字证书，在验证通过后，与中间代理节点建立加密代理连接。
可选的，第一建立模块1013，具体用于通过重定向响应指示用户代理发送第一连接建立请求。
可选的，重定向响应包括中间代理节点的网址，或，
重定向响应包括代理网址，代理网址由中间代理节点对网络服务器的指示信息添加代理指示得到，指示信息为网页指示信息、网页中对象的对象指示信息、对网页指示信息或对象指示信息进行转换后得到的信息中的一种。
可选的，当重定向响应包括中间代理节点的网址时，装置，还包括：
第四接收模块1015，用于在第一建立模块1013根据用户代理发送的第一连接建立请求，与用户代理建立加密连接之后，接收用户代理发送的第五密文，第五密文由用户代理使用第一密钥对第二访问请求进行加密得到，第二访问请求用于请求访问中间代理节点；
第三解密模块1016，用于使用第二密钥解密第五接收模块1015接收到的第五密文，得到第二访问请求；
网页获取模块1017，用于获取中间代理节点的网页；
第三加密模块1018，用于使用第二密钥加密网页获取模块1016获取的网页，得到第六密文；
第五发送模块1019，用于将第三加密模块1018加密后的第六密文发送给用户代理，以使用户代理使用第一密钥解密第六密文，得到网页，网页用于触发用户代理发送第一密文。
在第二种应用场景中，代理节点是位于用户代理和中间代理节点之间的前端代理节点：
可选的，装置，还包括：
第五接收模块1020，用于在第一发送模块1003将业务信息发送给业务处理系统之后，接收业务处理系统发送的业务数据；
第四加密模块1021，用于使用第二密钥加密第五接收模块1020接收到的业务数据，得到第七密文；
第六发送模块1022，用于将第四加密模块1021加密后的第七密文发送给用户代理，以使用户代理使用第一密钥解密第七密文，得到业务数据。
可选的，装置，还包括：
请求截获模块1023，用于在第一接收模块1001接收用户代理发送的第一密文之前，截获用户代理向中间代理节点发送的第二连接建立请求，第二连接建立请求包括中间代理节点的目的IP地址；
第三建立模块1024，用于根据目的IP地址和预存的中间代理节点的节点信息，与用户代理建立加密连接。
可选的，第二连接建立请求是中间代理节点截获用户代理向网络服务器发送的第一访问请求后，指示用户代理发送的，第一访问请求用于请求访问网络服务器，或，第二连接建立请求是用户代理在接收到用户触发的触发信号后发送的，触发信号是用户触发用户代理中预存的中间代理节点的网页后生成的。
可选的，第二连接建立请求是中间代理节点通过加密代理连接截获用户代理向网络服务器发送的第一访问请求后，指示用户代理发送的，加密代理连接是中间代理节点截获用户代理向网络服务器发送的TCP连接请求，读取TCP连接请求中网络服务器的信息，根据信息顶替网络服务器与用户代理建立TCP连接，在TCP连接建立完成后，利用预存的与网络服务器对应的数字证书与用户代理建立的。
可选的，当第二连接建立请求是中间代理节点截获第一访问请求后，通过重定向响应指示用户代理发送的时，
重定向响应包括中间代理节点的网址；或，
重定向响应包括代理网址，代理网址由中间代理节点对网络服务器的指示信息添加代理指示得到，指示信息为网页指示信息、网页中对象的对象指示信息、对网页指示信息或对象指示信息进行转换后得到的信息中的一种。
可选的，重定向响应包括中间代理节点的网址，装置，还包括：
第六接收模块1025，用于在第三建立模块1024根据目的IP地址和预存的中间代理节点的节点信息，与用户代理建立加密连接之后，接收用户代理发送的第五密文，第五密文由用户代理使用第一密钥对第二访问请求进行加密得到，第二访问请求用于请求访问中间代理节点；
第四解密模块1026，用于使用第二密钥解密第六接收模块1025接收到的第五密文，得到第二访问请求；
第七发送模块1027，用于将第四解密模块1026解密后的第二访问请求发送给业务处理系统，以使业务处理系统将第二访问请求按照增值业务进行处 理，将处理后的第二访问请求请求发送给中间代理节点；
第五加密模块1028，用于第二密钥加密业务处理系统发送的网页，得到第六密文，网页由中间代理节点发送给业务处理系统；
第八发送模块1029，用于将第五加密模块1028加密后的第六密文发送给用户代理，以使用户代理使用第一密钥解密第六密文，得到网页，网页用于触发用户代理发送第一密文。
可选的，第三建立模块1024，具体用于
节点信息包括数字证书和私钥，将数字证书发送给用户代理，接收用户代理根据数字证书携带的公钥发送的加密信息，使用私钥对加密信息进行解密得到预主密钥，并使用目的IP地址与用户代理建立加密连接；或，
节点信息包括数字证书，将数字证书发送给用户代理，接收用户代理根据数字证书携带的公钥发送的加密信息，将加密信息发送给中间代理节点，接收中间代理节点使用私钥对加密信息进行解密后发送的预主密钥，并使用目的IP地址与用户代理建立加密连接；
其中，预主密钥用于生成第一密钥和第二密钥。
综上所述，本发明实施例提供的业务处理装置，通过接收用户代理发送的第一密文；使用第二密钥解密第一密文，得到业务信息；将业务信息发送给业务处理系统，以使业务处理系统将业务信息按照增值业务进行处理，并触发将处理后的业务信息发送给网络服务器的流程，可以在用户代理使用SSL/TLS协议时，通过代理节点对传输的第一密文进行解密，并将解密后的业务信息发送给业务处理系统，解决了业务处理系统无法解密密文，导致业务处理系统无法为使用SSL/TLS协议的用户代理提供增值业务的问题，达到了扩大增值业务的使用范围的效果。
另外，重定向响应包括代理网址，代理网址由中间代理节点对网络服务器的指示信息添加代理指示得到，指示信息为网页指示信息、网页中对象的对象指示信息、对网页指示信息或对象指示信息进行转换后得到的信息中的一种，可以直接向用户代理发送网络服务器指示信息或对象指示信息，而不需要先获取中间代理节点的网页，再触发中间代理节点的网页来获取网络服务器指示信息或对象指示信息，可以简化操作流程，提高了业务处理的效率。
