WO2016141513A1 - 业务处理方法及装置 - Google Patents

业务处理方法及装置 Download PDF

Info

Publication number
WO2016141513A1
WO2016141513A1 PCT/CN2015/073797 CN2015073797W WO2016141513A1 WO 2016141513 A1 WO2016141513 A1 WO 2016141513A1 CN 2015073797 W CN2015073797 W CN 2015073797W WO 2016141513 A1 WO2016141513 A1 WO 2016141513A1
Authority
WO
WIPO (PCT)
Prior art keywords
user agent
connection
proxy node
ciphertext
intermediate proxy
Prior art date
Application number
PCT/CN2015/073797
Other languages
English (en)
French (fr)
Inventor
韦安妮
熊春山
郭建华
唐妙然
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201580027319.6A priority Critical patent/CN106464684B/zh
Priority to PCT/CN2015/073797 priority patent/WO2016141513A1/zh
Publication of WO2016141513A1 publication Critical patent/WO2016141513A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present invention relates to the field of communications, and in particular, to a service processing method and apparatus.
  • SSL Secure socket layer
  • TLS transport layer security
  • the SSL/TLS protocol is located between the transmission control protocol (English: transmission control protocol; TCP) protocol and the hypertext transfer protocol (English: hypertext transfer protocol; HTTP).
  • a service processing method provided by the related art includes: a user agent (English agent: UA) is based on a hypertext transfer protocol over secure socket layer (English: hyper text transfer protocol over secure socket layer; : HTTPS) establishes an encrypted connection with the network server, and stipulates the first key and the second key.
  • the user agent encrypts the service information by using the first key and sends the service information to the network server, and the network server decrypts the service information by using the second key.
  • the service data is generated according to the service information, and the service data is encrypted and sent to the user agent, and the user agent decrypts the service data by using the first key.
  • the service information may be used to request a webpage of the web server, or may be used to request an object in the web server.
  • an intermediate proxy node can also be set up between the user agent and the web server.
  • the intermediate proxy node is a portal site, which is equivalent to a gateway to the Internet.
  • Portals generally have search engines that allow users to find other websites they want to visit.
  • the intermediate proxy node provides a webpage including an input box, and the user inputs the web address of the website to be accessed in the input box, and the intermediate proxy node forwards the service information triggered by the user, and forwards the service data returned by the website to the user.
  • the intermediate proxy node can be a portal.
  • the intermediate proxy node when the encrypted connection is established between the user agent and the network server, the encrypted ciphertext transmitted between the user agent and the network server cannot be obtained because the intermediate proxy node cannot obtain the first key. And the second key, therefore, the intermediate proxy node cannot decrypt the ciphertext, The intermediate proxy node is unable to provide service optimization for the user agent.
  • the embodiment of the present invention provides a service processing method and device.
  • the technical solution is as follows:
  • a service processing method comprising:
  • the intermediate proxy node establishes a first connection with the user agent, and the first connection is an intermediate connection between the intermediate proxy node and the network proxy, and an encrypted connection established with the user agent;
  • the intermediate proxy node triggers establishing a second connection with the user agent according to the first indication information transmitted on the first connection;
  • the intermediate proxy node receives the service information sent by the user agent by using the second connection;
  • the intermediate proxy node processes the service information.
  • the intermediate proxy node establishes a first connection with the user agent, including:
  • the intermediate proxy node intercepts a transmission control protocol TCP connection request sent by the user agent to the network server;
  • the intermediate proxy node reads information in the TCP connection request, and replaces the network server with the user agent to establish a TCP connection according to the information;
  • the intermediate proxy node After the TCP connection is established, the intermediate proxy node establishes the first connection with the user agent by using a pre-stored digital certificate corresponding to the network server.
  • the intermediate proxy node establishes, by using a pre-stored digital certificate corresponding to the network server, the user agent
  • the first connection includes:
  • the intermediate proxy node sends a first digital certificate to the user agent, where the first digital certificate is a digital certificate issued by a certificate authority and corresponding to the network server, and the second digital certificate of the certificate authority is pre- Configuring in the user agent or an operating system of the terminal in which the user agent is installed, so that the user agent verifies the first digital certificate according to the second digital certificate, after the verification is passed,
  • An intermediate proxy node establishes the first connection; or,
  • the intermediate proxy node sends a third digital certificate and a fourth digital certificate to the user agent, where the third digital certificate is a number issued by an unauthorized certificate authority and corresponding to the network server a word certificate, the fourth digital certificate is a digital certificate of the non-authorized certificate authority, so that the user agent verifies the third digital certificate according to the fourth digital certificate, after the verification is passed,
  • the intermediate proxy node establishes the first connection.
  • the intermediate proxy node is The first indication transmitted on the connection triggers establishing a second connection with the user agent, including:
  • the intermediate proxy node intercepts, by using the first connection, a first access request sent by the user agent to the network server, where the first access request is used to request access to the network server;
  • the intermediate proxy node After the intermediate proxy node intercepts the first access request, the intermediate proxy node sends the first indication information to the user agent on the first connection, where the first indication information is used to indicate The user agent sends a connection establishment request to the intermediate proxy node;
  • the intermediate proxy node establishes the second connection with the user agent according to the connection establishment request.
  • the fourth possibility in the first aspect includes a redirect response message.
  • the redirect response message includes a URL of the intermediate proxy node, or the redirect response message
  • the proxy web address is obtained by the intermediate proxy node adding a proxy indication to the second indication information of the web server, where the second indication information includes webpage indication information, object indication information of an object in the webpage, One of the information obtained after the web page indication information or the object indication information is converted.
  • the intermediate proxy node establishes the second connection with the user agent according to the connection establishment request, include:
  • the intermediate proxy node establishes a TCP connection with the user agent according to the connection establishment request;
  • the intermediate proxy node After the establishment of the TCP connection is completed, the intermediate proxy node establishes the second connection with the user agent by using a digital certificate of the intermediate proxy node.
  • the intermediate proxy node by using the second connection, the service information sent by the user agent, includes:
  • the intermediate proxy node receives the first ciphertext sent by the user agent by using the second connection, and the first ciphertext is obtained by the user agent by using the first key to encrypt the service information;
  • the first key and the second key are keys agreed by the intermediate proxy node and the user agent when establishing the second connection.
  • the intermediate proxy node when the redirect response message includes a website address of the intermediate proxy node, the intermediate proxy node receives Before the first ciphertext sent by the user agent by using the second connection, the method further includes:
  • the intermediate proxy node receives a second ciphertext sent by the user agent, and the second ciphertext is obtained by the user agent by using the first key to encrypt a second access request, where the second access request is obtained. Used to request access to the intermediate proxy node;
  • the intermediate proxy node decrypts the second ciphertext by using the second key to obtain the second access request
  • the intermediate proxy node acquires a webpage of the intermediate proxy node
  • the intermediate proxy node encrypts the webpage by using the second key to obtain a third ciphertext
  • the intermediate proxy node when the redirect response message includes a website address of the intermediate proxy node, the intermediate proxy node is configured according to After the first indication information transmitted on the first connection triggers the establishment of the second connection with the user agent, the method further includes:
  • the intermediate proxy node receives a second access request sent by the user agent, and the second access request is used to request access to the intermediate proxy node;
  • the intermediate proxy node acquires a webpage of the intermediate proxy node
  • the intermediate proxy node sends the webpage to the user agent, and the webpage is used to trigger the user agent to send the service information.
  • the processing, by the intermediate proxy node, the service information including:
  • the intermediate proxy node establishes a third connection with the network server, and stipulates a third key and a fourth key;
  • the intermediate proxy node encrypts the service information by using the third key to obtain a fourth ciphertext
  • the intermediate proxy node sends the fourth ciphertext to the network server, so that the network server decrypts the fourth ciphertext by using the fourth key to obtain the service information.
  • the intermediate proxy node receives the fifth ciphertext sent by the network server, and the fifth ciphertext is obtained by the network server by using the fourth key to encrypt the service data;
  • the intermediate proxy node encrypts the service data by using the second key to obtain a sixth ciphertext
  • the intermediate proxy node sends the sixth ciphertext to the user agent, so that the user agent decrypts the sixth ciphertext by using the first key to obtain the service data.
  • a service processing apparatus for use in an intermediate proxy node, the apparatus comprising:
  • a first establishing module configured to establish a first connection with the user agent, where the first connection is an intermediate connection between the intermediate agent node and the network server, and an encrypted connection established with the user agent;
  • a second establishing module configured to trigger a second connection with the user agent according to the first indication information transmitted on the first connection established by the first establishing module
  • a first receiving module configured to receive, by using the second connection established by the second establishing module, service information sent by the user agent
  • the information processing module is configured to process the service information received by the first receiving module.
  • the first establishing module is specifically configured to:
  • the first connection is established with the user agent by using a pre-stored digital certificate corresponding to the network server.
  • the first establishing module is specifically configured to:
  • the first digital certificate is a digital certificate issued by a certificate authority and corresponding to the network server
  • the second digital certificate of the certificate authority is pre-configured in the user In an operating system of the terminal or the terminal in which the user agent is installed, so that the user agent verifies the first digital certificate according to the second digital certificate, and after the verification is passed, establishes with the intermediate agent node Said first connection; or,
  • the third digital certificate is a digital certificate issued by an unauthorized certificate authority and corresponding to the network server
  • the fourth digital certificate is the non- Authorizing a digital certificate of the certificate authority to cause the user agent to verify the third digital certificate according to the fourth digital certificate, and establishing the first connection with the intermediate agent node after the verification is passed.
  • the second establishing module is specifically configured to:
  • the first indication information is sent to the user agent on the first connection, where the first indication information is used to indicate that the user agent is to the intermediate proxy node.
  • the fourth possibility in the second aspect includes a redirect response message.
  • the redirect response message includes a URL of the intermediate proxy node, or the redirect response message
  • the proxy web address is obtained by the intermediate proxy node adding a proxy indication to the second indication information of the web server, where the second indication information includes webpage indication information, object indication information of an object in the webpage, One of the information obtained after the web page indication information or the object indication information is converted.
  • the second establishing module is further configured to:
  • the second connection is established with the user agent by using the digital certificate of the intermediate proxy node.
  • the first receiving module is specifically configured to:
  • the first key and the second key are keys agreed by the intermediate proxy node and the user agent when establishing the second connection.
  • the apparatus when the redirect response message includes a URL of the intermediate proxy node, the apparatus further includes :
  • a second receiving module configured to receive, by the first receiving module, a second ciphertext sent by the user agent, before receiving the first ciphertext sent by the user agent by using the second connection, the second ciphertext Encrypting the second access request by the user agent by using the first key, and the second access request is used to request access to the intermediate proxy node;
  • a first decryption module configured to decrypt the second ciphertext received by the second receiving module by using the second key, to obtain the second access request
  • a third obtaining module configured to acquire a webpage of the intermediate proxy node
  • a first encryption module configured to encrypt the webpage acquired by the third obtaining module by using the second key, to obtain a third ciphertext
  • a first sending module configured to send the third ciphertext obtained by encrypting the first cryptographic module to the user agent, so that the user agent decrypts the third ciphertext by using the first key And obtaining the webpage, where the webpage is used to trigger the user agent to send the first ciphertext.
  • the device when the redirect response message includes a website address of the intermediate proxy node, the device further includes :
  • a third receiving module configured, by the second establishing module, according to the first transmission on the first connection
  • the indication information triggers establishing a second connection with the user agent, receiving a second access request sent by the user agent, where the second access request is used to request access to the intermediate proxy node;
  • a fourth obtaining module configured to acquire a webpage of the intermediate proxy node
  • a second sending module configured to send the webpage acquired by the fourth acquiring module to the user agent, where the webpage is used to trigger the user agent to send the service information.
  • the information processing module is specifically configured to:
  • the device further includes:
  • a fourth receiving module configured to: after the information processing module sends the fourth ciphertext to the network server, receive a fifth ciphertext sent by the network server, where the fifth ciphertext is used by the network server Encrypting the service data by using the fourth key;
  • a second decrypting module configured to decrypt the fifth ciphertext received by the fourth receiving module by using the third key, to obtain the service data
  • a second encryption module configured to encrypt the service data obtained by decrypting the second decryption module by using the second key, to obtain a sixth ciphertext
  • a third sending module configured to send the sixth ciphertext obtained by encrypting the second cryptographic module to the user agent, so that the user agent decrypts the sixth ciphertext by using the first key , get the business data.
  • a service processing apparatus for use in an intermediate proxy node, the apparatus comprising: a bus, and a processor, a memory, a transmitter, and a receiver coupled to the bus.
  • the memory is for storing a plurality of instructions, the instructions being configured to be executed by the processor;
  • the processor is configured to establish a first connection with a user agent, where the first connection is the intermediate generation
  • the node replaces the network server, and establishes an encrypted connection with the user agent; and triggers establishing a second connection with the user agent according to the first indication information transmitted on the first connection;
  • the receiver configured to receive, by using the second connection established by the processor, service information sent by the user agent;
  • the processor is further configured to process the service information received by the receiver.
  • the receiver is further configured to intercept a transmission control protocol TCP connection request sent by the user agent to the network server;
  • the processor is further configured to read, in the TCP connection request intercepted by the receiver, to establish a TCP connection with the user agent according to the information, and after the TCP connection is established, And establishing the first connection with the user agent by using a pre-stored digital certificate corresponding to the network server.
  • the transmitter is further configured to send, to the user agent, a first digital certificate, where the first digital certificate is a digital certificate issued by a certificate authority and corresponding to the network server, and the second certificate authority
  • the digital certificate is pre-configured in an operating system of the user agent or a terminal in which the user agent is installed, so that the user agent verifies the first digital certificate according to the second digital certificate, after the verification is passed, Establishing the first connection with the intermediate proxy node; or,
  • the transmitter is further configured to send, to the user agent, a third digital certificate and a fourth digital certificate, where the third digital certificate is a digital certificate issued by an unauthorized certificate authority and corresponding to the network server,
  • the fourth digital certificate is a digital certificate of the non-authorized certificate authority, so that the user agent verifies the third digital certificate according to the fourth digital certificate, and after the verification is passed, establishes with the intermediate agent node Said the first connection.
  • the receiver is further configured to intercept, by using the first connection, a first access request sent by the user agent to the network server, where the first access request is used to request access to the network server;
  • the transmitter is further configured to: after the receiver intercepts the first access request, send the first indication information to the user agent on the first connection, where the first indication information is used by Instructing the user agent to send a connection establishment request to the intermediate proxy node;
  • the processor is specifically configured to establish the second connection with the user agent according to the connection establishment request.