请参考图11，其示出了本发明实施例提供的一种业务处理装置的结构示意 图。该业务处理装置，可以包括：总线1101，以及连接到总线的处理器1102、存储器1103、发射器1104和接收器1105。其中，存储器1103用于存储若干个指令，指令被配置成由处理器1102执行；
接收器1105，用于接收用户代理发送的第一密文，第一密文由用户代理使用第一密钥对业务信息进行加密得到；
处理器1102，用于使用第二密钥解密接收器1105接收到的第一密文，得到业务信息；
发射器1104，用于将处理器1102解密后的业务信息发送给业务处理系统，以使业务处理系统将业务信息按照增值业务进行处理，并触发将处理后的业务信息发送给网络服务器的流程；
其中，第一密钥和第二密钥是用户代理和代理节点在建立加密连接时约定的密钥。
综上所述，本发明实施例提供的业务处理装置，通过接收用户代理发送的第一密文；使用第二密钥解密第一密文，得到业务信息；将业务信息发送给业务处理系统，以使业务处理系统将业务信息按照增值业务进行处理，并触发将处理后的业务信息发送给网络服务器的流程，可以在用户代理使用SSL/TLS协议时，通过代理节点对传输的第一密文进行解密，并将解密后的业务信息发送给业务处理系统，解决了业务处理系统无法解密密文，导致业务处理系统无法为使用SSL/TLS协议的用户代理提供增值业务的问题，达到了扩大增值业务的使用范围的效果。
本发明实施例还提供了一种业务处理装置，该业务处理装置，可以包括：总线1101，以及连接到总线的处理器1102、存储器1103、发射器1104和接收器1105。其中，存储器1103用于存储若干个指令，指令被配置成由处理器1102执行；
接收器1105，用于接收用户代理发送的第一密文，第一密文由用户代理使用第一密钥对业务信息进行加密得到；
处理器1102，用于使用第二密钥解密接收器1105接收到的第一密文，得到业务信息；
发射器1104，用于将处理器1102解密后的业务信息发送给业务处理系统，以使业务处理系统将业务信息按照增值业务进行处理，并触发将处理后的业务 信息发送给网络服务器的流程；
其中，第一密钥和第二密钥是用户代理和代理节点在建立加密连接时约定的密钥。
可选的，代理节点是中间代理节点，
接收器1105，还用于在发射器1104将业务信息发送给业务处理系统之后，接收业务处理系统发送的处理后的业务信息；
处理器1102，还用于与网络服务器建立加密连接，并约定第三密钥和第四密钥；使用第三密钥加密业务信息，得到第二密文；
发射器1104，还用于将处理器1102加密后的第二密文发送给网络服务器，以使网络服务器使用第四密钥解密第二密文，得到业务信息。
可选的，接收器1105，还用于在发射器1104将第二密文发送给网络服务器之后，接收网络服务器发送的第三密文，第三密文由网络服务器使用第四密钥对业务数据进行加密得到；
处理器1102，还用于使用第三密钥解密接收器1105接收到的第三密文，得到业务数据；
发射器1104，还用于将处理器1102解密后的业务数据发送给业务处理系统，以使业务处理系统将业务数据按照增值业务进行处理，将处理后的业务数据发送给中间代理节点；
处理器1102，还用于使用第二密钥加密处理后的业务数据，得到第四密文；
发射器1104，还用于将处理器1102加密后的第四密文发送给用户代理，以使用户代理使用第一密钥解密第四密文，得到业务数据。
可选的，接收器1105，还用于在接收用户代理发送的第一密文之前，截获用户代理向网络服务器发送的第一访问请求，发射器1104，还用于指示用户代理发送第一连接建立请求，处理器1102，还用于根据用户代理发送的第一连接建立请求，与用户代理建立加密连接，第一访问请求用于请求访问网络服务器；或，
接收器1105，还用于在接收用户代理发送的第一密文之前，接收用户代理发送的第一连接建立请求，处理器1102，还用于根据用户代理发送的第一连接建立请求，与用户代理建立加密连接，第一连接建立请求是用户代理在接收到用户触发的触发信号后发送的，触发信号是用户触发用户代理中预存的中间代理节点的网页后生成的。
可选的，接收器1105，还用于截获用户代理向网络服务器发送的第一访问请求之前，截获用户代理向网络服务器发送的TCP连接请求；
处理器1102，还用于读取TCP连接请求中网络服务器的信息，根据信息顶替网络服务器与用户代理建立TCP连接，在TCP连接建立完成后，利用预存的与网络服务器对应的数字证书与用户代理建立加密代理连接，加密代理连接供用户代理向网络服务器发送第一访问请求。
可选的，发射器1104，还用于向用户代理发送第一数字证书，第一数字证书是证书颁发机构颁发的且与网络服务器对应的数字证书，证书颁发机构的第二数字证书预先配置在用户代理中或安装有用户代理的终端的操作系统中，以使用户代理根据第二数字证书验证第一数字证书，在验证通过后，与中间代理节点建立加密代理连接；或，
发射器1104，还用于向用户代理发送第三数字证书和第四数字证书，第三数字证书是非授权证书颁发机构颁发的且与网络服务器对应的数字证书，第四数字证书是非授权证书颁发机构的数字证书，以使用户代理根据第四数字证书验证第三数字证书，在验证通过后，与中间代理节点建立加密代理连接。
可选的，发射器1104，具体用于通过重定向响应指示用户代理发送第一访问请求。
可选的，重定向响应包括中间代理节点的网址，或，
重定向响应包括代理网址，代理网址由中间代理节点对网络服务器的指示信息添加代理指示得到，指示信息为网页指示信息、网页中对象的对象指示信息、对网页指示信息或对象指示信息进行转换后得到的信息中的一种。
可选的，重定向响应包括中间代理节点的网址，
接收器1105，还用于在处理器1102根据用户代理发送的第一连接建立请求，与用户代理建立加密连接之后，接收用户代理发送的第五密文，第五密文由用户代理使用第一密钥对第二访问请求进行加密得到，第二访问请求用于请求访问中间代理节点；