  • the fourth possibility in the third aspect includes a redirect response message.
  • the redirect response message includes a URL of the intermediate proxy node, or the redirect response message
  • the proxy web address is obtained by the intermediate proxy node adding a proxy indication to the second indication information of the web server, where the second indication information includes webpage indication information, object indication information of an object in the webpage, One of the information obtained after the web page indication information or the object indication information is converted.
  • the processor is further configured to establish a TCP connection with the user agent according to the connection establishment request; After the TCP connection is established, the second connection is established with the user agent by using the digital certificate of the intermediate proxy node.
  • the receiver is configured to receive, by the user, the first The ciphertext, where the first ciphertext is encrypted by the user agent by using the first key to encrypt the service information;
  • the processor is specifically configured to decrypt the first ciphertext received by the receiver according to the second key, to obtain the service information
  • the first key and the second key are keys agreed by the intermediate proxy node and the user agent when establishing the second connection.
  • the receiver is further configured to receive a second ciphertext sent by the user agent before receiving the first ciphertext sent by the user agent by using the second connection, where the second ciphertext is used by the user agent Encrypting the second access request by using the first key, where the second access request is used to request access to the intermediate proxy node;
  • the processor is further configured to decrypt the second ciphertext received by the receiver by using the second key to obtain the second access request, acquire a webpage of the intermediate proxy node, and use the Second Encrypting the webpage with a key to obtain a third ciphertext;
  • the transmitter is further configured to send the third ciphertext encrypted by the processor to the user agent, so that the user agent decrypts the third ciphertext by using the first key, Obtaining the webpage, where the webpage is used to trigger the user agent to send the first ciphertext.
  • the receiver is further configured to receive, by the processor, a second access request sent by the user agent after triggering establishing a second connection with the user agent according to the first indication information transmitted on the first connection,
  • the second access request is used to request access to the intermediate proxy node;
  • the processor is further configured to acquire a webpage of the intermediate proxy node
  • the transmitter is further configured to send the webpage acquired by the processor to the user agent, where the webpage is used to trigger the user agent to send the service information.
  • the processor is specifically configured to establish a third connection with the network server, and stipulate a third key and a fourth key; use the third key to encrypt the service information to obtain a fourth ciphertext;
  • the transmitter is configured to send the fourth ciphertext encrypted by the processor to the network server, so that the network server decrypts the fourth ciphertext by using the fourth key, Obtain the business information.
  • the receiver is further configured to: after the transmitter sends the fourth ciphertext to the network server, receive a fifth ciphertext sent by the network server, where the fifth ciphertext is used by the network server Encrypting the service data by using the fourth key;
  • the processor is further configured to decrypt the fifth ciphertext received by the receiver by using the third key to obtain the service data, and encrypt the service data by using the second key to obtain Sixth ciphertext;
  • the transmitter is further configured to send the sixth ciphertext encrypted by the processor to the user agent, so that the user agent decrypts the sixth ciphertext by using the first key, Obtain the business data.
  • the first connection is an intermediate proxy node replacing the network server, establishing an encrypted connection with the user agent; triggering establishing a second connection with the user agent according to the first indication information transmitted on the first connection;
  • the second connection receives the service information sent by the user agent; and processes the service information, when the user agent requests to establish an encrypted connection with the network server, the network server is replaced with the user agent to establish an encrypted first connection, and then the first connection is used.
  • the first indication information transmitted triggers a second connection with the user agent, and provides service optimization to the user agent through the second connection, which solves the problem that the intermediate agent node cannot decrypt the ciphertext, and the intermediate agent node cannot provide service optimization for the user agent. Achieved the effect of optimizing the business.
  • FIG. 1 is a flowchart of a method for processing a service according to an embodiment of the present invention
  • FIG. 2A is a flowchart of still another method for processing a service according to an embodiment of the present invention.
  • 2B is a schematic diagram of establishing a TLS connection according to an embodiment of the present invention.
  • FIG. 3 is a flowchart of an application of a first service processing method according to an embodiment of the present invention.
  • FIG. 4 is a flowchart of still another method for processing a service according to an embodiment of the present invention.
  • FIG. 5 is a flowchart of an application of a second service processing method according to an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of a service processing apparatus according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic structural diagram of still another service processing apparatus according to an embodiment of the present invention.
  • FIG. 8 is a schematic structural diagram of a service processing apparatus according to an embodiment of the present invention.
  • FIG. 1 is a flowchart of a method for processing a service according to an embodiment of the present invention.
  • the service processing method may include:
  • Step 101 The intermediate proxy node establishes a first connection with the user agent, and the first connection is an intermediate proxy node replacing the network server and establishing an encrypted connection with the user agent.
  • Step 102 The intermediate proxy node establishes a second connection with the user agent according to the first indication information transmitted on the first connection.
  • Step 103 The intermediate proxy node receives the service information sent by the user agent through the second connection.
  • step 104 the intermediate proxy node processes the service information.
  • the service processing method establishes a first connection with a user agent, where the first connection is an intermediate proxy node replacing the network server, and an encrypted connection established with the user agent; and transmitting according to the first connection
  • the first indication information triggers establishing a second connection with the user agent; receiving the service information sent by the user agent through the second connection; processing the service information, and replacing the network server and the user when the user agent requests to establish an encrypted connection with the network server
  • the proxy establishes the encrypted first connection, and then uses the first indication information transmitted on the first connection to trigger a second connection with the user agent, and provides service optimization to the user agent through the second connection, thereby solving the problem that the intermediate proxy node cannot decrypt the ciphertext.
  • the intermediate agent node cannot provide service optimization for the user agent, and the effect of optimizing the business is achieved.
  • the service processing method may include:
  • Step 201 The intermediate proxy node establishes a first connection with the user agent, and the first connection is an intermediate proxy node replacing the network server and establishing an encrypted connection with the user agent.
  • the intermediate proxy node can be a Portal.
  • the intermediate proxy node may also be other sites, which is not limited in this embodiment.
  • the intermediate proxy node can replace the network server to establish a first connection with the user agent.
  • the first connection may be a connection based on the SSL/TLS protocol.
  • the first connection is based on a connection control protocol (English: transmission control protocol; TCP: connection), which is an SSL connection and a TLS connection.
  • TCP transmission control protocol
  • the encryption connection of the SSL protocol is similar to the establishment process of the TLS protocol-based encrypted connection. The following is an example of an encrypted connection based on the TLS protocol.
  • the intermediate proxy node establishes a first connection with the user agent, including:
  • the intermediate proxy node intercepts the TCP connection request sent by the user agent to the network server;
  • the intermediate proxy node reads the information in the TCP connection request, and replaces the network server with the user agent to establish a TCP connection according to the information;
  • the intermediate proxy node After the TCP connection is established, the intermediate proxy node establishes a first connection with the user agent by using the pre-stored digital certificate corresponding to the network server.
  • the user agent needs to establish a TCP connection with the web server.
  • the TCP connection port includes port 80 and port 443. If the user agent needs to access the network server based on the HTTP protocol, the port of the TCP connection is port 80; if the user agent needs to use the high-text transmission security of the lower layer using SSL/TLS protocol
  • the protocol (English: hyper text transfer protocol over secure socket layer; abbreviation: HTTPS) accesses the network server, and the TCP connection port is port 443.
  • the intermediate proxy node intercepts the TCP connection request sent by the user agent.
  • the information in the TCP connection request includes the source Internet protocol (English: Internet Protocol; IP address), the source port, the destination IP address, the destination port, and the source end.
  • the destination is the web server.
  • the intermediate proxy node uses the above information to replace the network server, and establishes a TCP connection with the user agent port 443. After the TCP connection is established, the intermediate proxy node establishes the first connection with the user agent by using the pre-stored digital certificate corresponding to the network server.
  • the first connection refers to an intermediate proxy node replacing the network server and establishing an encrypted connection with the user agent.
  • FIG. 2B Please refer to the setup diagram of the TLS connection shown in FIG. 2B, which shows the process of establishing a TLS connection between the user agent and the intermediate agent node.
  • step 201' the user agent sends the TLS protocol version number, the encryption algorithm list, and the first random number to the intermediate proxy node.
  • Step 202' if the intermediate proxy node supports the TLS protocol version, an encryption algorithm selected from the encryption algorithm list sends the TLS protocol version number, the encryption algorithm, the session identifier, and the second random number to the user agent.
  • Step 203' the intermediate proxy node sends a digital certificate corresponding to the network server to the user agent.
  • step 204' the intermediate proxy node sends a first completion message to the user agent.
  • Step 205' the user agent verifies the digital certificate, and after obtaining the verification, acquires the public key in the digital certificate, generates a pre-master key, and encrypts the pre-master key by using the public key, and obtains the public key exchange information. Send to the intermediate agent node.
  • step 206' the user agent sends a change password description to the intermediate proxy node, informing the intermediate proxy node to initiate the negotiated parameters.
  • the user agent generates the first key according to the first random number, the second random number, the pre-master key, and the encryption algorithm.
  • Step 207' the user agent sends a second completion message to the intermediate proxy node.
  • step 208' the intermediate proxy node sends a change password description to the user agent, informing the user agent to initiate the negotiated parameters.
  • the intermediate proxy node decrypts the public key exchange information using the private key to obtain a pre-master key, and generates a second key according to the first random number, the second random number, the pre-master key, and the encryption algorithm.
  • step 209' the intermediate proxy node sends a third completion message to the user agent.
  • the intermediate proxy node before establishing the first connection with the user agent, the intermediate proxy node also needs to obtain a digital certificate and a private key corresponding to the network server, and the digital certificate includes at least a public key, an owner name, and a digital signature of the certificate authority.
  • a digital signature is a hash value obtained by hashing information to verify whether the information has been tampered with.
  • the digital signature in this embodiment is used to verify whether the digital certificate has been tampered with.
  • the intermediate proxy node establishes the first connection with the user agent by using the pre-stored digital certificate corresponding to the network server, including:
  • the intermediate proxy node sends a first digital certificate to the user agent, the first digital certificate is a digital certificate issued by the certificate authority and corresponding to the network server, and the second digital certificate of the certificate authority is pre-configured in the user agent or installed The operating system of the terminal of the user agent, so that the user agent verifies the first digital certificate according to the second digital certificate, and establishes a first connection with the intermediate agent node after the verification is passed; or
  • the intermediate proxy node sends a third digital certificate and a fourth digital certificate to the user agent, the third digital certificate is a digital certificate issued by an unauthorized certificate authority and corresponding to the network server, and the fourth digital certificate is a number of the non-authorized certificate authority
  • the certificate is such that the user agent verifies the third digital certificate according to the fourth digital certificate, and after the verification is passed, establishes a first connection with the intermediate proxy node.
  • the digital certificate corresponding to the network server may be a real digital certificate of the network server, or may be a digital certificate other than the real digital certificate, and the other digital certificate has a corresponding relationship with the network server.
  • the other digital certificate may be a proxy digital certificate or a fake digital certificate, and the specific content is as follows.
  • the certificate authority can be an authorized certificate authority or an unauthorized certificate authority.
  • the authorized certificate authority When the certificate authority is an authorized certificate authority, the authorized certificate authority issues a proxy digital certificate of the network server for the trusted intermediate agent node according to security monitoring and the like, and the agent digital certificate is the first digital certificate.
  • the authorization certificate issuing authority may issue different proxy digital certificates for each network server, and may also issue the same proxy digital certificate for multiple different network servers, which is not limited in this embodiment.
  • the proxy digital certificate of the network server may also be a sub-certificate on the digital certificate chain of the network server.
  • This sub-certificate can be issued by a network server or by another third-party authorized certificate authority.
  • the proxy digital certificate may be the same as the real digital certificate issued by the authorized certificate authority for the network server, or may be different from the real digital certificate. That is, the proxy digital certificate and the real digital certificate can have different public and private key pairs.
  • the non-authorized certificate authority issues a digital certificate of the network server for the intermediate agent node, and the digital certificate at this time is a fake digital certificate, and the fake digital certificate is the first digital certificate.
  • the user agent verifies the digital certificate, it checks whether the root certificate of the certificate authority of the digital certificate is in the list of the trusted certificate authority (English: Certificate Authority; CA), and the root certificate is the second digital certificate. If the root certificate is located in the trusted CA list, the digital signature in the digital certificate is verified according to the public key of the root certificate. If the verification of the digital signature is successful, the verification of the digital certificate is successful; if the verification of the digital signature fails , the verification of the digital certificate fails; if the root certificate is not in the list of trusted CAs, the verification of the digital certificate fails.
  • the root certificate authority of the digital certificate is in the list of the trusted certificate authority (English: Certificate Authority; CA)
  • the root certificate is the second digital certificate. If the root certificate is located in the trusted CA list, the digital signature in the digital certificate is verified according to the public key of the root certificate. If the verification of the digital signature is successful, the verification of the digital certificate is successful; if the verification of the digital signature fails , the verification of the digital certificate fails; if the root certificate
  • the digital certificate corresponding to the network server obtained by the intermediate proxy node may be issued by a multi-level certificate authority.
  • the digital certificate corresponding to the network server obtained by the intermediate agent node is issued by the intermediate certificate authority Issuer, and the digital certificate issued by the intermediate certificate authority Issuer is issued by the advanced certificate authority Root CA.
  • the user agent searches for the digital certificate of the certificate authority step by step, and detects whether the root certificate of the certificate authority of the digital certificate is located in the trusted CA list, and if the root certificate is located in the trusted CA list, according to the root certificate
  • the public key verifies the digital signature in the lower-level digital certificate.
  • the digital signature in the lower-level digital certificate is verified according to the public key of the lower-level digital certificate until the verification of all the digital signatures is successful.
  • the verification of the certificate is successful; if the verification of one of the digital signatures fails, the verification of the digital certificate fails; If the root certificate is not in the list of trusted CAs, the verification of the digital certificate fails.
  • the root certificate of the authorized certificate authority is pre-configured in the user agent or the operating system of the terminal where the user agent is installed, that is, the authorized certificate authority
  • the root certificate is pre-configured in the list of trusted CAs; when the certificate authority is an unauthorized certificate authority, the root certificate of the non-authorized certificate authority needs to be added to the list of trusted CAs.
  • the intermediate proxy node may obtain a digital certificate chain sent by an unauthorized certificate authority, where the digital certificate chain includes at least a digital certificate of an unauthorized certificate authority, that is, a self-signed root certificate, that is, a fourth The digital certificate, and the counterfeit digital certificate of the network server, the intermediate agent node sends the digital certificate chain to the user agent, and the fake digital certificate is a third digital certificate.
  • the user agent When the user agent verifies the digital certificate, it reads the public key of the root certificate in the received digital certificate chain, and verifies the digital signature in the fake digital certificate according to the public key. If the verification of the digital signature is successful, the counterfeit number is The verification of the certificate is successful; if the verification of the digital signature fails, the verification of the fake digital certificate fails.
  • the fake digital certificate obtained by the intermediate proxy node may be issued by a multi-level non-authorized certificate authority, that is, the certificate chain further includes a digital certificate of a multi-level non-authorized certificate authority.
  • the digital certificate corresponding to the network server obtained by the intermediate agent node is issued by the non-authorized intermediate certificate authority Issuer, and the digital certificate of the non-authorized intermediate certificate authority Issuer is issued by the non-authorized advanced certificate authority Root CA.
  • the user agent searches for the digital certificate of the unauthorized certificate authority step by step from the received digital certificate, and verifies the digital signature in the lower level digital certificate according to the public key of the root certificate.
  • the public key of the lower-level digital certificate verifies the digital signature in the lower-level digital certificate until the verification of the digital certificate is successful after all the digital signatures are successfully verified; if the verification of one of the digital signatures fails, the verification of the digital certificate fails. .
  • Step 202 The intermediate proxy node triggers establishing a second connection with the user agent according to the first indication information transmitted on the first connection.
  • the intermediate proxy node triggers the user according to the first indication information transmitted on the first connection.
  • the proxy establishes a second connection, including:
  • the intermediate proxy node intercepts, by using the first connection, a first access request sent by the user agent to the network server, where the first access request is used to request access to the network server;
  • the intermediate proxy node After the intermediate proxy node intercepts the first access request, the intermediate proxy node sends first indication information to the user agent on the first connection, where the first indication information is used to indicate that the user proxy sends a connection establishment request to the intermediate proxy node;
  • the intermediate proxy node establishes a second connection with the user agent according to the connection establishment request.
  • the first access request may specifically request access to an object in a web server's home page or a web server.
  • the first indication information includes a redirect response message.
  • the redirect response message can be HTTP Redirection.
  • the location header field of the redirect response message may include type information, where the type information is used to indicate a connection type that the user agent requests to establish.
  • the type information may carry HTTPS, and the HTTPS is used to indicate the HTTPS protocol; when the redirect response message needs to indicate that the user agent establishes an unencrypted connection, the type information may be It carries HTTP, and HTTP is used to indicate the HTTP protocol. This example is described by taking the HTTPS as the type information. In this case, the connection establishment request is used to request to establish an encrypted second connection, and the port is port 443.
  • the redirect response message includes a web address of the intermediate proxy node, or the redirect response message includes a proxy web address, and the proxy web address is obtained by the intermediate proxy node adding a proxy indication to the second indication information of the network server, where the second indication information includes the webpage indication information.
  • the second indication information includes the webpage indication information.
  • one of object indication information of the object in the webpage information obtained by converting the webpage indication information or the object indication information.
  • the redirect response message needs to include the URL of the intermediate proxy node so that the user proxy accesses the web server through the intermediate proxy node.
  • the redirect response message may only include the URL of the intermediate proxy node, www.portal.com.
  • the redirect response message includes not only the website address of the intermediate proxy node, but also the webpage indication information or the object indication information of the web server or the information obtained by converting one of the two types of information, the webpage.
  • the indication information and the object indication information can be obtained from the first access request.
  • the redirect response message may include www.portal.com/view?
  • the intermediate proxy node may be in the process of establishing a first connection with the user agent, and
  • the user agent stipulates the encryption key and the decryption key.
  • the intermediate proxy node may encrypt the redirect response message by using the encryption key, and send the encrypted ciphertext to the user agent, and the user agent decrypts the ciphertext by using the decryption key to obtain a redirect response message.
  • the user agent generates a connection establishment request according to the redirect response message, sends a connection establishment request to the intermediate proxy node, and the intermediate proxy node obtains a connection establishment request.
  • the second connection established by the intermediate proxy node and the user agent may be an encrypted connection or a non-encrypted connection TCP connection.
  • the intermediate proxy node establishes a second connection with the user agent according to the connection establishment request, including: the intermediate proxy node establishes a TCP connection with the user agent according to the connection establishment request; after the TCP connection is established, the intermediate proxy node A second connection is established with the user agent using the digital certificate of the intermediate proxy node.
  • the flow of the intermediate proxy node establishing a TLS connection with the user agent is similar to the flow shown in Figure 2B, except that in step 204', the intermediate proxy node sends the digital certificate of the intermediate proxy node to the user agent.
  • Step 203 The intermediate proxy node receives the first ciphertext sent by the user agent through the second connection, and the first ciphertext is obtained by the user agent encrypting the service information by using the first key.
  • the service information is used for performing service interaction with the network server, and may be specifically used for requesting service from the network server, or may be specifically used for sending service data to the network server.
  • the service information may be used to request a homepage of the network server, or may be used to request an object in the network server, where the object may be an object stored in the network server. It may also be an object stored in another server and the uniform resource identifier (English: uniform resource identifier; URI) of the object is included in the webpage of the web server.
  • URI uniform resource identifier
  • the service information at this time includes www.ottserver.com; when the web page of the OTT server includes the URI and the service information is used to request the OTT server.
  • the URI of the webpage is www.ottserver.com/picture1.gif and the user needs to obtain the picture 1 indicated by the URI, and the service information includes www.ottserver.com/picture1.gif. .
  • the service information may be obtained by the intermediate proxy node adding an agent indication to the foregoing website address.
  • the proxy indicates an intermediate proxy node used to indicate the transit service, and may be a web address of the intermediate proxy node.
  • the proxy indication may be the URL of the intermediate proxy node www.portal.com.
  • the intermediate proxy node may further convert the webpage indication information or the object indication information, and add a proxy indication to the information obtained after the conversion to obtain the service information.
  • the conversion can convert the plaintext into ciphertext for transmission, which can improve the security of data transmission.
  • the intermediate proxy node agrees on the key in the process of establishing a second connection with the user agent.
  • the first key and the second key may be agreed.
  • the first key is stored in the user agent, and the user agent may use the first key to encrypt and send to the middle.
  • the plaintext of the proxy node may also use the first key to decrypt the ciphertext sent by the intermediate proxy node;
  • the second key is stored in the intermediate proxy node, and the intermediate proxy node may use the second key to encrypt the plaintext to be sent to the user proxy.
  • the second key can also be used to decrypt the ciphertext sent by the user agent.
  • the first key and the second key may be agreed upon, and the fifth key and the sixth key are agreed, and the first key and the fifth key are stored in
  • the user agent may encrypt the plaintext to be sent to the intermediate proxy node using the first key, decrypt the ciphertext sent by the intermediate proxy node using the fifth key, and store the second key and the sixth key in the intermediate proxy node.
  • the intermediate proxy node may use the second key to encrypt the plaintext to be sent to the user agent, and the sixth key to decrypt the ciphertext sent by the user agent.
  • the first key and the second key may be symmetric keys or asymmetric keys; the fifth key and the sixth key may be symmetric keys or asymmetric keys. The following is an example in which the encryption key and the decryption key of the same device are the same.
  • the method before the redirecting response message includes the URL of the intermediate proxy node, before the intermediate proxy node receives the first ciphertext sent by the user proxy by using the second connection, the method further includes:
  • the intermediate proxy node receives the second ciphertext sent by the user agent, the second ciphertext is obtained by the user agent encrypting the second access request by using the first key, and the second access request is used to request access to the intermediate proxy node;
  • the intermediate proxy node decrypts the second ciphertext using the second key to obtain a second access request
  • the intermediate proxy node encrypts the webpage by using the second key to obtain a third ciphertext
  • the intermediate proxy node sends the third ciphertext to the user agent, so that the user agent uses the first secret
  • the key decrypts the third ciphertext to obtain a webpage, and the webpage is used to trigger the user agent to send the first ciphertext.
  • the second access request may specifically request access to an object in the home page of the intermediate agent node or the intermediate agent node.
  • the user proxy further needs to obtain the webpage of the intermediate proxy node according to the URL of the intermediate proxy node, so that the user triggers the webpage after receiving the webpage, and the user proxy sends the connection according to the trigger.
  • a request is established and the first ciphertext is sent after establishing a second connection with the intermediate proxy node.
  • Step 204 The intermediate proxy node decrypts the first ciphertext according to the second key to obtain service information, where the first key and the second key are keys agreed by the intermediate proxy node and the user agent when establishing the second connection.
  • the intermediate proxy node determines the second key corresponding to the first key, and decrypts the first ciphertext by using the second key to obtain service information.
  • the intermediate proxy node may search for the service data requested by the service information in the cache. If the service data exists, step 210 is performed. The response speed of the service information is increased; if the service data does not exist, step 205 is performed. When the intermediate proxy node does not have the function of caching the service data of the web server, step 205 is performed.
  • Step 205 The intermediate proxy node establishes a third connection with the network server, and stipulates a third key and a fourth key.
  • the intermediate proxy node parses the web address of the web server from the processed service information, and establishes an encrypted connection with the web server indicated by the webpage, and The third key and the fourth key are agreed upon.
  • the process of establishing an encrypted connection between the intermediate proxy node and the network server is similar to the process of establishing an encrypted connection between the intermediate proxy node and the user agent, and is not described here.
  • the service information includes the object indication information or the information obtained by converting the object indication information
  • the intermediate proxy node when the intermediate proxy node has acquired the webpage of the network server, that is, the intermediate proxy node has established with the network server.
  • the intermediate proxy node parses out the processed service information.
  • the web server's web address establishes an encrypted connection with the web server indicated by the web address, and stipulates the third key and the fourth key, which are not described here.
  • Step 206 The intermediate proxy node encrypts the service information by using the third key to obtain a fourth ciphertext.
  • the service information in this step may be service information in which the URL of the intermediate proxy node is removed. That is, the service information at this time includes only the network server indication information, or the service information includes only the object indication information.
  • Step 207 The intermediate proxy node sends the fourth ciphertext to the network server, so that the network server decrypts the fourth ciphertext by using the fourth key to obtain service information.
  • Step 208 The intermediate proxy node receives the fifth ciphertext sent by the network server, and the fifth ciphertext is obtained by the network server encrypting the service data by using the fourth key.
  • the network server obtains the corresponding service data according to the service information, and encrypts the service data by using the fourth key to obtain the fifth ciphertext, and sends the fifth ciphertext to the intermediate proxy node.
  • the service data may be the home page of the web server; when the service information includes www.ottserver.com/picture1.gif, the service data may be picture 1.
  • Step 209 The intermediate proxy node decrypts the fifth ciphertext by using the third key to obtain service data.
  • Step 210 The intermediate proxy node encrypts the service data by using the second key to obtain a sixth ciphertext.
  • the webpage may further include object indication information
  • the intermediate proxy node further needs to add an agent indication to the object indication information.
  • the web page includes the URI of picture 1
  • Step 211 The intermediate proxy node sends the sixth ciphertext to the user agent, so that the user agent decrypts the sixth ciphertext by using the first key to obtain service data.
  • the service processing method establishes a first connection with a user agent, where the first connection is an intermediate proxy node replacing the network server, and an encrypted connection established with the user agent; and transmitting according to the first connection
  • the first indication information triggers establishing a second connection with the user agent; receiving the service information sent by the user agent through the second connection; processing the service information, and replacing the network server and the user when the user agent requests to establish an encrypted connection with the network server
  • the proxy establishes the encrypted first connection, and then uses the first indication information transmitted on the first connection to trigger a second connection with the user agent, and provides service optimization to the user agent through the second connection, thereby solving the problem that the intermediate proxy node cannot decrypt the ciphertext.
  • the intermediate agent node cannot provide service optimization for the user agent, and the effect of optimizing the business is achieved.
  • the proxy digital certificate corresponding to the network server or the fake digital certificate can be used to replace the network server.
  • establishing a first connection with the user agent enriches the implementation of establishing the first connection with the user agent.
  • the redirect response message includes a proxy web address
  • the proxy web address is obtained by the intermediate proxy node adding a proxy indication to the second indication information of the web server, where the second indication information includes the webpage indication information, the object indication information of the object in the webpage, and the webpage indication information.
  • one of the information obtained after the object indication information is converted may directly send the webpage indication information or the object indication information or the information obtained by converting one of the two kinds of information to the user agent, without first acquiring
  • the webpage of the intermediate proxy node which triggers the webpage of the intermediate proxy node to obtain the webpage indication information or the object indication information or the information obtained by converting one of the two kinds of information, can simplify the operation flow and improve the efficiency of the business processing. .
  • the process of the service processing method is described below by taking the user agent and the intermediate proxy node to establish an encrypted second connection, the intermediate proxy node, and the network server to establish an encrypted third connection as an example.
  • the intermediate proxy node is a portal
  • the user proxy is a UA
  • the network server is an OTT server.
  • the portal intercepts the TCP connection request sent by the UA to the OTT server, and replaces the OTT server with the UA to establish a TCP connection (port 443) according to the information in the TCP connection request.
  • Step 302 The Portal uses a TLS handshake process between the digital certificate corresponding to the OTT server and the UA.
  • step 303 the Portal intercepts the encrypted GET request sent by the UA to the OTT server.
  • the GET request is the first access request.
  • Step 304 The Portal sends the encrypted redirect response message to the UA and/or the encrypted type information that needs to be accessed through the HTTPS protocol.
  • the HTTPS protocol is the lower layer HTTP protocol using the SSL/TLS protocol.
  • Step 305 A TCP connection (443 port) is established between the UA and the Portal. After the TCP connection is established, the TLS handshake process between the UA and the Portal. At this point, the Portal provides the Portal's own digital certificate.
  • step 306 the UA sends an encrypted GET request to the Portal, and the GET request includes www.portal.com. Wherein, the GET request is a second access request.
  • Step 307 after the Portal decrypts the GET request, the UA returns an encrypted 200ok response and returns. Www.portal.com's website.
  • Step 309 after the Portal decrypts the GET request, parses the www.ottserver.com from the GET request.
  • a TCP connection (port 443) is established between the Portal and the OTT server.
  • Step 311 A TLS handshake process between the Portal and the OTT server.
  • step 312 the Portal sends an encrypted GET request to the OTT server, and the GET request includes www.ottserver.com.
  • step 313 the OTT server returns an encrypted 200ok response to the Portal and returns to the webpage of www.ottserver.com.
  • step 315 the Portal sends an encrypted 200ok response to the UA.