处理器1102，还用于使用第二密钥解密接收器1105接收到的第五密文，得到第二访问请求；获取中间代理节点的网页；使用第二密钥加密网页，得到第六密文；
发射器1104，还用于将处理器1102加密后的第六密文发送给用户代理，以使用户代理使用第一密钥解密第六密文，得到网页，网页用于触发用户代理 发送第一密文。
可选的，代理节点是位于用户代理和中间代理节点之间的前端代理节点，还包括：
接收器1105，还用于在发射器1104将业务信息发送给业务处理系统之后，接收业务处理系统发送的业务数据；
处理器1102，还用于使用第二密钥加密接收器1105接收到的业务数据，得到第七密文；
发射器1104，还用于将处理器1102加密后的第七密文发送给用户代理，以使用户代理使用第一密钥解密第七密文，得到业务数据。
可选的，接收器1105，还用于在接收用户代理发送的第一密文之前，截获用户代理向中间代理节点发送的第二连接建立请求，第二连接建立请求包括中间代理节点的目的IP地址；
处理器1102，用于根据目的IP地址和预存的中间代理节点的节点信息，与用户代理建立加密连接。
可选的，第二连接建立请求是中间代理节点截获用户代理向网络服务器发送的第一访问请求后，指示用户代理发送的，第一访问请求用于请求访问网络服务器，或，第二连接建立请求是用户代理在接收到用户触发的触发信号后发送的，触发信号是用户触发用户代理中预存的中间代理节点的网页后生成的。
可选的，第二连接建立请求是中间代理节点通过加密代理连接截获用户代理向网络服务器发送的第一访问请求后，指示用户代理发送的，加密代理连接是中间代理节点截获用户代理向网络服务器发送的TCP连接请求，读取TCP连接请求中网络服务器的信息，根据信息顶替网络服务器与用户代理建立TCP连接，在TCP连接建立完成后，利用预存的与网络服务器对应的数字证书与用户代理建立的。
可选的，当第二连接建立请求是中间代理节点截获第一访问请求后，通过重定向响应指示用户代理发送的时，重定向响应包括中间代理节点的网址；或，
重定向响应包括代理网址，代理网址由中间代理节点对网络服务器的指示信息添加代理指示得到，指示信息为网页指示信息、网页中对象的对象指示信息、对网页指示信息或对象指示信息进行转换后得到的信息中的一种。
可选的，当重定向响应包括中间代理节点的网址时，
接收器1105，还用于在处理器1102根据目的IP地址和预存的中间代理节 点的节点信息，与用户代理建立加密连接之后，接收用户代理发送的第五密文，第五密文由用户代理使用第一密钥对第二访问请求进行加密得到，第二访问请求用于请求访问中间代理节点；
处理器1102，还用于使用第二密钥解密接收器1105接收到的第五密文，得到第二访问请求；
发射器1104，还用于将处理器1102解密后的第二访问请求发送给业务处理系统，以使业务处理系统将第二访问请求按照增值业务进行处理，将处理后的第二访问请求请求发送给中间代理节点；
处理器1102，还用于使用第二密钥加密业务处理系统发送的网页，得到第六密文，网页由中间代理节点发送给业务处理系统；
发射器1104，还用于将处理器1102加密后的第六密文发送给用户代理，以使用户代理使用第一密钥解密第六密文，得到网页，网页用于触发用户代理发送第一密文。
可选的，节点信息包括数字证书和私钥，发射器1104，具体用于将数字证书发送给用户代理，接收器1105，具体用于接收用户代理根据数字证书携带的公钥发送的加密信息，处理器1102，具体用于使用私钥对加密信息进行解密得到预主密钥，并使用目的IP地址与用户代理建立加密连接；或，
节点信息包括数字证书，发射器1104，具体用于将数字证书发送给用户代理，接收器1105，具体用于接收用户代理根据数字证书携带的公钥发送的加密信息，发射器1104，还用于将加密信息发送给中间代理节点，接收器1105，还用于接收中间代理节点使用私钥对加密信息进行解密后发送的预主密钥，处理器1102，具体用于使用目的IP地址与用户代理建立加密连接；
其中，预主密钥用于生成第一密钥和第二密钥。
综上所述，本发明实施例提供的业务处理装置，通过接收用户代理发送的第一密文；使用第二密钥解密第一密文，得到业务信息；将业务信息发送给业务处理系统，以使业务处理系统将业务信息按照增值业务进行处理，并触发将处理后的业务信息发送给网络服务器的流程，可以在用户代理使用SSL/TLS协议时，通过代理节点对传输的第一密文进行解密，并将解密后的业务信息发送给业务处理系统，解决了业务处理系统无法解密密文，导致业务处理系统无法为使用SSL/TLS协议的用户代理提供增值业务的问题，达到了扩大增值业务的使用范围的效果。
另外，重定向响应包括代理网址，代理网址由中间代理节点对网络服务器的指示信息添加代理指示得到，指示信息为网页指示信息、网页中对象的对象指示信息、对网页指示信息或对象指示信息进行转换后得到的信息中的一种，可以直接向用户代理发送网络服务器指示信息或对象指示信息，而不需要先获取中间代理节点的网页，再触发中间代理节点的网页来获取网络服务器指示信息或对象指示信息，可以简化操作流程，提高了业务处理的效率。
需要说明的是：上述实施例提供的业务处理装置在进行业务处理时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将业务处理装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。另外，上述实施例提供的业务处理装置与业务处理方法实施例属于同一构思，其具体实现过程详见方法实施例，这里不再赘述。
上述本发明实施例序号仅仅为了描述，不代表实施例的优劣。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，可以仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者 也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应所述以权利要求的保护范围为准。