  • Step 317 after the Portal decrypts the GET request, parses the www.ottserver.com/picture1.gif from the GET request.
  • the Portal sends an encrypted GET request to the OTT server, and the GET request includes www.ottserver.com/picture1.gif.
  • step 319 the OTT server responds with a 200 ok response to the Portal encryption, and returns a picture 1.
  • step 320 after the Portal decrypts the 200ok response, the portal indication of www.portal.com is added to the 200ok response.
  • step 321 the Portal sends an encrypted 200ok response to the UA.
  • the service processing method may include:
  • Step 401 The intermediate proxy node establishes a first connection with the user agent, and the first connection is an intermediate proxy node replacing the network server and establishing an encrypted connection with the user agent.
  • the intermediate proxy node can be a Portal.
  • the intermediate proxy node may also be other sites, which is not limited in this embodiment.
  • the first connection may be a connection based on the SSL/TLS protocol, and the first connection is a connection based on a TCP connection, and is one of an SSL connection and a TLS connection. Since the establishment process of the SSL-based encrypted connection and the TLS-based encrypted connection is similar, the following describes an encrypted connection based on the TLS protocol as an example.
  • the intermediate proxy node establishes a first connection with the user agent, including:
  • the intermediate proxy node intercepts the TCP connection request sent by the user agent to the network server;
  • the intermediate proxy node reads the information in the TCP connection request, and replaces the network server with the user agent to establish a TCP connection according to the information;
  • the intermediate proxy node After the TCP connection is established, the intermediate proxy node establishes a first connection with the user agent by using the pre-stored digital certificate corresponding to the network server.
  • the user agent needs to establish a TCP connection with the web server.
  • the TCP connection port includes port 80 and port 443. If the user agent needs to access the network server based on the HTTP protocol, the port of the TCP connection is port 80; if the user agent needs to access the network server based on the lower layer using HTTP/TLS protocol HTTPS , the TCP connection port is 443 port.
  • the intermediate proxy node intercepts the TCP connection request sent by the user agent.
  • the information in the TCP connection request includes the source IP address, the source port, the destination IP address, and the destination port.
  • the source is the user agent, and the destination is the network server.
  • the intermediate proxy node uses the above information to replace the network server and the user agent to establish a TCP connection of port 443.
  • the intermediate proxy node After the TCP connection is established, the intermediate proxy node establishes a first connection with the user agent by using the pre-stored digital certificate corresponding to the network server.
  • the first connection refers to an encrypted connection established between the intermediate agent node and the user agent.
  • the process of establishing a TLS connection between the user agent and the intermediate agent node is shown in FIG. 2B, and details are not described herein.
  • the intermediate proxy node before establishing the first connection with the user agent, the intermediate proxy node also needs to obtain a digital certificate and a private key corresponding to the network server, and the digital certificate includes at least a public key, an owner name, and a digital signature of the certificate authority.
  • a digital signature is a hash value obtained by hashing information to verify whether the information has been tampered with.
  • the digital signature in this embodiment is used to verify whether the digital certificate has been tampered with.
  • the intermediate proxy node establishes the first connection with the user agent by using the pre-stored digital certificate corresponding to the network server, including:
  • the intermediate agent node sends the first digital certificate to the user agent, and the first digital certificate is a certificate.
  • the digital certificate issued by the issuing authority and corresponding to the network server, the second digital certificate of the certificate authority is pre-configured in the user agent or in the operating system of the terminal in which the user agent is installed, so that the user agent verifies according to the second digital certificate.
  • a digital certificate after the verification is passed, establishing a first connection with the intermediate proxy node; or
  • the intermediate proxy node sends a third digital certificate and a fourth digital certificate to the user agent, the third digital certificate is a digital certificate issued by an unauthorized certificate authority and corresponding to the network server, and the fourth digital certificate is a number of the non-authorized certificate authority
  • the certificate is such that the user agent verifies the third digital certificate according to the fourth digital certificate, and after the verification is passed, establishes a first connection with the intermediate proxy node.
  • step 201 the process of establishing a first connection between the intermediate proxy node and the user agent according to the digital certificate corresponding to the network server is described in the description in step 201, and details are not described herein.
  • Step 402 The intermediate proxy node triggers establishing a second connection with the user agent according to the first indication information transmitted on the first connection.
  • the intermediate proxy node triggers establishing a second connection with the user agent according to the first indication information transmitted on the first connection, including:
  • the intermediate proxy node intercepts, by using the first connection, a first access request sent by the user agent to the network server, where the first access request is used to request access to the network server;
  • the intermediate proxy node After the intermediate proxy node intercepts the first access request, the intermediate proxy node sends first indication information to the user agent on the first connection, where the first indication information is used to indicate that the user proxy sends a connection establishment request to the intermediate proxy node;
  • the intermediate proxy node establishes a second connection with the user agent according to the connection establishment request.
  • the first access request may specifically request access to an object in a web server's home page or a web server.
  • the first indication information includes a redirect response message.
  • the redirecting response message includes a web address of the intermediate proxy node, or the redirecting response message includes a proxy web address, and the proxy web address is obtained by the intermediate proxy node adding a proxy indication to the second indication information of the network server, where the second indication information includes the webpage indication information, the webpage One of the object indication information of the medium object, the information obtained by converting the webpage indication information or the object indication information.
  • the content of the redirect response message is described in the description in step 201, and details are not described herein.
  • the intermediate proxy node may agree with the user agent to encrypt the key and the decryption key in the process of establishing the first connection with the user agent.
  • the intermediate proxy node may encrypt the redirect response message by using the encryption key, and send the encrypted ciphertext to the user agent, and the user agent decrypts the ciphertext by using the decryption key to obtain a redirect response message.
  • User agent responds according to the redirect The message generates a connection establishment request, sends a connection establishment request to the intermediate proxy node, and the intermediate proxy node obtains a connection establishment request.
  • the second connection is a TCP connection established by the intermediate proxy node and the user agent is a port of 80 ports.
  • Step 403 The intermediate proxy node receives the service information sent by the user agent by using the second connection.
  • the service information is used for performing service interaction with the network server, and may be specifically used for requesting service from the network server, or may be specifically used for sending service data to the network server.
  • the service information may be used to request a homepage of the network server, or may be used to request an object in the network server, where the object may be an object stored in the network server. It may also be an object stored in another server and the uniform resource identifier (English: uniform resource identifier; URI) of the object is included in the webpage of the web server.
  • URI uniform resource identifier
  • the service information at this time includes www.ottserver.com; when the web page of the OTT server includes the URI and the service information is used to request the OTT server.
  • the URI of the webpage is www.ottserver.com/picture1.gif and the user needs to obtain the picture 1 indicated by the URI, and the service information includes www.ottserver.com/picture1.gif. .
  • the service information may be obtained by the intermediate proxy node adding an agent indication to the foregoing website address.
  • the proxy indicates an intermediate proxy node used to indicate the transit service, and may be a web address of the intermediate proxy node.
  • the proxy indication may be the URL of the intermediate proxy node www.portal.com.
  • the intermediate proxy node may further convert the webpage indication information or the object indication information, and add a proxy indication to the information obtained after the conversion to obtain the service information.
  • the conversion can convert the plaintext into ciphertext for transmission, which can improve the security of data transmission.
  • the method further includes:
  • the intermediate proxy node receives the second access request sent by the user agent, and the second access request is used to request access to the intermediate proxy node;
  • the intermediate proxy node sends the webpage to the user agent, and the webpage is used to trigger the user agent to send the service information.
  • the second access request may specifically request access to an object in the home page of the intermediate agent node or the intermediate agent node.
  • the user proxy further needs to obtain the webpage of the intermediate proxy node according to the URL of the intermediate proxy node, so that the user triggers the webpage after receiving the webpage, and the user proxy sends the connection according to the trigger.
  • a request is established and the service information is sent after establishing a second connection with the intermediate proxy node.
  • the intermediate proxy node when the intermediate proxy node has the function of buffering the service data of the network server, the intermediate proxy node can search for the service data requested by the service information in the cache. If the service data exists, step 409 is performed. The response speed of the service information is increased; if the service data does not exist, step 404 is performed. When the intermediate proxy node does not have the function of caching the business data of the web server, step 404 is performed.
  • Step 404 The intermediate proxy node establishes a third connection with the network server, and stipulates the third key and the fourth key.
  • the intermediate proxy node parses the web address of the web server from the processed service information, and establishes an encrypted connection with the web server indicated by the webpage, and The third key and the fourth key are agreed upon.
  • the process of establishing an encrypted connection between the intermediate proxy node and the network server is similar to the process of establishing an encrypted connection between the intermediate proxy node and the user agent, and is not described here.
  • the service information includes the object indication information or the information obtained by converting the object indication information
  • the intermediate proxy node when the intermediate proxy node has acquired the webpage of the network server, that is, the intermediate proxy node has established with the network server.
  • the intermediate proxy node parses out the processed service information.
  • the web server's web address establishes an encrypted connection with the web server indicated by the web address, and stipulates a third key and a fourth key. I will not go into details.
  • Step 405 The intermediate proxy node encrypts the service information by using the third key to obtain a fourth ciphertext.
  • the service information in this step may be service information in which the URL of the intermediate proxy node is removed. That is, the service information at this time includes only the network server indication information, or the service information includes only the object indication information.
  • Step 406 The intermediate proxy node sends the fourth ciphertext to the network server, so that the network server decrypts the fourth ciphertext by using the fourth key to obtain service information.
  • Step 407 The intermediate proxy node receives the fifth ciphertext sent by the network server, and the fifth ciphertext is obtained by the network server encrypting the service data by using the fourth key.
  • the network server obtains the corresponding service data according to the service information, and encrypts the service data by using the fourth key to obtain the fifth ciphertext, and sends the fifth ciphertext to the intermediate proxy node.
  • the service data may be the home page of the web server; when the service information includes www.ottserver.com/picture1.gif, the service data may be picture 1.
  • Step 408 The intermediate proxy node decrypts the fifth ciphertext by using the third key to obtain service data.
  • Step 409 The intermediate proxy node encrypts the service data by using the second key to obtain a sixth ciphertext.
  • the webpage may further include object indication information
  • the intermediate proxy node further needs to add an agent indication to the object indication information.
  • the web page includes the URI of picture 1
  • Step 410 The intermediate proxy node sends the sixth ciphertext to the user agent, so that the user agent decrypts the sixth ciphertext using the first key to obtain service data.
  • the service processing method establishes a first connection with a user agent, where the first connection is an intermediate proxy node replacing the network server, and an encrypted connection established with the user agent; and transmitting according to the first connection
  • the first indication information triggers establishing a second connection with the user agent; receiving the service information sent by the user agent through the second connection; processing the service information, and replacing the network server and the user when the user agent requests to establish an encrypted connection with the network server
  • the proxy establishes the encrypted first connection, and then uses the first indication information transmitted on the first connection to trigger a second connection with the user agent, and provides service optimization to the user agent through the second connection, thereby solving the problem that the intermediate proxy node cannot decrypt the ciphertext.
  • the intermediate agent node cannot provide service optimization for the user agent, and the effect of optimizing the business is achieved.
  • the proxy digital certificate corresponding to the network server or the fake digital certificate can be used to replace the network server, thereby establishing a first connection with the user agent, enriching the user.
  • the proxy establishes the implementation of the first connection.
  • the redirect response message includes a proxy web address
  • the proxy web address is obtained by the intermediate proxy node adding a proxy indication to the second indication information of the web server, where the second indication information includes the webpage indication information, the object indication information of the object in the webpage, and the webpage indication information.
  • one of the information obtained after the object indication information is converted may directly send the webpage indication information or the object indication information or the information obtained by converting one of the two kinds of information to the user agent, without first acquiring
  • the webpage of the intermediate proxy node which triggers the webpage of the intermediate proxy node to obtain the webpage indication information or the object indication information or the information obtained by converting one of the two kinds of information, can simplify the operation flow and improve the efficiency of the business processing. .
  • the process of the service processing method is described below by taking the user agent and the intermediate proxy node to establish an encrypted second connection, the intermediate proxy node, and the network server to establish an encrypted third connection as an example.
  • the intermediate proxy node is a portal
  • the user proxy is a UA
  • the network server is an OTT server.
  • the portal intercepts the TCP connection request sent by the UA to the OTT server, and replaces the OTT server with the UA to establish a TCP connection (port 443) according to the information in the TCP connection request.
  • Step 502 The Portal uses a TLS handshake process between the digital certificate corresponding to the OTT server and the UA.
  • the Portal intercepts the encrypted GET request sent by the UA to the OTT server.
  • the GET request is the first access request.
  • Step 504 The Portal sends the encrypted redirect response message to the UA and/or the encrypted type information that needs to be accessed through the HTTPS protocol.
  • the HTTPS protocol is the lower layer HTTP protocol using the SSL/TLS protocol.
  • step 505 a TCP connection (port 80) is established between the UA and the Portal.
  • step 506 the UA sends a GET request to the Portal, and the GET request includes www.portal.com. Wherein, the GET request is a second access request.
  • step 507 the Portal replies with a 200ok response to the UA and returns to the webpage of www.portal.com.
  • step 509 the Portal parses the www.ottserver.com from the GET request.
  • a TCP connection (port 443) is established between the Portal and the OTT server.
  • Step 511 a TLS handshake process between the Portal and the OTT server.
  • step 512 the Portal sends an encrypted GET request to the OTT Server, and the GET request includes www.ottserver.com.
  • step 513 the OTT Server returns an encrypted 200ok response to the Portal and returns to the webpage of www.ottserver.com.
  • step 515 the Portal sends a 200ok response to the UA.
  • step 517 the Portal parses the www.ottserver.com/picture1.gif from the GET request.
  • the Portal sends an encrypted GET request to the OTT server, and the GET request includes www.ottserver.com/picture1.gif.
  • step 519 the OTT server responds with a 200 ok response to the Portal encryption, and returns a picture 1.
  • step 520 after the Portal decrypts the 200ok response, the portal indication of www.portal.com is added to the 200ok response.
  • step 521 the Portal sends a 200ok response to the UA.
  • FIG. 6 is a schematic structural diagram of a service processing apparatus according to an embodiment of the present invention.
  • the service processing device is used in an intermediate proxy node, and may include:
  • a first establishing module 601 configured to establish a first connection with the user agent, where the first connection is an intermediate proxy node replacing the network server, and an encrypted connection established with the user agent;
  • the second establishing module 602 is configured to trigger a second connection with the user agent according to the first indication information transmitted on the first connection established by the first establishing module 601.