Claims (48)

  1. 一种业务处理方法，其特征在于，所述方法包括：
    代理节点接收用户代理发送的第一密文，所述第一密文由所述用户代理使用第一密钥对业务信息进行加密得到；
    所述代理节点使用第二密钥解密所述第一密文，得到所述业务信息；
    所述代理节点将所述业务信息发送给业务处理系统，以使所述业务处理系统将所述业务信息按照增值业务进行处理，并触发将处理后的所述业务信息发送给网络服务器的流程；
    其中，所述第一密钥和所述第二密钥是所述用户代理和所述代理节点在建立加密连接时约定的密钥。
  2. 根据权利要求1所述的方法，其特征在于，所述代理节点是中间代理节点，所述代理节点将所述业务信息发送给业务处理系统之后，还包括：
    所述中间代理节点接收所述业务处理系统发送的处理后的所述业务信息；
    所述中间代理节点与所述网络服务器建立加密连接，并约定第三密钥和第四密钥；
    所述中间代理节点使用所述第三密钥加密所述业务信息，得到第二密文；
    所述中间代理节点将所述第二密文发送给所述网络服务器，以使所述网络服务器使用所述第四密钥解密所述第二密文，得到所述业务信息。
  3. 根据权利要求2所述的方法，其特征在于，所述中间代理节点将所述第二密文发送给所述网络服务器之后，还包括：
    所述中间代理节点接收所述网络服务器发送的第三密文，所述第三密文由所述网络服务器使用所述第四密钥对业务数据进行加密得到；
    所述中间代理节点使用所述第三密钥解密所述第三密文，得到所述业务数据；
    所述中间代理节点将所述业务数据发送给所述业务处理系统，以使所述业务处理系统将所述业务数据按照增值业务进行处理，将处理后的所述业务数据发送给所述中间代理节点；
    所述中间代理节点使用所述第二密钥加密处理后的所述业务数据，得到第 四密文；
    所述中间代理节点将所述第四密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第四密文，得到所述业务数据。
  4. 根据权利要求2或3所述的方法，其特征在于，所述代理节点接收用户代理发送的第一密文之前，还包括：
    所述中间代理节点截获所述用户代理向所述网络服务器发送的第一访问请求，指示所述用户代理发送第一连接建立请求，根据所述用户代理发送的所述第一连接建立请求，与所述用户代理建立所述加密连接，所述第一访问请求用于请求访问所述网络服务器；或，
    所述中间代理节点接收所述用户代理发送的第一连接建立请求，根据所述用户代理发送的所述第一连接建立请求，与所述用户代理建立所述加密连接，所述第一连接建立请求是所述用户代理在接收到用户触发的触发信号后发送的，所述触发信号是用户触发所述用户代理中预存的所述中间代理节点的网页后生成的。
  5. 根据权利要求4所述的方法，其特征在于，所述指示所述用户代理发送第一连接建立请求，包括：
    通过重定向响应指示所述用户代理发送所述第一连接建立请求。
  6. 根据权利要求5所述的方法，其特征在于，
    所述重定向响应包括所述中间代理节点的网址，或，
    所述重定向响应包括代理网址，所述代理网址由所述中间代理节点对所述网络服务器的指示信息添加代理指示得到，所述指示信息为网页指示信息、网页中对象的对象指示信息、对所述网页指示信息或所述对象指示信息进行转换后得到的信息中的一种。
  7. 根据权利要求6所述的方法，其特征在于，当所述重定向响应包括所述中间代理节点的网址时，所述中间代理节点根据所述用户代理发送的所述第一连接建立请求，与所述用户代理建立所述加密连接之后，还包括：
    所述中间代理节点接收所述用户代理发送的第五密文，所述第五密文由所 述用户代理使用所述第一密钥对第二访问请求进行加密得到，所述第二访问请求用于请求访问所述中间代理节点；
    所述中间代理节点使用所述第二密钥解密所述第五密文，得到所述第二访问请求；
    所述中间代理节点获取所述中间代理节点的网页；
    所述中间代理节点使用所述第二密钥加密所述网页，得到第六密文；
    所述中间代理节点将所述第六密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第六密文，得到所述网页，所述网页用于触发所述用户代理发送所述第一密文。
  8. 根据权利要求1所述的方法，其特征在于，所述代理节点是位于所述用户代理和中间代理节点之间的前端代理节点，所述代理节点将所述业务信息发送给业务处理系统之后，还包括：
    所述前端代理节点接收所述业务处理系统发送的业务数据；
    所述前端代理节点使用所述第二密钥加密所述业务数据，得到第七密文；
    所述前端代理节点将所述第七密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第七密文，得到所述业务数据。
  9. 根据权利要求8所述的方法，其特征在于，所述代理节点接收用户代理发送的第一密文之前，还包括：
    所述前端代理节点截获所述用户代理向中间代理节点发送的第二连接建立请求，所述第二连接建立请求包括所述中间代理节点的目的因特网协议IP地址；
    所述前端代理节点根据所述目的IP地址和预存的所述中间代理节点的节点信息，与所述用户代理建立所述加密连接。
  10. 根据权利要求9所述的方法，其特征在于，
    所述第二连接建立请求是所述中间代理节点截获所述用户代理向所述网络服务器发送的第一访问请求后，指示所述用户代理发送的，所述第一访问请求用于请求访问所述网络服务器，或，
    所述第二连接建立请求是所述用户代理在接收到用户触发的触发信号后发送的，所述触发信号是用户触发所述用户代理中预存的所述中间代理节点的网 页后生成的。
  11. 根据权利要求10所述的方法，其特征在于，当所述第二连接建立请求是所述中间代理节点截获所述第一访问请求后，通过重定向响应指示所述用户代理发送的时，
    所述重定向响应包括所述中间代理节点的网址；或，
    所述重定向响应包括代理网址，所述代理网址由所述中间代理节点对所述网络服务器的指示信息添加代理指示得到，所述指示信息为网页指示信息、网页中对象的对象指示信息、对所述网页指示信息或所述对象指示信息进行转换后得到的信息中的一种。
  12. 根据权利要求11所述的方法，其特征在于，当所述重定向响应包括所述中间代理节点的网址时，
    所述前端代理节点根据所述目的IP地址和预存的所述中间代理节点的节点信息，与所述用户代理建立所述加密连接之后，还包括：
    所述前端代理节点接收所述用户代理发送的第五密文，所述第五密文由所述用户代理使用所述第一密钥对第二访问请求进行加密得到，所述第二访问请求用于请求访问所述中间代理节点；
    所述前端代理节点使用所述第二密钥解密所述第五密文，得到所述第二访问请求；
    所述前端代理节点将所述第二访问请求发送给所述业务处理系统，以使所述业务处理系统将所述第二访问请求按照增值业务进行处理，将处理后的所述第二访问请求请求发送给所述中间代理节点；
    所述前端代理节点使用所述第二密钥加密所述业务处理系统发送的网页，得到第六密文，所述网页由所述中间代理节点发送给所述业务处理系统；
    所述前端代理节点将所述第六密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第六密文，得到所述网页，所述网页用于触发所述用户代理发送所述第一密文。
  13. 根据权利要求9至12任一项所述的方法，其特征在于，所述前端代理节点根据所述目的IP地址和预存的所述中间代理节点的节点信息，与所述用户 代理建立所述加密连接，包括：
    所述节点信息包括数字证书和私钥，所述前端代理节点将所述数字证书发送给所述用户代理，接收所述用户代理根据所述数字证书携带的公钥发送的加密信息，使用所述私钥对所述加密信息进行解密得到预主密钥，并使用所述目的IP地址与所述用户代理建立所述加密连接；或，
    所述节点信息包括数字证书，所述前端代理节点将所述数字证书发送给所述用户代理，接收所述用户代理根据所述数字证书携带的公钥发送的加密信息，将所述加密信息发送给所述中间代理节点，接收所述中间代理节点使用私钥对所述加密信息进行解密后发送的预主密钥，并使用所述目的IP地址与所述用户代理建立所述加密连接；
    其中，所述预主密钥用于生成所述第一密钥和所述第二密钥。
  14. 根据权利要求4所述的方法，其特征在于，所述中间代理节点截获所述用户代理向所述网络服务器发送的第一访问请求之前，还包括：
    所述中间代理节点截获所述用户代理向所述网络服务器发送的传输控制协议TCP连接请求；
    所述中间代理节点读取所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接，在所述TCP连接建立完成后，利用预存的与所述网络服务器对应的数字证书与所述用户代理建立加密代理连接，所述加密代理连接供所述用户代理向所述网络服务器发送所述第一访问请求。
  15. 根据权利要求14所述的方法，其特征在于，所述利用预存的与所述网络服务器对应的数字证书与所述用户代理建立加密代理连接，包括：
    所述中间代理节点向所述用户代理发送第一数字证书，所述第一数字证书是证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述证书颁发机构的第二数字证书预先配置在所述用户代理中或安装有所述用户代理的终端的操作系统中，以使所述用户代理根据所述第二数字证书验证所述第一数字证书，在验证通过后，与所述中间代理节点建立所述加密代理连接；或，
    所述中间代理节点向所述用户代理发送第三数字证书和第四数字证书，所述第三数字证书是非授权证书颁发机构颁发的且与所述网络服务器对应的数字 证书，所述第四数字证书是所述非授权证书颁发机构的数字证书，以使所述用户代理根据所述第四数字证书验证所述第三数字证书，在验证通过后，与所述中间代理节点建立所述加密代理连接。
  16. 根据权利要求10所述的方法，其特征在于，所述第二连接建立请求是所述中间代理节点通过加密代理连接截获所述用户代理向所述网络服务器发送的所述第一访问请求后，指示所述用户代理发送的，所述加密代理连接是所述中间代理节点截获所述用户代理向所述网络服务器发送的TCP连接请求，读取所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接，在所述TCP连接建立完成后，利用预存的与所述网络服务器对应的数字证书与所述用户代理建立的。
  17. 一种业务处理装置，其特征在于，用于代理节点中，所述装置包括：
    第一接收模块，用于接收用户代理发送的第一密文，所述第一密文由所述用户代理使用第一密钥对业务信息进行加密得到；
    第一解密模块，用于使用第二密钥解密所述第一接收模块接收到的所述第一密文，得到所述业务信息；
    第一发送模块，用于将所述第一解密模块解密后得到的所述业务信息发送给业务处理系统，以使所述业务处理系统将所述业务信息按照增值业务进行处理，并触发将处理后的所述业务信息发送给网络服务器的流程；
    其中，所述第一密钥和所述第二密钥是所述用户代理和所述代理节点在建立加密连接时约定的密钥。
  18. 根据权利要求17所述的装置，其特征在于，所述代理节点是中间代理节点，所述装置，还包括：
    第二接收模块，用于在所述第一发送模块将所述业务信息发送给业务处理系统之后，接收所述业务处理系统发送的处理后的所述业务信息；
    密钥约定模块，用于与所述网络服务器建立加密连接，并约定第三密钥和第四密钥；
    第一加密模块，用于使用所述密钥约定模块约定的所述第三密钥加密所述业务信息，得到第二密文；
    第二发送模块，用于将所述第一加密模块加密后的所述第二密文发送给所述网络服务器，以使所述网络服务器使用所述第四密钥解密所述第二密文，得到所述业务信息。
  19. 根据权利要求18所述的装置，其特征在于，所述装置，还包括：
    第三接收模块，用于在所述第二发送模块将所述第二密文发送给所述网络服务器之后，接收所述网络服务器发送的第三密文，所述第三密文由所述网络服务器使用所述第四密钥对业务数据进行加密得到；
    第二解密模块，用于使用所述第三密钥解密所述第三接收模块接收到的所述第三密文，得到所述业务数据；
    第三发送模块，用于将所述第二解密模块解密后的所述业务数据发送给所述业务处理系统，以使所述业务处理系统将所述业务数据按照增值业务进行处理，将处理后的所述业务数据发送给所述中间代理节点；
    第二加密模块，用于使用所述第二密钥加密处理后的所述业务数据，得到第四密文；
    第四发送模块，用于将所述第二加密模块加密后的所述第四密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第四密文，得到所述业务数据。
  20. 根据权利要求18或19所述的装置，其特征在于，所述装置，还包括：
    第一建立模块，用于在所述第一接收模块接收用户代理发送的第一密文之前，截获所述用户代理向所述网络服务器发送的第一访问请求，指示所述用户代理发送第一连接建立请求，根据所述用户代理发送的所述第一连接建立请求，与所述用户代理建立所述加密连接，所述第一访问请求用于请求访问所述网络服务器；或，
    第二建立模块，用于在所述第一接收模块接收用户代理发送的第一密文之前，接收所述用户代理发送的第一连接建立请求，根据所述用户代理发送的所述第一连接建立请求，与所述用户代理建立所述加密连接，所述第一连接建立请求是所述用户代理在接收到用户触发的触发信号后发送的，所述触发信号是用户触发所述用户代理中预存的所述中间代理节点的网页后生成的。
  21. 根据权利要求20所述的装置，其特征在于，所述第一建立模块，具体用于通过重定向响应指示所述用户代理发送所述第一连接建立请求。
  22. 根据权利要求21所述的装置，其特征在于，
    所述重定向响应包括所述中间代理节点的网址，或，
    所述重定向响应包括代理网址，所述代理网址由所述中间代理节点对所述网络服务器的指示信息添加代理指示得到，所述指示信息为网页指示信息、网页中对象的对象指示信息、对所述网页指示信息或所述对象指示信息进行转换后得到的信息中的一种。
  23. 根据权利要求22所述的装置，其特征在于，当所述重定向响应包括所述中间代理节点的网址时，所述装置，还包括：
    第四接收模块，用于在所述第一建立模块根据所述用户代理发送的所述第一连接建立请求，与所述用户代理建立所述加密连接之后，接收所述用户代理发送的第五密文，所述第五密文由所述用户代理使用所述第一密钥对第二访问请求进行加密得到，所述第二访问请求用于请求访问所述中间代理节点；
    第三解密模块，用于使用所述第二密钥解密所述第五接收模块接收到的所述第五密文，得到所述第二访问请求；
    网页获取模块，用于获取所述中间代理节点的网页；
    第三加密模块，用于使用所述第二密钥加密所述网页获取模块获取的所述网页，得到第六密文；
    第五发送模块，用于将所述第三加密模块加密后的所述第六密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第六密文，得到所述网页，所述网页用于触发所述用户代理发送所述第一密文。
  24. 根据权利要求17所述的装置，其特征在于，所述代理节点是位于所述用户代理和中间代理节点之间的前端代理节点，所述装置，还包括：
    第五接收模块，用于在所述第一发送模块将所述业务信息发送给业务处理系统之后，接收所述业务处理系统发送的业务数据；
    第四加密模块，用于使用所述第二密钥加密所述第五接收模块接收到的所述业务数据，得到第七密文；
    第六发送模块，用于将所述第四加密模块加密后的所述第七密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第七密文，得到所述业务数据。
  25. 根据权利要求24所述的装置，其特征在于，所述装置，还包括：
    请求截获模块，用于在所述第一接收模块接收用户代理发送的第一密文之前，截获所述用户代理向中间代理节点发送的第二连接建立请求，所述第二连接建立请求包括所述中间代理节点的目的因特网协议IP地址；
    第三建立模块，用于根据所述目的IP地址和预存的所述中间代理节点的节点信息，与所述用户代理建立所述加密连接。
  26. 根据权利要求25所述的装置，其特征在于，
    所述第二连接建立请求是所述中间代理节点截获所述用户代理向所述网络服务器发送的第一访问请求后，指示所述用户代理发送的，所述第一访问请求用于请求访问所述网络服务器，或，
    所述第二连接建立请求是所述用户代理在接收到用户触发的触发信号后发送的，所述触发信号是用户触发所述用户代理中预存的所述中间代理节点的网页后生成的。