  • the first receiving module 603 is configured to receive, by using the second connection established by the second establishing module 602, the service information sent by the user agent.
  • the information processing module 604 is configured to process the service information received by the first receiving module 603.
  • the service processing apparatus establishes a first connection with a user agent, where the first connection is an intermediate proxy node replacing the network server, and an encrypted connection established with the user agent; and transmitting according to the first connection.
  • the first indication information triggers establishing a second connection with the user agent; receiving the service information sent by the user agent through the second connection; processing the service information, and replacing the network server and the user when the user agent requests to establish an encrypted connection with the network server
  • the proxy establishes the encrypted first connection, and then uses the first indication information transmitted on the first connection to trigger a second connection with the user agent, and provides service optimization to the user agent through the second connection, thereby solving the problem that the intermediate proxy node cannot decrypt the ciphertext.
  • the intermediate agent node cannot provide service optimization for the user agent, and the effect of optimizing the business is achieved.
  • FIG. 7 is a schematic structural diagram of still another service processing apparatus according to an embodiment of the present invention.
  • the service processing device is used in an intermediate proxy node, and may include:
  • a first establishing module 701 configured to establish a first connection with the user agent, where the first connection is an intermediate proxy node replacing the network server, and an encrypted connection established with the user agent;
  • the second establishing module 702 is configured to trigger a second connection with the user agent according to the first indication information transmitted on the first connection established by the first establishing module 701;
  • the first receiving module 703 is configured to receive, by using the second connection established by the second establishing module 702, the service information sent by the user agent.
  • the information processing module 704 is configured to process the service information received by the first receiving module 703.
  • the first establishing module 701 is specifically configured to:
  • the first connection is established with the user agent by using the pre-stored digital certificate corresponding to the network server.
  • the first establishing module 701 is specifically configured to:
  • the first digital certificate is a digital certificate issued by the certificate authority and corresponding to the network server
  • the second digital certificate of the certificate authority is pre-configured in the user agent or the terminal with the user agent installed
  • the user agent is configured to verify the first digital certificate according to the second digital certificate, and after the verification is passed, establish a first connection with the intermediate proxy node;
  • the third digital certificate is a non-authorization certificate
  • the fourth digital certificate is a digital certificate of the non-authorized certificate authority, so that the user agent verifies the third digital certificate according to the fourth digital certificate, and after the verification is passed, the intermediate agent The node establishes the first connection.
  • the second establishing module 702 is specifically configured to:
  • the first indication information is sent to the user agent on the first connection, where the first indication information is used to indicate that the user agent sends a connection establishment request to the intermediate proxy node;
  • a second connection is established with the user agent based on the connection establishment request.
  • the first indication information includes a redirect response message.
  • the redirect response message includes a web address of the intermediate proxy node, or the redirect response message includes a proxy web address, and the proxy web address is obtained by the intermediate proxy node adding a proxy indication to the second indication information of the network server, where the second indication information includes the webpage.
  • the second indication information includes the webpage.
  • the second establishing module 702 is further configured to: establish a TCP connection with the user agent according to the connection establishment request; after the TCP connection is established, establish a second connection with the user agent by using the digital certificate of the intermediate proxy node.
  • the first receiving module 703 is specifically configured to:
  • the first key and the second key are keys agreed by the intermediate agent node and the user agent when establishing the second connection.
  • the device when the redirect response message includes the URL of the intermediate proxy node, the device further includes:
  • the second receiving module 705 is configured to receive, by the first receiving module 703, the second ciphertext sent by the user agent before receiving the first ciphertext sent by the user agent by using the second connection, where the second ciphertext is used by the user agent to use the first key Encrypting the second access request, and the second access request is used to request access to the intermediate proxy node;
  • the first decryption module 706 is configured to decrypt the second ciphertext received by the second receiving module 705 by using the second key to obtain a second access request.
  • a first obtaining module 707 configured to acquire a webpage of the intermediate proxy node
  • the first encryption module 708 is configured to encrypt the webpage acquired by the first obtaining module 707 by using the second key to obtain a third ciphertext;
  • the first sending module 709 is configured to send the third ciphertext encrypted by the first encryption module 708 to the user agent, so that the user agent decrypts the third ciphertext by using the first key, and obtains a webpage, where the webpage is used to trigger the user agent. Send the first ciphertext.
  • the device when the redirect response message includes the URL of the intermediate proxy node, the device further includes:
  • the third receiving module 710 is configured to receive, by the second establishing module 702, a second access request sent by the user agent after triggering the second connection with the user agent according to the first indication information transmitted on the first connection, where the second access request is used. Requesting access to an intermediate proxy node;
  • a second obtaining module 711 configured to acquire a webpage of the intermediate proxy node
  • the second sending module 712 is configured to send the webpage acquired by the second obtaining module 711 to the user agent, where the webpage is used to trigger the user agent to send the service information.
  • the information processing module 704 is specifically configured to:
  • the device further includes:
  • the fourth receiving module 713 is configured to: after the information processing module 704 sends the fourth ciphertext to the network server, receive the fifth ciphertext sent by the network server, where the fifth ciphertext encrypts the service data by using the fourth key by the network server. get;
  • the second decryption module 714 is configured to decrypt the fifth ciphertext received by the fourth receiving module 713 by using the third key to obtain service data.
  • a second encryption module 715 configured to use the second key to encrypt the second decryption module 714 to decrypt the obtained service data, to obtain a sixth ciphertext
  • the third sending module 716 is configured to send the sixth ciphertext encrypted by the second encryption module 715 to the user agent, so that the user agent decrypts the sixth ciphertext by using the first key to obtain service data.
  • the service processing apparatus establishes a first connection with a user agent, where the first connection is an intermediate proxy node replacing the network server, and an encrypted connection established with the user agent; and transmitting according to the first connection.
  • the first indication information triggers establishing a second connection with the user agent; receiving the service information sent by the user agent through the second connection; processing the service information, and the user agent
  • the replacement network server establishes an encrypted first connection with the user agent, and then uses the first indication information transmitted on the first connection to trigger a second connection with the user agent, and the second connection to the user
  • the agent provides service optimization, which solves the problem that the intermediate agent node cannot decrypt the ciphertext, which causes the intermediate agent node to fail to provide service optimization for the user agent, and achieves the effect of optimizing the service.
  • the proxy digital certificate corresponding to the network server or the fake digital certificate can be used to replace the network server, thereby establishing a first connection with the user agent, enriching the user.
  • the proxy establishes the implementation of the first connection.
  • the redirect response message includes a proxy web address
  • the proxy web address is obtained by the intermediate proxy node adding a proxy indication to the second indication information of the web server, where the second indication information includes the webpage indication information, the object indication information of the object in the webpage, and the webpage indication information.
  • one of the information obtained after the object indication information is converted may directly send the webpage indication information or the object indication information or the information obtained by converting one of the two kinds of information to the user agent, without first acquiring
  • the webpage of the intermediate proxy node which triggers the webpage of the intermediate proxy node to obtain the webpage indication information or the object indication information or the information obtained by converting one of the two kinds of information, can simplify the operation flow and improve the efficiency of the business processing. .
  • FIG. 8 is a schematic structural diagram of a service processing apparatus according to an embodiment of the present invention.
  • the service processing device is used in an intermediate proxy node and may include a bus 801, and a processor 802, a memory 803, a transmitter 804, and a receiver 805 connected to the bus.
  • the memory 803 is configured to store a number of instructions that are configured to be executed by the processor 802:
  • the processor 802 is configured to establish a first connection with the user agent, where the first connection is an intermediate proxy node replacing the network server, and an encrypted connection established with the user agent; triggering establishment with the user agent according to the first indication information transmitted on the first connection Second connection
  • the receiver 805 is configured to receive, by using the second connection established by the processor 802, service information sent by the user agent.
  • the processor 802 is further configured to process the service information received by the receiver 805.
  • the service processing apparatus establishes a first connection with a user agent, where the first connection is an intermediate proxy node replacing the network server, and an encrypted connection established with the user agent; and transmitting according to the first connection.
  • the first indication information triggers establishing a second connection with the user agent; receiving the service information sent by the user agent through the second connection; processing the service information, and the user agent
  • the replacement network server establishes an encrypted first connection with the user agent, and then uses the first indication information transmitted on the first connection to trigger a second connection with the user agent, and the second connection to the user
  • the agent provides service optimization, which solves the problem that the intermediate agent node cannot decrypt the ciphertext, which causes the intermediate agent node to fail to provide service optimization for the user agent, and achieves the effect of optimizing the service.
  • the embodiment of the present invention further provides a service processing apparatus, where the service processing apparatus is used in an intermediate proxy node, and may include: a bus 801, and a processor 802, a memory 803, a transmitter 804, and a receiver 805 connected to the bus.
  • the memory 803 is configured to store a number of instructions that are configured to be executed by the processor 802:
  • the processor 802 is configured to establish a first connection with the user agent, where the first connection is an intermediate proxy node replacing the network server, and an encrypted connection established with the user agent; triggering establishment with the user agent according to the first indication information transmitted on the first connection Second connection
  • the receiver 805 is configured to receive, by using the second connection established by the processor 802, service information sent by the user agent.
  • the processor 802 is further configured to process the service information received by the receiver 805.
  • the receiver 805 is further configured to intercept a TCP connection request sent by the user agent to the network server.
  • the processor 802 is further configured to read information in the TCP connection request intercepted by the receiver 805, and replace the network server to establish a TCP connection with the user agent according to the information; after the TCP connection is established, use the pre-stored number corresponding to the network server.
  • the certificate establishes a first connection with the user agent.
  • the transmitter 804 is further configured to send the first digital certificate to the user agent, where the first digital certificate is a digital certificate issued by the certificate authority and corresponding to the network server, and the second digital certificate of the certificate authority is pre-configured in the In the operating system of the user agent or the terminal in which the user agent is installed, so that the user agent verifies the first digital certificate according to the second digital certificate, and establishes a first connection with the intermediate agent node after the verification is passed; or
  • the transmitter 804 is further configured to send a third digital certificate and a fourth digital certificate to the user agent, where the third digital certificate is a digital certificate issued by an unauthorized certificate authority and corresponding to the network server, and the fourth digital certificate is an unauthorized certificate authority
  • the digital certificate is such that the user agent verifies the third digital certificate according to the fourth digital certificate, and after the verification is passed, establishes a first connection with the intermediate proxy node.
  • the receiver 805 is further configured to intercept the user agent by using the first connection to send to the network server.
  • the first access request sent, the first access request is used to request access to the network server;
  • the transmitter 804 is further configured to: after the receiver 805 intercepts the first access request, send first indication information to the user agent on the first connection, where the first indication information is used to indicate that the user agent sends a connection establishment request to the intermediate proxy node. ;
  • the processor 802 is specifically configured to establish a second connection with the user agent according to the connection establishment request.
  • the first indication information includes a redirect response message.
  • the redirect response message includes a web address of the intermediate proxy node, or the redirect response message includes a proxy web address, and the proxy web address is obtained by the intermediate proxy node adding a proxy indication to the second indication information of the network server, where the second indication information includes the webpage.
  • the second indication information includes the webpage.
  • the processor 802 is further configured to establish a TCP connection with the user agent according to the connection establishment request; after the TCP connection is established, establish a second connection with the user agent by using the digital certificate of the intermediate proxy node.
  • the receiver 805 is configured to receive the first ciphertext sent by the user agent by using the second connection, where the first ciphertext is encrypted by the user agent by using the first key to encrypt the service information.
  • the processor 802 is specifically configured to decrypt the first ciphertext received by the receiver 805 according to the second key to obtain service information.
  • the first key and the second key are keys agreed by the intermediate agent node and the user agent when establishing the second connection.
  • the redirect response message includes the URL of the intermediate proxy node
  • the receiver 805 is further configured to: before receiving the first ciphertext sent by the user agent by using the second connection, receive the second ciphertext sent by the user agent, where the second ciphertext is used by the user agent to perform the second access request by using the first key. Encrypted, the second access request is used to request access to the intermediate proxy node;
  • the processor 802 is further configured to use the second key to decrypt the second ciphertext received by the receiver 805, obtain a second access request, obtain a webpage of the intermediate proxy node, and encrypt the webpage by using the second key to obtain a third ciphertext. ;
  • the transmitter 804 is further configured to send the third ciphertext encrypted by the processor 802 to the user agent, so that the user agent decrypts the third ciphertext by using the first key, and obtains a webpage, where the webpage is used to trigger the user agent to send the first Cipher text.
  • the redirect response message includes the URL of the intermediate proxy node
  • the receiver 805 is further configured to be used by the processor 802 according to the first indication information transmitted on the first connection. After establishing a second connection with the user agent, receiving a second access request sent by the user agent, where the second access request is used to request access to the intermediate proxy node;
  • the processor 802 is further configured to acquire a webpage of the intermediate proxy node
  • the transmitter 804 is further configured to send the webpage acquired by the processor 802 to the user agent, where the webpage is used to trigger the user agent to send the service information.
  • the processor 802 is specifically configured to establish a third connection with the network server, and stipulate a third key and a fourth key; and encrypt the service information by using the third key to obtain a fourth ciphertext;
  • the transmitter 804 is specifically configured to send the fourth ciphertext encrypted by the processor 802 to the network server, so that the network server decrypts the fourth ciphertext by using the fourth key to obtain service information.
  • the receiver 805 is further configured to: after the transmitter 804 sends the fourth ciphertext to the network server, receive the fifth ciphertext sent by the network server, where the fifth ciphertext is used by the network server to use the fourth key pair to the service data. Encrypted to get;
  • the processor 802 is further configured to: use the third key to decrypt the fifth ciphertext received by the receiver 805 to obtain service data; and encrypt the service data by using the second key to obtain a sixth ciphertext;
  • the transmitter 804 is further configured to send the sixth ciphertext encrypted by the processor 802 to the user agent, so that the user agent decrypts the sixth ciphertext by using the first key to obtain service data.
  • the service processing apparatus establishes a first connection with a user agent, where the first connection is an intermediate proxy node replacing the network server, and an encrypted connection established with the user agent; and transmitting according to the first connection.
  • the first indication information triggers establishing a second connection with the user agent; receiving the service information sent by the user agent through the second connection; processing the service information, and replacing the network server and the user when the user agent requests to establish an encrypted connection with the network server
  • the proxy establishes the encrypted first connection, and then uses the first indication information transmitted on the first connection to trigger a second connection with the user agent, and provides service optimization to the user agent through the second connection, thereby solving the problem that the intermediate proxy node cannot decrypt the ciphertext.