  27. 根据权利要求26所述的装置，其特征在于，当所述第二连接建立请求是所述中间代理节点截获所述第一访问请求后，通过重定向响应指示所述用户代理发送的时，
    所述重定向响应包括所述中间代理节点的网址；或，
    所述重定向响应包括代理网址，所述代理网址由所述中间代理节点对所述网络服务器的指示信息添加代理指示得到，所述指示信息为网页指示信息、网页中对象的对象指示信息、对所述网页指示信息或所述对象指示信息进行转换后得到的信息中的一种。
  28. 根据权利要求27所述的装置，其特征在于，当所述重定向响应包括所述中间代理节点的网址时，所述装置，还包括：
    第六接收模块，用于在所述第三建立模块根据所述目的IP地址和预存的所 述中间代理节点的节点信息，与所述用户代理建立所述加密连接之后，接收所述用户代理发送的第五密文，所述第五密文由所述用户代理使用所述第一密钥对第二访问请求进行加密得到，所述第二访问请求用于请求访问所述中间代理节点；
    第四解密模块，用于使用所述第二密钥解密所述第六接收模块接收到的所述第五密文，得到所述第二访问请求；
    第七发送模块，用于将所述第四解密模块解密后的所述第二访问请求发送给所述业务处理系统，以使所述业务处理系统将所述第二访问请求按照增值业务进行处理，将处理后的所述第二访问请求请求发送给所述中间代理节点；
    第五加密模块，用于所述第二密钥加密所述业务处理系统发送的网页，得到第六密文，所述网页由所述中间代理节点发送给所述业务处理系统；
    第八发送模块，用于将所述第五加密模块加密后的所述第六密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第六密文，得到所述网页，所述网页用于触发所述用户代理发送所述第一密文。
  29. 根据权利要求25至28任一项所述的装置，其特征在于，所述第三建立模块，具体用于
    所述节点信息包括数字证书和私钥，将所述数字证书发送给所述用户代理，接收所述用户代理根据所述数字证书携带的公钥发送的加密信息，使用所述私钥对所述加密信息进行解密得到预主密钥，并使用所述目的IP地址与所述用户代理建立所述加密连接；或，
    所述节点信息包括数字证书，将所述数字证书发送给所述用户代理，接收所述用户代理根据所述数字证书携带的公钥发送的加密信息，将所述加密信息发送给所述中间代理节点，接收所述中间代理节点使用私钥对所述加密信息进行解密后发送的预主密钥，并使用所述目的IP地址与所述用户代理建立所述加密连接；
    其中，所述预主密钥用于生成所述第一密钥和所述第二密钥。
  30. 根据权利要求20所述的装置，其特征在于，所述装置，还包括：
    请求获取模块，用于所述第一建立模块截获所述用户代理向所述网络服务器发送的第一访问请求之前，截获所述用户代理向所述网络服务器发送的传输 控制协议TCP连接请求；
    第四建立模块，用于读取所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接，在所述TCP连接建立完成后，利用预存的与所述网络服务器对应的数字证书与所述用户代理建立加密代理连接，所述加密代理连接供所述用户代理向所述网络服务器发送所述第一访问请求。
  31. 根据权利要求30所述的装置，其特征在于，所述第四建立模块，具体用于：
    向所述用户代理发送第一数字证书，所述第一数字证书是证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述证书颁发机构的第二数字证书预先配置在所述用户代理中或安装有所述用户代理的终端的操作系统中，以使所述用户代理根据所述第二数字证书验证所述第一数字证书，在验证通过后，与所述中间代理节点建立所述加密代理连接；或，
    向所述用户代理发送第三数字证书和第四数字证书，所述第三数字证书是非授权证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述第四数字证书是所述非授权证书颁发机构的数字证书，以使所述用户代理根据所述第四数字证书验证所述第三数字证书，在验证通过后，与所述中间代理节点建立所述加密代理连接。
  32. 根据权利要求26所述的装置，其特征在于，所述第二连接建立请求是所述中间代理节点通过加密代理连接截获所述用户代理向所述网络服务器发送的所述第一访问请求后，指示所述用户代理发送的，所述加密代理连接是所述中间代理节点截获所述用户代理向所述网络服务器发送的TCP连接请求，读取所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接，在所述TCP连接建立完成后，利用预存的与所述网络服务器对应的数字证书与所述用户代理建立的。
  33. 一种业务处理装置，其特征在于，用于代理节点中，所述装置包括：总线，以及连接到所述总线的处理器、存储器、发射器和接收器。其中，所述存储器用于存储若干个指令，所述指令被配置成由所述处理器执行；
    所述接收器，用于接收用户代理发送的第一密文，所述第一密文由所述用户代理使用第一密钥对业务信息进行加密得到；
    所述处理器，用于使用第二密钥解密所述接收器接收到的所述第一密文，得到所述业务信息；
    所述发射器，用于将所述处理器解密后的所述业务信息发送给业务处理系统，以使所述业务处理系统将所述业务信息按照增值业务进行处理，并触发将处理后的所述业务信息发送给网络服务器的流程；
    其中，所述第一密钥和所述第二密钥是所述用户代理和所述代理节点在建立加密连接时约定的密钥。
  34. 根据权利要求33所述的装置，其特征在于，所述代理节点是中间代理节点，
    所述接收器，还用于在所述发射器将所述业务信息发送给业务处理系统之后，接收所述业务处理系统发送的处理后的所述业务信息；
    所述处理器，还用于与所述网络服务器建立加密连接，并约定第三密钥和第四密钥；使用所述第三密钥加密所述业务信息，得到第二密文；
    所述发射器，还用于将所述处理器加密后的所述第二密文发送给所述网络服务器，以使所述网络服务器使用所述第四密钥解密所述第二密文，得到所述业务信息。
  35. 根据权利要求34所述的装置，其特征在于，
    所述接收器，还用于在所述发射器将所述第二密文发送给所述网络服务器之后，接收所述网络服务器发送的第三密文，所述第三密文由所述网络服务器使用所述第四密钥对业务数据进行加密得到；
    所述处理器，还用于使用所述第三密钥解密所述接收器接收到的所述第三密文，得到所述业务数据；
    所述发射器，还用于将所述处理器解密后的所述业务数据发送给所述业务处理系统，以使所述业务处理系统将所述业务数据按照增值业务进行处理，将处理后的所述业务数据发送给所述中间代理节点；
    所述处理器，还用于使用所述第二密钥加密处理后的所述业务数据，得到第四密文；
    所述发射器，还用于将所述处理器加密后的所述第四密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第四密文，得到所述业务数据。
  36. 根据权利要求34或35所述的装置，其特征在于，
    所述接收器，还用于在接收用户代理发送的第一密文之前，截获所述用户代理向所述网络服务器发送的第一访问请求，所述发射器，还用于指示所述用户代理发送第一连接建立请求，所述处理器，还用于根据所述用户代理发送的所述第一连接建立请求，与所述用户代理建立所述加密连接，所述第一访问请求用于请求访问所述网络服务器；或，
    所述接收器，还用于在接收用户代理发送的第一密文之前，接收所述用户代理发送的第一连接建立请求，所述处理器，还用于根据所述用户代理发送的所述第一连接建立请求，与所述用户代理建立所述加密连接，所述第一连接建立请求是所述用户代理在接收到用户触发的触发信号后发送的，所述触发信号是用户触发所述用户代理中预存的所述中间代理节点的网页后生成的。
  37. 根据权利要求36所述的装置，其特征在于，所述发射器，具体用于通过重定向响应指示所述用户代理发送所述第一连接建立请求。
  38. 根据权利要求37所述的装置，其特征在于，
    所述重定向响应包括所述中间代理节点的网址，或，
    所述重定向响应包括代理网址，所述代理网址由所述中间代理节点对所述网络服务器的指示信息添加代理指示得到，所述指示信息为网页指示信息、网页中对象的对象指示信息、对所述网页指示信息或所述对象指示信息进行转换后得到的信息中的一种。
  39. 根据权利要求38所述的装置，其特征在于，当所述重定向响应包括所述中间代理节点的网址时，
    所述接收器，还用于在所述处理器根据所述用户代理发送的所述第一连接建立请求，与所述用户代理建立所述加密连接之后，接收所述用户代理发送的第五密文，所述第五密文由所述用户代理使用所述第一密钥对第二访问请求进 行加密得到，所述第二访问请求用于请求访问所述中间代理节点；
    所述处理器，还用于使用所述第二密钥解密所述接收器接收到的所述第五密文，得到所述第二访问请求；获取所述中间代理节点的网页；使用所述第二密钥加密所述网页，得到第六密文；
    所述发射器，还用于将所述所述处理器加密后的第六密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第六密文，得到所述网页，所述网页用于触发所述用户代理发送所述第一密文。
  40. 根据权利要求33所述的装置，其特征在于，所述代理节点是位于所述用户代理和中间代理节点之间的前端代理节点，还包括：
    所述接收器，还用于在所述发射器将所述业务信息发送给业务处理系统之后，接收所述业务处理系统发送的业务数据；
    所述处理器，还用于使用所述第二密钥加密所述接收器接收到的所述业务数据，得到第七密文；
    所述发射器，还用于将所述处理器加密后的所述第七密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第七密文，得到所述业务数据。
  41. 根据权利要求40所述的装置，其特征在于，
    所述接收器，还用于在接收用户代理发送的第一密文之前，截获所述用户代理向中间代理节点发送的第二连接建立请求，所述第二连接建立请求包括所述中间代理节点的目的因特网协议IP地址；
    所述处理器，用于根据所述目的IP地址和预存的所述中间代理节点的节点信息，与所述用户代理建立所述加密连接。
  42. 根据权利要求41所述的装置，其特征在于，
    所述第二连接建立请求是所述中间代理节点截获所述用户代理向所述网络服务器发送的第一访问请求后，指示所述用户代理发送的，所述第一访问请求用于请求访问所述网络服务器，或，
    所述第二连接建立请求是所述用户代理在接收到用户触发的触发信号后发送的，所述触发信号是用户触发所述用户代理中预存的所述中间代理节点的网 页后生成的。
  43. 根据权利要求42所述的装置，其特征在于，当所述第二连接建立请求是所述中间代理节点截获所述第一访问请求后，通过重定向响应指示所述用户代理发送的时，
    所述重定向响应包括所述中间代理节点的网址；或，
    所述重定向响应包括代理网址，所述代理网址由所述中间代理节点对所述网络服务器的指示信息添加代理指示得到，所述指示信息为网页指示信息、网页中对象的对象指示信息、对所述网页指示信息或所述对象指示信息进行转换后得到的信息中的一种。
  44. 根据权利要求43所述的装置，其特征在于，当所述重定向响应包括所述中间代理节点的网址时，
    所述接收器，还用于在所述处理器根据所述目的IP地址和预存的所述中间代理节点的节点信息，与所述用户代理建立所述加密连接之后，接收所述用户代理发送的第五密文，所述第五密文由所述用户代理使用所述第一密钥对第二访问请求进行加密得到，所述第二访问请求用于请求访问所述中间代理节点；
    所述处理器，还用于使用所述第二密钥解密所述接收器接收到的所述第五密文，得到所述第二访问请求；
    所述发射器，还用于将所述处理器解密后的所述第二访问请求发送给所述业务处理系统，以使所述业务处理系统将所述第二访问请求按照增值业务进行处理，将处理后的所述第二访问请求请求发送给所述中间代理节点；
    所述处理器，还用于使用所述第二密钥加密所述业务处理系统发送的网页，得到第六密文，所述网页由所述中间代理节点发送给所述业务处理系统；
    所述发射器，还用于将所述处理器加密后的所述第六密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第六密文，得到所述网页，所述网页用于触发所述用户代理发送所述第一密文。
  45. 根据权利要求41至44任一项所述的装置，其特征在于，
    所述节点信息包括数字证书和私钥，所述发射器，具体用于将所述数字证书发送给所述用户代理，所述接收器，具体用于接收所述用户代理根据所述数 字证书携带的公钥发送的加密信息，所述处理器，具体用于使用所述私钥对所述加密信息进行解密得到预主密钥，并使用所述目的IP地址与所述用户代理建立所述加密连接；或，
    所述节点信息包括数字证书，所述发射器，具体用于将所述数字证书发送给所述用户代理，所述接收器，具体用于接收所述用户代理根据所述数字证书携带的公钥发送的加密信息，所述发射器，还用于将所述加密信息发送给所述中间代理节点，所述接收器，还用于接收所述中间代理节点使用私钥对所述加密信息进行解密后发送的预主密钥，所述处理器，具体用于使用所述目的IP地址与所述用户代理建立所述加密连接；
    其中，所述预主密钥用于生成所述第一密钥和所述第二密钥。
  46. 根据权利要求36所述的装置，其特征在于，
    所述接收器，还用于截获所述用户代理向所述网络服务器发送的第一访问请求之前，截获所述用户代理向所述网络服务器发送的传输控制协议TCP连接请求；
    所述处理器，还用于读取所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接，在所述TCP连接建立完成后，利用预存的与所述网络服务器对应的数字证书与所述用户代理建立加密代理连接，所述加密代理连接供所述用户代理向所述网络服务器发送所述第一访问请求。
  47. 根据权利要求46所述的装置，其特征在于，
    所述发射器，还用于向所述用户代理发送第一数字证书，所述第一数字证书是证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述证书颁发机构的第二数字证书预先配置在所述用户代理中或安装有所述用户代理的终端的操作系统中，以使所述用户代理根据所述第二数字证书验证所述第一数字证书，在验证通过后，与所述中间代理节点建立所述加密代理连接；或，
    所述发射器，还用于向所述用户代理发送第三数字证书和第四数字证书，所述第三数字证书是非授权证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述第四数字证书是所述非授权证书颁发机构的数字证书，以使所述用户代理根据所述第四数字证书验证所述第三数字证书，在验证通过后，与所 述中间代理节点建立所述加密代理连接。
  48. 根据权利要求42所述的装置，其特征在于，所述第二连接建立请求是所述中间代理节点通过加密代理连接截获所述用户代理向所述网络服务器发送的所述第一访问请求后，指示所述用户代理发送的，所述加密代理连接是所述中间代理节点截获所述用户代理向所述网络服务器发送的TCP连接请求，读取所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接，在所述TCP连接建立完成后，利用预存的与所述网络服务器对应的数字证书与所述用户代理建立的。
PCT/CN2015/073784 2015-01-14 2015-03-06 业务处理方法及装置 WO2016112580A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP15877498.4A EP3242444A4 (en) 2015-01-14 2015-03-06 Service processing method and device
CN201580001098.5A CN106031097A (zh) 2015-01-14 2015-03-06 业务处理方法及装置
US15/650,484 US20170317836A1 (en) 2015-01-14 2017-07-14 Service Processing Method and Apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN2015070664 2015-01-14
CNPCT/CN2015/070664 2015-01-14