  • the intermediate agent node cannot provide service optimization for the user agent, and the effect of optimizing the business is achieved.
  • the proxy digital certificate corresponding to the network server or the fake digital certificate can be used to replace the network server, thereby establishing a first connection with the user agent, enriching the user.
  • the proxy establishes the implementation of the first connection.
  • the redirect response message includes a proxy web address
  • the proxy web address is obtained by the intermediate proxy node adding a proxy indication to the second indication information of the web server, where the second indication information includes the webpage indication information, the object indication information of the object in the webpage, and the webpage indication information.
  • the object indication information includes the webpage indication information, the object indication information of the object in the webpage, and the webpage indication information.
  • One of the information may directly send the webpage indication information or the object indication information or the information obtained by converting one of the two kinds of information to the user agent, without first obtaining the webpage of the intermediate proxy node, and then triggering the middle
  • the webpage of the proxy node obtains the webpage indication information or the object indication information or the information obtained by converting one of the two kinds of information, which can simplify the operation flow and improve the efficiency of the business processing.
  • the disclosed systems, devices, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit may be only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined. Or it can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. You can choose some or all of them according to actual needs.
  • the unit is to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product.
  • the technical solution of the present invention which is essential or contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product, which is stored in a storage medium, including
  • the instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

本发明公开了一种业务处理方法及装置，涉及通信领域，所述方法包括：中间代理节点与用户代理建立第一连接，所述第一连接是所述中间代理节点顶替网络服务器，与所述用户代理建立的加密连接；所述中间代理节点根据在所述第一连接上传输的第一指示信息触发与所述用户代理建立第二连接；所述中间代理节点通过所述第二连接接收所述用户代理发送的业务信息；所述中间代理节点对所述业务信息进行处理。本发明解决了中间代理节点无法解密密文，导致中间代理节点无法为用户代理提供业务优化的问题，达到了优化业务的效果。

Description

业务处理方法及装置 技术领域
本发明涉及通信领域，特别涉及一种业务处理方法及装置。
背景技术
安全套接层(英文：security socket layer；简称：SSL)协议及其继任者传输层安全(英文：transport layer security；简称，TLS)协议用于为网络通信提供加密、身份认证及数据完整性等服务，已被广泛地应用于浏览器与网络服务器之间的安全通信。其中，SSL/TLS协议位于传输层的传输控制协议(英文：transmission control protocol；简称：TCP)协议和应用层的超文本传送协议(英文：hypertext transfer protocol；简称：HTTP)之间。
相关技术提供的一种业务处理方法包括：用户代理(英文：user agent；简称：UA)基于下层使用了SSL/TLS协议的超文本传输安全协议(英文：hyper text transfer protocol over secure socket layer；简称：HTTPS)与网络服务器建立加密连接，并约定第一密钥和第二密钥，用户代理使用第一密钥加密业务信息后发送给网络服务器，网络服务器使用第二密钥解密得到业务信息，根据该业务信息生成业务数据，加密业务数据后发送给用户代理，用户代理使用第一密钥解密得到业务数据。其中，业务信息可以用于请求网络服务器的网页，也可以用于请求网络服务器中的对象。
通常，还可以在用户代理和网络服务器之间设置中间代理节点，中间代理节点是一种门户网站站点，相当于因特网入网的网关。门户网站一般都有搜索引擎，供用户查找自己所要访问的其它网站。具体地，中间代理节点提供一个包含输入框的网页，用户在输入框中输入所要访问的网站的网址，由中间代理节点转发用户触发的业务信息，并将网站返回的业务数据转发给用户。其中，中间代理节点可以是Portal。
在中间代理节点存在的场景下，当在用户代理和网络服务器之间建立加密连接时，用户代理和网络服务器之间传输的加密后得到的密文，由于中间代理节点不能获取到第一密钥和第二密钥，因此，中间代理节点无法解密密文，导 致中间代理节点无法为用户代理提供业务优化。
发明内容
为了解决中间代理节点无法解密密文，导致中间代理节点无法为用户代理提供业务优化的问题，本发明实施例提供了一种业务处理方法及装置。所述技术方案如下：
第一方面，提供了一种业务处理方法，所述方法包括：
中间代理节点与用户代理建立第一连接，所述第一连接是所述中间代理节点顶替网络服务器，与所述用户代理建立的加密连接；
所述中间代理节点根据在所述第一连接上传输的第一指示信息触发与所述用户代理建立第二连接；
所述中间代理节点通过所述第二连接接收所述用户代理发送的业务信息；
所述中间代理节点对所述业务信息进行处理。
在第一方面的第一种可能的实现方式中，所述中间代理节点与用户代理建立第一连接，包括：
所述中间代理节点截获所述用户代理向所述网络服务器发送的传输控制协议TCP连接请求；
所述中间代理节点读取所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接；
在所述TCP连接建立完成后，所述中间代理节点利用预存的与所述网络服务器对应的数字证书与所述用户代理建立所述第一连接。
根据第一方面的第一种可能的实现方式，在第一方面的第二种可能的实现方式中，所述中间代理节点利用预存的与所述网络服务器对应的数字证书与所述用户代理建立所述第一连接，包括：
所述中间代理节点向所述用户代理发送第一数字证书，所述第一数字证书是证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述证书颁发机构的第二数字证书预先配置在所述用户代理中或安装有所述用户代理的终端的操作系统中，以使所述用户代理根据所述第二数字证书验证所述第一数字证书，在验证通过后，与所述中间代理节点建立所述第一连接；或，
所述中间代理节点向所述用户代理发送第三数字证书和第四数字证书，所述第三数字证书是非授权证书颁发机构颁发的且与所述网络服务器对应的数 字证书，所述第四数字证书是所述非授权证书颁发机构的数字证书，以使所述用户代理根据所述第四数字证书验证所述第三数字证书，在验证通过后，与所述中间代理节点建立所述第一连接。
根据第一方面的第一种可能的实现方式或第一方面的第二种可能的实现方式，在第一方面的第三种可能的实现方式中，所述中间代理节点根据在所述第一连接上传输的第一指示信息触发与所述用户代理建立第二连接，包括：
所述中间代理节点通过所述第一连接截获所述用户代理向所述网络服务器发送的第一访问请求，所述第一访问请求用于请求访问所述网络服务器；
在所述中间代理节点截获到所述第一访问请求后，所述中间代理节点在所述第一连接上向所述用户代理发送所述第一指示信息，所述第一指示信息用于指示所述用户代理向所述中间代理节点发送连接建立请求；
所述中间代理节点根据所述连接建立请求与所述用户代理建立所述第二连接。
根据第一方面或第一方面的第一种可能的实现方式或第一方面的第二种可能的实现方式或第一方面的第三种可能的实现方式，在第一方面的第四种可能的实现方式中，所述第一指示信息包括重定向响应消息。
根据第一方面的第四种可能的实现方式，在第一方面的第五种可能的实现方式中，所述重定向响应消息包括所述中间代理节点的网址，或，所述重定向响应消息包括代理网址，所述代理网址由所述中间代理节点对所述网络服务器的第二指示信息添加代理指示得到，所述第二指示信息包括网页指示信息、网页中对象的对象指示信息、对所述网页指示信息或所述对象指示信息进行转换后得到的信息中的一种。
根据第一方面的第五种可能的实现方式，在第一方面的第六种可能的实现方式中，所述中间代理节点根据所述连接建立请求与所述用户代理建立所述第二连接，包括：
所述中间代理节点根据所述连接建立请求与所述用户代理建立TCP连接；
在所述TCP连接建立完成后，所述中间代理节点利用所述中间代理节点的数字证书与所述用户代理建立所述第二连接。
根据第一方面的第六种可能的实现方式，在第一方面的第七种可能的实现方式中，所述中间代理节点通过所述第二连接接收所述用户代理发送的业务信息，包括：
所述中间代理节点接收所述用户代理通过所述第二连接发送的第一密文，所述第一密文由所述用户代理使用第一密钥对所述业务信息进行加密得到；
所述中间代理节点根据第二密钥解密所述第一密文，得到所述业务信息；
其中，所述第一密钥和所述第二密钥是所述中间代理节点和所述用户代理在建立所述第二连接时约定的密钥。
根据第一方面的第七种可能的实现方式，在第一方面的第八种可能的实现方式中，当所述重定向响应消息包括所述中间代理节点的网址时，所述中间代理节点接收所述用户代理通过所述第二连接发送的第一密文之前，还包括：
所述中间代理节点接收所述用户代理发送的第二密文，所述第二密文由所述用户代理使用所述第一密钥对第二访问请求进行加密得到，所述第二访问请求用于请求访问所述中间代理节点；
所述中间代理节点使用所述第二密钥解密所述第二密文，得到所述第二访问请求；
所述中间代理节点获取所述中间代理节点的网页；
所述中间代理节点使用所述第二密钥加密所述网页，得到第三密文；
所述中间代理节点将所述第三密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第三密文，得到所述网页，所述网页用于触发所述用户代理发送所述第一密文。
根据第一方面的第五种可能的实现方式，在第一方面的第九种可能的实现方式中，当所述重定向响应消息包括所述中间代理节点的网址时，所述中间代理节点根据在所述第一连接上传输的第一指示信息触发与所述用户代理建立第二连接之后，还包括：
所述中间代理节点接收所述用户代理发送的第二访问请求，所述第二访问请求用于请求访问所述中间代理节点；
所述中间代理节点获取所述中间代理节点的网页；
所述中间代理节点将所述网页发送给所述用户代理，所述网页用于触发所述用户代理发送所述业务信息。
根据第一方面或第一方面的第一种可能的实现方式或第一方面的第二种可能的实现方式或第一方面的第三种可能的实现方式或第一方面的第四种可能的实现方式或第一方面的第五种可能的实现方式或第一方面的第六种可能的实现方式或第一方面的第七种可能的实现方式或第一方面的第八种可能的 实现方式或第一方面的第九种可能的实现方式，在第一方面的第十种可能的实现方式中，所述中间代理节点对所述业务信息进行处理，包括：
所述中间代理节点与所述网络服务器建立第三连接，并约定第三密钥和第四密钥；
所述中间代理节点使用所述第三密钥加密所述业务信息，得到第四密文；
所述中间代理节点将所述第四密文发送给所述网络服务器，以使所述网络服务器使用所述第四密钥解密所述第四密文，得到所述业务信息。
根据第一方面的第十种可能的实现方式，在第一方面的第十一种可能的实现方式中，所述中间代理节点将所述第四密文发送给所述网络服务器之后，还包括：
所述中间代理节点接收所述网络服务器发送的第五密文，所述第五密文由所述网络服务器使用所述第四密钥对业务数据进行加密得到；
所述中间代理节点使用所述第三密钥解密所述第五密文，得到所述业务数据；
所述中间代理节点使用所述第二密钥加密所述业务数据，得到第六密文；
所述中间代理节点将所述第六密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第六密文，得到所述业务数据。
第二方面，提供了一种业务处理装置，用于中间代理节点中，所述装置包括：
第一建立模块，用于与用户代理建立第一连接，所述第一连接是所述中间代理节点顶替网络服务器，与所述用户代理建立的加密连接；
第二建立模块，用于根据在所述第一建立模块建立的所述第一连接上传输的第一指示信息触发与所述用户代理建立第二连接；
第一接收模块，用于通过所述第二建立模块建立的所述第二连接接收所述用户代理发送的业务信息；
信息处理模块，用于对所述第一接收模块接收到的所述业务信息进行处理。
在第二方面的第一种可能的实现方式中，所述第一建立模块，具体用于：
截获所述用户代理向所述网络服务器发送的传输控制协议TCP连接请求；
读取所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接；
在所述TCP连接建立完成后，利用预存的与所述网络服务器对应的数字证书与所述用户代理建立所述第一连接。