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/650,484 Continuation US20170317836A1 (en) 2015-01-14 2017-07-14 Service Processing Method and Apparatus

Publications (1)

Publication Number Publication Date
WO2016112580A1 true WO2016112580A1 (zh) 2016-07-21

Family

ID=56405155

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/073784 WO2016112580A1 (zh) 2015-01-14 2015-03-06 业务处理方法及装置

Country Status (4)

Country Link
US (1) US20170317836A1 (zh)
EP (1) EP3242444A4 (zh)
CN (1) CN106031097A (zh)
WO (1) WO2016112580A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018076183A1 (zh) * 2016-10-25 2018-05-03 华为技术有限公司 一种传输数据的方法、装置和系统

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3462666B1 (en) * 2016-06-07 2023-05-31 Huawei Technologies Co., Ltd. Service processing method and device
CN111355695B (zh) * 2018-12-24 2022-07-01 中移（杭州）信息技术有限公司 一种安全代理方法和装置
US11330094B2 (en) * 2019-03-29 2022-05-10 Snap Inc. Eyewear with customizable notifications
CN112040279B (zh) * 2020-08-11 2022-06-07 福建天泉教育科技有限公司 自定义drm的音视频播放方法、存储介质
CN114143082B (zh) * 2021-11-30 2023-10-13 北京天融信网络安全技术有限公司 一种加密通信方法、系统及装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050015490A1 (en) * 2003-07-16 2005-01-20 Saare John E. System and method for single-sign-on access to a resource via a portal server
CN1909685A (zh) * 2006-07-18 2007-02-07 华为技术有限公司 一种业务平台和门户分离的实现方法和系统
CN101026800A (zh) * 2007-03-13 2007-08-29 华为技术有限公司 数据业务内容的适配方法、系统及门户系统
CN101286843A (zh) * 2008-06-03 2008-10-15 江西省电力信息通讯有限公司 点对点模式下单点登录方法

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7412539B2 (en) * 2002-12-18 2008-08-12 Sonicwall, Inc. Method and apparatus for resource locator identifier rewrite
CN1275169C (zh) * 2002-12-30 2006-09-13 成都三零盛安信息系统有限公司 一种ssl中间代理用户证书的隧道传输方法
US8732332B2 (en) * 2003-11-19 2014-05-20 Alcatel Lucent Content switching with user-defined policies
US20060174001A1 (en) * 2005-01-31 2006-08-03 Shouyu Zhu Responding to malicious traffic using separate detection and notification methods
US7661131B1 (en) * 2005-02-03 2010-02-09 Sun Microsystems, Inc. Authentication of tunneled connections
CN100561909C (zh) * 2005-06-20 2009-11-18 中兴通讯股份有限公司 一种基于tls的ip多媒体子系统接入安全保护方法
US8190875B2 (en) * 2007-03-22 2012-05-29 Cisco Technology, Inc. Reducing processing load in proxies for secure communications
CN101436933B (zh) * 2007-11-16 2012-02-01 成都市华为赛门铁克科技有限公司 一种https加密访问方法、系统及装置
US8667146B2 (en) * 2008-01-26 2014-03-04 Citrix Systems, Inc. Systems and methods for configuration driven rewrite of SSL VPN clientless sessions
CN101984778B (zh) * 2008-01-26 2014-08-13 思杰系统有限公司 用于细粒度策略驱动的cookie代理的系统和方法
US9473542B2 (en) * 2011-12-09 2016-10-18 Telefonaktiebolaget Lm Ericsson (Publ) Method, server and user equipment for accessing an HTTP server
US9176838B2 (en) * 2012-10-19 2015-11-03 Intel Corporation Encrypted data inspection in a network environment
US9379931B2 (en) * 2014-05-16 2016-06-28 Cisco Technology, Inc. System and method for transporting information to services in a network environment

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050015490A1 (en) * 2003-07-16 2005-01-20 Saare John E. System and method for single-sign-on access to a resource via a portal server
CN1909685A (zh) * 2006-07-18 2007-02-07 华为技术有限公司 一种业务平台和门户分离的实现方法和系统
CN101026800A (zh) * 2007-03-13 2007-08-29 华为技术有限公司 数据业务内容的适配方法、系统及门户系统
CN101286843A (zh) * 2008-06-03 2008-10-15 江西省电力信息通讯有限公司 点对点模式下单点登录方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3242444A4 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018076183A1 (zh) * 2016-10-25 2018-05-03 华为技术有限公司 一种传输数据的方法、装置和系统

Also Published As

Publication number Publication date
US20170317836A1 (en) 2017-11-02
EP3242444A4 (en) 2018-01-24
CN106031097A (zh) 2016-10-12
EP3242444A1 (en) 2017-11-08

Similar Documents

Publication Publication Date Title
CN107666383B (zh) 基于https协议的报文处理方法以及装置
CN109088889B (zh) 一种ssl加解密方法、系统及计算机可读存储介质
US10693848B2 (en) Installation of a terminal in a secure system
US9553856B2 (en) Secure session capability using public-key cryptography without access to the private key
US8532620B2 (en) Trusted mobile device based security
EP3205048B1 (en) Generating a symmetric encryption key
WO2016112580A1 (zh) 业务处理方法及装置
US10257171B2 (en) Server public key pinning by URL
US20170310665A1 (en) Method and system for establishing a secure communication channel
US20180063131A1 (en) Mutual authentication
US20170293768A1 (en) Security through authentication tokens
US20130019092A1 (en) System to Embed Enhanced Security / Privacy Functions Into a User Client
CN105516161A (zh) 安全获取http请求的方法及系统
KR101880999B1 (ko) 사물 인터넷 네트워크의 엔드 투 엔드 데이터 암호화 시스템 및 방법
WO2016141513A1 (zh) 业务处理方法及装置
CN107209751B (zh) 业务处理方法及装置
Nainar et al. Capturing Secured Application Traffic for Analysis
JP6167598B2 (ja) 情報処理装置、情報処理方法、および、コンピュータ・プログラム
Gupta et al. An enhanced approach to use SSL for end to end security
EP3051770A1 (en) User opt-in computer implemented method for monitoring network traffic data, network traffic controller and computer programs
Hoffmann et al. SMARTPROXY: secure smartphone-assisted login on compromised machines

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15877498

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

REEP Request for entry into the european phase

Ref document number: 2015877498

Country of ref document: EP