根据第二方面的第一种可能的实现方式，在第二方面的第二种可能的实现方式中，所述第一建立模块，具体用于：
向所述用户代理发送第一数字证书，所述第一数字证书是证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述证书颁发机构的第二数字证书预先配置在所述用户代理中或安装有所述用户代理的终端的操作系统中，以使所述用户代理根据所述第二数字证书验证所述第一数字证书，在验证通过后，与所述中间代理节点建立所述第一连接；或，
向所述用户代理发送第三数字证书和第四数字证书，所述第三数字证书是非授权证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述第四数字证书是所述非授权证书颁发机构的数字证书，以使所述用户代理根据所述第四数字证书验证所述第三数字证书，在验证通过后，与所述中间代理节点建立所述第一连接。
根据第二方面的第一种可能的实现方式或第二方面的第二种可能的实现方式，在第二方面的第三种可能的实现方式中，所述第二建立模块，具体用于：
通过所述第一连接截获所述用户代理向所述网络服务器发送的第一访问请求，所述第一访问请求用于请求访问所述网络服务器；
在截获到所述第一访问请求后，在所述第一连接上向所述用户代理发送所述第一指示信息，所述第一指示信息用于指示所述用户代理向所述中间代理节点发送连接建立请求；
根据所述连接建立请求与所述用户代理建立所述第二连接。
根据第二方面或第二方面的第一种可能的实现方式或第二方面的第二种可能的实现方式或第二方面的第三种可能的实现方式，在第二方面的第四种可能的实现方式中，所述第一指示信息包括重定向响应消息。
根据第二方面的第四种可能的实现方式，在第二方面的第五种可能的实现方式中，所述重定向响应消息包括所述中间代理节点的网址，或，所述重定向响应消息包括代理网址，所述代理网址由所述中间代理节点对所述网络服务器的第二指示信息添加代理指示得到，所述第二指示信息包括网页指示信息、网页中对象的对象指示信息、对所述网页指示信息或所述对象指示信息进行转换后得到的信息中的一种。
根据第二方面的第五种可能的实现方式，在第二方面的第六种可能的实现方式中，所述第二建立模块，还用于：
根据所述连接建立请求与所述用户代理建立TCP连接；
在所述TCP连接建立完成后，利用所述中间代理节点的数字证书与所述用户代理建立所述第二连接。
根据第二方面的第六种可能的实现方式，在第二方面的第七种可能的实现方式中，第一接收模块，具体用于：
接收所述用户代理通过所述第二连接发送的第一密文，所述第一密文由所述用户代理使用第一密钥对所述业务信息进行加密得到；
根据第二密钥解密所述第一密文，得到所述业务信息；
其中，所述第一密钥和所述第二密钥是所述中间代理节点和所述用户代理在建立所述第二连接时约定的密钥。
根据第二方面的第七种可能的实现方式，在第二方面的第八种可能的实现方式中，当所述重定向响应消息包括所述中间代理节点的网址时，所述装置，还包括：
第二接收模块，用于所述第一接收模块接收所述用户代理通过所述第二连接发送的第一密文之前，接收所述用户代理发送的第二密文，所述第二密文由所述用户代理使用所述第一密钥对第二访问请求进行加密得到，所述第二访问请求用于请求访问所述中间代理节点；
第一解密模块，用于使用所述第二密钥解密所述第二接收模块接收到的所述第二密文，得到所述第二访问请求；
第三获取模块，用于获取所述中间代理节点的网页；
第一加密模块，用于使用所述第二密钥加密所述第三获取模块获取到的所述网页，得到第三密文；
第一发送模块，用于将所述第一加密模块加密得到的所述第三密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第三密文，得到所述网页，所述网页用于触发所述用户代理发送所述第一密文。
根据第二方面的第五种可能的实现方式，在第二方面的第九种可能的实现方式中，当所述重定向响应消息包括所述中间代理节点的网址时，所述装置，还包括：
第三接收模块，用于所述第二建立模块根据在所述第一连接上传输的第一 指示信息触发与所述用户代理建立第二连接之后，接收所述用户代理发送的第二访问请求，所述第二访问请求用于请求访问所述中间代理节点；
第四获取模块，用于获取所述中间代理节点的网页；
第二发送模块，用于将所述第四获取模块获取到的所述网页发送给所述用户代理，所述网页用于触发所述用户代理发送所述业务信息。
根据第二方面或第二方面的第一种可能的实现方式或第二方面的第二种可能的实现方式或第二方面的第三种可能的实现方式或第二方面的第四种可能的实现方式或第二方面的第五种可能的实现方式或第二方面的第六种可能的实现方式或第二方面的第七种可能的实现方式或第二方面的第八种可能的实现方式或第二方面的第九种可能的实现方式，在第二方面的第十种可能的实现方式中，所述信息处理模块，具体用于：
与所述网络服务器建立第三连接，并约定第三密钥和第四密钥；
使用所述第三密钥加密所述业务信息，得到第四密文；
将所述第四密文发送给所述网络服务器，以使所述网络服务器使用所述第四密钥解密所述第四密文，得到所述业务信息。
根据第二方面的第十种可能的实现方式，在第二方面的第十一种可能的实现方式中，所述装置，还包括：
第四接收模块，用于所述信息处理模块将所述第四密文发送给所述网络服务器之后，接收所述网络服务器发送的第五密文，所述第五密文由所述网络服务器使用所述第四密钥对业务数据进行加密得到；
第二解密模块，用于使用所述第三密钥解密所述第四接收模块接收到的所述第五密文，得到所述业务数据；
第二加密模块，用于使用所述第二密钥加密所述第二解密模块解密得到的所述业务数据，得到第六密文；
第三发送模块，用于将所述第二加密模块加密得到的所述第六密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第六密文，得到所述业务数据。
第三方面，提供了一种业务处理装置，用于中间代理节点中，所述装置包括：总线，以及连接到所述总线的处理器、存储器、发射器和接收器。其中，所述存储器用于存储若干个指令，所述指令被配置成由所述处理器执行；
所述处理器，用于与用户代理建立第一连接，所述第一连接是所述中间代 理节点顶替网络服务器，与所述用户代理建立的加密连接；根据在所述第一连接上传输的第一指示信息触发与所述用户代理建立第二连接；
所述接收器，用于通过所述处理器建立的所述第二连接接收所述用户代理发送的业务信息；
所述处理器，还用于对所述接收器接收到的所述业务信息进行处理。
在第三方面的第一种可能的实现方式中，
所述接收器，还用于截获所述用户代理向所述网络服务器发送的传输控制协议TCP连接请求；
所述处理器，还用于读取所述接收器截获的所述TCP连接请求中的，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接；在所述TCP连接建立完成后，利用预存的与所述网络服务器对应的数字证书与所述用户代理建立所述第一连接。
根据第三方面的第一种可能的实现方式，在第三方面的第二种可能的实现方式中，
所述发射器，还用于向所述用户代理发送第一数字证书，所述第一数字证书是证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述证书颁发机构的第二数字证书预先配置在所述用户代理中或安装有所述用户代理的终端的操作系统中，以使所述用户代理根据所述第二数字证书验证所述第一数字证书，在验证通过后，与所述中间代理节点建立所述第一连接；或，
所述发射器，还用于向所述用户代理发送第三数字证书和第四数字证书，所述第三数字证书是非授权证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述第四数字证书是所述非授权证书颁发机构的数字证书，以使所述用户代理根据所述第四数字证书验证所述第三数字证书，在验证通过后，与所述中间代理节点建立所述第一连接。
根据第三方面的第一种可能的实现方式或第三方面的第二种可能的实现方式，在第三方面的第三种可能的实现方式中，
所述接收器，还用于通过所述第一连接截获所述用户代理向所述网络服务器发送的第一访问请求，所述第一访问请求用于请求访问所述网络服务器；
所述发射器，还用于在所述接收器截获到所述第一访问请求后，在所述第一连接上向所述用户代理发送所述第一指示信息，所述第一指示信息用于指示所述用户代理向所述中间代理节点发送连接建立请求；
所述处理器，具体用于根据所述连接建立请求与所述用户代理建立所述第二连接。
根据第三方面或第三方面的第一种可能的实现方式或第三方面的第二种可能的实现方式或第三方面的第三种可能的实现方式，在第三方面的第四种可能的实现方式中，所述第一指示信息包括重定向响应消息。
根据第三方面的第四种可能的实现方式，在第三方面的第五种可能的实现方式中，所述重定向响应消息包括所述中间代理节点的网址，或，所述重定向响应消息包括代理网址，所述代理网址由所述中间代理节点对所述网络服务器的第二指示信息添加代理指示得到，所述第二指示信息包括网页指示信息、网页中对象的对象指示信息、对所述网页指示信息或所述对象指示信息进行转换后得到的信息中的一种。
根据第三方面的第五种可能的实现方式，在第三方面的第六种可能的实现方式中，所述处理器，还用于根据所述连接建立请求与所述用户代理建立TCP连接；在所述TCP连接建立完成后，利用所述中间代理节点的数字证书与所述用户代理建立所述第二连接。
根据第三方面的第六种可能的实现方式，在第三方面的第七种可能的实现方式中，所述接收器，具体用于接收所述用户代理通过所述第二连接发送的第一密文，所述第一密文由所述用户代理使用第一密钥对所述业务信息进行加密得到；
所述处理器，具体用于根据第二密钥解密所述接收器接收到的所述第一密文，得到所述业务信息；
其中，所述第一密钥和所述第二密钥是所述中间代理节点和所述用户代理在建立所述第二连接时约定的密钥。
根据第三方面的第七种可能的实现方式，在第三方面的第八种可能的实现方式中，当所述重定向响应消息包括所述中间代理节点的网址时，
所述接收器，还用于接收所述用户代理通过所述第二连接发送的第一密文之前，接收所述用户代理发送的第二密文，所述第二密文由所述用户代理使用所述第一密钥对第二访问请求进行加密得到，所述第二访问请求用于请求访问所述中间代理节点；
所述处理器，还用于使用所述第二密钥解密所述接收器接收到的所述第二密文，得到所述第二访问请求；获取所述中间代理节点的网页；使用所述第二 密钥加密所述网页，得到第三密文；
所述发射器，还用于将所述处理器加密得到的所述第三密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第三密文，得到所述网页，所述网页用于触发所述用户代理发送所述第一密文。
根据第三方面的第五种可能的实现方式，在第三方面的第九种可能的实现方式中，当所述重定向响应消息包括所述中间代理节点的网址时，
所述接收器，还用于所述处理器根据在所述第一连接上传输的第一指示信息触发与所述用户代理建立第二连接之后，接收所述用户代理发送的第二访问请求，所述第二访问请求用于请求访问所述中间代理节点；
所述处理器，还用于获取所述中间代理节点的网页；
所述发射器，还用于将所述处理器获取到的所述网页发送给所述用户代理，所述网页用于触发所述用户代理发送所述业务信息。
根据第三方面或第三方面的第一种可能的实现方式或第三方面的第二种可能的实现方式或第三方面的第三种可能的实现方式或第三方面的第四种可能的实现方式或第三方面的第五种可能的实现方式或第三方面的第六种可能的实现方式或第三方面的第七种可能的实现方式或第三方面的第八种可能的实现方式或第三方面的第九种可能的实现方式，在第三方面的第十种可能的实现方式中，
所述处理器，具体用于与所述网络服务器建立第三连接，并约定第三密钥和第四密钥；使用所述第三密钥加密所述业务信息，得到第四密文；
所述发射器，具体用于将所述处理器加密得到的所述第四密文发送给所述网络服务器，以使所述网络服务器使用所述第四密钥解密所述第四密文，得到所述业务信息。
根据第三方面的第十种可能的实现方式，在第三方面的第十一种可能的实现方式中，
所述接收器，还用于所述发射器将所述第四密文发送给所述网络服务器之后，接收所述网络服务器发送的第五密文，所述第五密文由所述网络服务器使用所述第四密钥对业务数据进行加密得到；
所述处理器，还用于使用所述第三密钥解密所述接收器接收到的所述第五密文，得到所述业务数据；使用所述第二密钥加密所述业务数据，得到第六密文；
所述发射器，还用于将所述处理器加密得到的所述第六密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第六密文，得到所述业务数据。
本发明实施例提供的技术方案的有益效果是：
通过与用户代理建立第一连接，第一连接是中间代理节点顶替网络服务器，与用户代理建立的加密连接；根据在第一连接上传输的第一指示信息触发与用户代理建立第二连接；通过第二连接接收用户代理发送的业务信息；对业务信息进行处理，可以在用户代理请求与网络服务器建立加密连接时，顶替网络服务器与用户代理建立加密的第一连接，再利用在第一连接上传输的第一指示信息触发与用户代理建立第二连接，通过第二连接对用户代理提供业务优化，解决了中间代理节点无法解密密文，导致中间代理节点无法为用户代理提供业务优化的问题，达到了优化业务的效果。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本发明实施例提供的一种业务处理方法的方法流程图；
图2A是本发明实施例提供的又一种业务处理方法的方法流程图；
图2B是本发明实施例提供的TLS连接的建立示意图；
图3是本发明实施例提供的第一种业务处理方法的应用流程图；
图4是本发明实施例提供的又一种业务处理方法的方法流程图；
图5是本发明实施例提供的第二种业务处理方法的应用流程图；
图6是本发明实施例提供的一种业务处理装置的结构示意图；
图7是本发明实施例提供的又一种业务处理装置的结构示意图；
图8是本发明实施例提供的一种业务处理装置的结构示意图。
具体实施方式
为使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明实施方式作进一步地详细描述。
请参见图1，其示出了本发明实施例提供的一种业务处理方法的方法流程图。该业务处理方法，可以包括：
步骤101，中间代理节点与用户代理建立第一连接，第一连接是中间代理节点顶替网络服务器，与用户代理建立的加密连接。
步骤102，中间代理节点根据在第一连接上传输的第一指示信息与用户代理建立第二连接。
步骤103，中间代理节点通过第二连接接收用户代理发送的业务信息。
步骤104，中间代理节点对业务信息进行处理。
综上所述，本发明实施例提供的业务处理方法，通过与用户代理建立第一连接，第一连接是中间代理节点顶替网络服务器，与用户代理建立的加密连接；根据在第一连接上传输的第一指示信息触发与用户代理建立第二连接；通过第二连接接收用户代理发送的业务信息；对业务信息进行处理，可以在用户代理请求与网络服务器建立加密连接时，顶替网络服务器与用户代理建立加密的第一连接，再利用在第一连接上传输的第一指示信息触发与用户代理建立第二连接，通过第二连接对用户代理提供业务优化，解决了中间代理节点无法解密密文，导致中间代理节点无法为用户代理提供业务优化的问题，达到了优化业务的效果。
请参见图2A，其示出了本发明实施例提供的又一种业务处理方法的方法流程图。该业务处理方法，可以包括：
步骤201，中间代理节点与用户代理建立第一连接，第一连接是中间代理节点顶替网络服务器，与用户代理建立的加密连接。
中间代理节点可以是Portal。当然，中间代理节点还可以是其它站点，本实施例不作限定。
由于用户代理请求与网络服务器建立加密连接，再通过该加密连接访问网络服务器，此时中间代理节点无法解密用户代理与网络服务器之间传输的密文，从而无法为用户代理提供业务优化，因此，中间代理节点可以顶替网络服务器与用户代理建立第一连接。其中，第一连接可以是基于SSL/TLS协议的连接，此时第一连接基于传输控制协议(英文：transmission control protocol；简称：TCP)连接的连接，是SSL连接和TLS连接这两种中的一种。由于基于 SSL协议的加密连接和基于TLS协议的加密连接的建立过程类似，下文以基于TLS协议的加密连接为例进行说明。
具体地，中间代理节点与用户代理建立第一连接，包括：
1)中间代理节点截获用户代理向网络服务器发送的TCP连接请求；
2)中间代理节点读取TCP连接请求中的信息，根据该信息顶替网络服务器与用户代理建立TCP连接；
3)在TCP连接建立完成后，中间代理节点利用预存的与网络服务器对应的数字证书与用户代理建立第一连接。
首先，用户代理需要与网络服务器建立TCP连接。其中，TCP连接的端口包括80端口和443端口，若用户代理需要基于HTTP协议访问网络服务器，则TCP连接的端口为80端口；若用户代理需要基于下层使用了SSL/TLS协议的超文本传输安全协议(英文：hyper text transfer protocol over secure socket layer；简称：HTTPS)访问网络服务器，则TCP连接的端口为443端口。中间代理节点截获用户代理发送的TCP连接请求，TCP连接请求中的信息包括源端因特网协议(英文：Internet Protocol；简称：IP)地址，源端端口，目的端IP地址，目的端端口，源端为用户代理，目的端为网络服务器。中间代理节点利用上述信息顶替网络服务器，与用户代理建立端口是443端口的TCP连接，在TCP连接建立完成后，中间代理节点再利用预存的与网络服务器对应的数字证书与用户代理建立第一连接，第一连接是指中间代理节点顶替网络服务器，与用户代理之间建立的加密连接。
请参考图2B所示的TLS连接的建立示意图，其示出了用户代理与中间代理节点建立TLS连接的过程。
步骤201’，用户代理向中间代理节点发送TLS协议版本号、加密算法列表和第一随机数。
步骤202’，若中间代理节点支持该TLS协议版本，则从加密算法列表中选择的一个加密算法，向用户代理发送TLS协议版本号、加密算法、会话标识和第二随机数。
步骤203’，中间代理节点向用户代理发送与网络服务器对应的数字证书。
步骤204’，中间代理节点向用户代理发送第一完成消息。
步骤205’，用户代理对数字证书进行验证，在验证通过后，获取数字证书中的公钥，生成预主密钥，并使用公钥加密预主密钥，将得到公钥交换信息发 送给中间代理节点。
步骤206’，用户代理向中间代理节点发送更改密码说明，通知中间代理节点启动协商好的参数。
此时，用户代理根据第一随机数、第二随机数、预主密钥和加密算法生成第一密钥。
步骤207’，用户代理向中间代理节点发送第二完成消息。
步骤208’，中间代理节点向用户代理发送更改密码说明，通知用户代理启动协商好的参数。
此时，中间代理节点使用私钥解密公钥交换信息，得到预主密钥，根据第一随机数、第二随机数、预主密钥和加密算法生成第二密钥。
步骤209’，中间代理节点向用户代理发送第三完成消息。
需要说明的是，中间代理节点在与用户代理建立第一连接之前，还需要获取与网络服务器对应的数字证书和私钥，数字证书至少包括公钥、拥有者名称和证书颁发机构的数字签名，数字签名是指对信息进行哈希运算得到的哈希值，用于验证信息是否被篡改。本实施例中的数字签名用于验证数字证书是否被篡改。
因此，中间代理节点利用预存的与网络服务器对应的数字证书与用户代理建立第一连接，包括：
1)中间代理节点向用户代理发送第一数字证书，第一数字证书是证书颁发机构颁发的且与网络服务器对应的数字证书，证书颁发机构的第二数字证书预先配置在用户代理中或安装有用户代理的终端的操作系统中，以使用户代理根据第二数字证书验证第一数字证书，在验证通过后，与中间代理节点建立第一连接；或，
2)中间代理节点向用户代理发送第三数字证书和第四数字证书，第三数字证书是非授权证书颁发机构颁发的且与网络服务器对应的数字证书，第四数字证书是非授权证书颁发机构的数字证书，以使用户代理根据第四数字证书验证第三数字证书，在验证通过后，与中间代理节点建立第一连接。
其中，与网络服务器对应的数字证书可以是网络服务器的真实数字证书，也可以是除真实数字证书之外的其他数字证书，该其他数字证书与网络服务器之间存在对应关系。本实施例中，其他数字证书可以是代理数字证书，也可以是假冒的数字证书，具体内容如下所述。
在第一种实现方式中，证书颁发机构可以是授权证书颁发机构，也可以是非授权证书颁发机构。
当证书颁发机构是授权证书颁发机构时，授权证书颁发机构根据安全监控等需要为可信的中间代理节点颁发网络服务器的代理数字证书，该代理数字证书即第一数字证书。其中，授权证书颁发机构可以为每个网络服务器颁发不同的代理数字证书，也可以为多个不同的网络服务器颁发相同的代理数字证书，本实施例不作限定。
其中，网络服务器的代理数字证书也可以是网络服务器的数字证书链上的子证书。该子证书可以由网络服务器颁发，也可以由其他第三方授权证书颁发机构颁发。
本实施例中，代理数字证书可以与授权证书颁发机构为网络服务器颁发的真实数字证书相同，也可以与真实数字证书不同。即，代理数字证书与真实数字证书可以拥有不同的公钥和私钥对。
当证书颁发机构是非授权证书颁发机构时，非授权证书颁发机构为中间代理节点颁发网络服务器的数字证书，此时的数字证书是假冒的数字证书，该假冒的数字证书即第一数字证书。
在用户代理验证数字证书时，会检测该数字证书的证书颁发机构的根证书是否位于可信认证中心(英文：Certificate Authority；简称：CA)列表中，根证书即第二数字证书。若该根证书位于可信CA列表中，则根据该根证书的公钥验证数字证书中的数字签名，若对数字签名的验证成功，则对数字证书的验证成功；若对数字签名的验证失败，则对数字证书的验证失败；若该根证书不在可信CA列表中，则对数字证书的验证失败。
可选的，中间代理节点获取到的与网络服务器对应的数字证书可以是多级证书颁发机构颁发的。比如，中间代理节点获取到的与网络服务器对应的数字证书是中级证书颁发机构Issuer颁发的，中级证书颁发机构Issuer的数字证书是高级证书颁发机构Root CA颁发的。此时，用户代理逐级寻找证书颁发机构的数字证书，检测该数字证书的证书颁发机构的根证书是否位于可信CA列表中，若该根证书位于可信CA列表中，则根据该根证书的公钥验证下级数字证书中的数字签名，若对数字签名的验证成功，则根据下级数字证书的公钥验证下下级数字证书中的数字签名，直至对所有的数字签名验证成功后，对数字证书的验证成功；若对其中一个数字签名的验证失败，则对数字证书的验证失败； 若该根证书不在可信CA列表中，则对数字证书的验证失败。
需要说明的是，当证书颁发机构是授权证书颁发机构时，该授权证书颁发机构的根证书预先配置在用户代理中或安装有用户代理的终端的操作系统中，即，该授权证书颁发机构的根证书预先配置在可信CA列表中；当证书颁发机构是非授权证书颁发机构时，还需要将该非授权证书颁发机构的根证书添加到可信CA列表中。
在一种添加方式中，可以与操作系统厂家或用户代理的厂家进行协商，将非授权证书颁发机构的根证书添加到可信CA列表中；在另一种添加方式中，可以提示用户安装非授权证书颁发机构的根证书，通过该非授权证书颁发机构的根证书添加到可信CA列表中。
在第二种实现方式中，中间代理节点可以获取非授权证书颁发机构发送的数字证书链，该数字证书链至少包括非授权证书颁发机构的数字证书，即自签名的根证书，也即第四数字证书，以及网络服务器的假冒的数字证书，中间代理节点将该数字证书链发送给用户代理，该假冒的数字证书即第三数字证书。
在用户代理验证数字证书时，会读取接收到的数字证书链中根证书的公钥，根据该公钥验证假冒的数字证书中的数字签名，若对数字签名的验证成功，则对假冒的数字证书的验证成功；若对数字签名的验证失败，则对假冒的数字证书的验证失败。
可选的，中间代理节点获取到的假冒的数字证书可以是多级非授权证书颁发机构颁发的，即，证书链还包括多级非授权证书颁发机构的数字证书。比如，中间代理节点获取到的与网络服务器对应的数字证书是非授权的中级证书颁发机构Issuer颁发的，非授权的中级证书颁发机构Issuer的数字证书是非授权的高级证书颁发机构Root CA颁发的。此时，用户代理从接收到的数字证书中逐级寻找非授权的证书颁发机构的数字证书，根据根证书的公钥验证下级数字证书中的数字签名，若对数字签名的验证成功，则根据下级数字证书的公钥验证下下级数字证书中的数字签名，直至对所有的数字签名验证成功后，对数字证书的验证成功；若对其中一个数字签名的验证失败，则对数字证书的验证失败。
步骤202，中间代理节点根据在第一连接上传输的第一指示信息触发与用户代理建立第二连接。
具体地，中间代理节点根据在第一连接上传输的第一指示信息触发与用户 代理建立第二连接，包括：
1)中间代理节点通过第一连接截获用户代理向网络服务器发送的第一访问请求，第一访问请求用于请求访问网络服务器；
2)在中间代理节点截获到第一访问请求后，中间代理节点在第一连接上向用户代理发送第一指示信息，第一指示信息用于指示用户代理向中间代理节点发送连接建立请求；
3)中间代理节点根据连接建立请求与用户代理建立第二连接。
其中，第一访问请求可以具体请求访问网络服务器的主页或网络服务器中的对象。第一指示信息包括重定向响应消息。
重定向响应消息可以是HTTP Redirection。可选的，重定向响应消息的location头域中可以包括类型信息，该类型信息用于指示用户代理请求建立的连接类型。比如，当重定向响应消息需要指示用户代理建立加密连接时，可以在类型信息中携带HTTPS，HTTPS用于指示HTTPS协议；当重定向响应消息需要指示用户代理建立非加密连接时，可以在类型信息中携带HTTP，HTTP用于指示HTTP协议。本实施例以类型信息中携带HTTPS为例进行说明，此时连接建立请求用于请求建立加密的第二连接，且端口为443端口。
另外，重定向响应消息包括中间代理节点的网址，或，重定向响应消息包括代理网址，代理网址由中间代理节点对网络服务器的第二指示信息添加代理指示得到，第二指示信息包括网页指示信息、网页中对象的对象指示信息、对网页指示信息或对象指示信息进行转换后得到的信息中的一种。
具体地，重定向响应消息需要包括中间代理节点的网址，以便用户代理通过中间代理节点访问网络服务器。在第一种实现方式中，重定向响应消息可以只包括中间代理节点的网址www.portal.com。在第二种实现方式中，重定向响应消息不仅包括中间代理节点的网址，还包括网络服务器的网页指示信息或对象指示信息或对上述两种信息中的一种进行转换后得到的信息，网页指示信息和对象指示信息可以从第一访问请求中获取到。比如，当网页指示信息是网络服务器的网址www.ottserver.com时，重定向响应消息可以包括www.portal.com/view？q＝www.ottserver.com；当对象指示信息是www.ottserver.com/picture1.gif时，重定向响应消息可以包括www.portal.com/view？q＝www.ottserver.com/picture1.gif。
本实施例中，中间代理节点可以在与用户代理建立第一连接的过程中，与 用户代理约定加密密钥和解密密钥。此时，中间代理节点可以使用加密密钥对重定向响应消息进行加密，将加密得到的密文发送给用户代理，用户代理使用解密密钥对密文进行解密后，得到重定向响应消息。用户代理根据重定向响应消息生成连接建立请求，将连接建立请求发送给中间代理节点，中间代理节点得到连接建立请求。
其中，中间代理节点与用户代理建立的第二连接可以是加密连接，也可以是非加密连接的TCP连接。当第二连接是加密连接时，中间代理节点根据连接建立请求与用户代理建立第二连接，包括：中间代理节点根据连接建立请求与用户代理建立TCP连接；在TCP连接建立完成后，中间代理节点利用中间代理节点的数字证书与用户代理建立第二连接。具体地，中间代理节点与用户代理建立TLS连接的流程与图2B所示的流程类似，不同的是，在步骤204’中，中间代理节点向用户代理发送的是中间代理节点的数字证书。
步骤203，中间代理节点接收用户代理通过第二连接发送的第一密文，第一密文由用户代理使用第一密钥对业务信息进行加密得到。
业务信息用于与网络服务器进行业务交互，可以具体用于向网络服务器请求业务，也可以具体用于向网络服务器发送业务数据。其中，当业务信息用于向网络服务器请求业务时，业务信息可以用于请求网络服务器的主页，也可以用于请求网络服务器中的对象(object)，该对象可以是网络服务器中存储的对象，也可以是其它服务器中存储的对象且该对象的统一资源标示符(英文：uniform resource identifier；简称：URI)包含在网络服务器的网页中。
比如，当网络服务器是OTT服务器且业务信息用于向OTT服务器请求OTT服务器的主页时，此时业务信息包括www.ottserver.com；当OTT服务器的网页包括URI且业务信息用于向OTT服务器请求该URI所指示的对象时，假设网页包括的URI为www.ottserver.com/picture1.gif且用户需要获取访问该URI所指示的图片1，此时业务信息包括www.ottserver.com/picture1.gif。
可选的，业务信息可以由中间代理节点对上述网址添加代理指示得到。其中，代理指示用于指示中转业务的中间代理节点，可以是中间代理节点的网址。比如，当中间代理节点是portal时，代理指示可以是中间代理节点的网址www.portal.com。
在添加代理指示，当业务信息用于请求网络服务器提供的主页时，指示信息是网页指示信息，即网络服务器的网址，此时业务信息可以是 www.portal.com/view？q＝www.ottserver.com；当业务信息用于请求网络服务器中的对象时，指示信息是对象指示信息，即对象的URI，此时业务信息可以是www.portal.com/view？q＝www.ottserver.com/picture1.gif。
可选的，中间代理节点还可以对网页指示信息或对象指示信息进行转换，并对转换后得到的信息添加代理指示，得到业务信息。通过转换可以将明文转换为密文进行传输，可以提高数据传输的安全性。比如，www.ottserver.com可以用www.abcd1234指代，此时www.portal.com/view？q＝www.abcd1234为www.portal.com/view？q＝www.ottserver.com。
本实施例中，中间代理节点在与用户代理建立第二连接的过程中约定密钥。当同一个设备的加密密钥和解密密钥相同时，可以约定第一密钥和第二密钥，第一密钥存储于用户代理中，用户代理可以使用第一密钥加密将要发送给中间代理节点的明文，也可以使用第一密钥解密中间代理节点发送的密文；第二密钥存储于中间代理节点中，中间代理节点可以使用第二密钥加密将要发送给用户代理的明文，也可以使用第二密钥解密用户代理发送的密文。当同一个设备的加密密钥和解密密钥不同时，可以约定第一密钥和第二密钥，并约定第五密钥和第六密钥，第一密钥和第五密钥存储于用户代理中，用户代理可以使用第一密钥加密将要发送给中间代理节点的明文，使用第五密钥解密中间代理节点发送的密文；第二密钥和第六密钥存储于中间代理节点中，中间代理节点可以使用第二密钥加密将要发送给用户代理的明文，使用第六密钥解密用户代理发送的密文。其中，第一密钥和第二密钥可以是对称密钥，也可以是不对称密钥；第五密钥和第六密钥可以是对称密钥，也可以是不对称密钥。下文以同一个设备的加密密钥和解密密钥相同为例进行说明。
可选的，当重定向响应消息包括中间代理节点的网址时，中间代理节点接收用户代理通过第二连接发送的第一密文之前，还包括：
1)中间代理节点接收用户代理发送的第二密文，第二密文由用户代理使用第一密钥对第二访问请求进行加密得到，第二访问请求用于请求访问中间代理节点；
2)中间代理节点使用第二密钥解密第二密文，得到第二访问请求；
3)中间代理节点获取中间代理节点的网页；
4)中间代理节点使用第二密钥加密网页，得到第三密文；
5)中间代理节点将第三密文发送给用户代理，以使用户代理使用第一密 钥解密第三密文，得到网页，网页用于触发用户代理发送第一密文。
其中，第二访问请求可以具体请求访问中间代理节点的主页或中间代理节点中的对象。
若重定向响应消息只包括中间代理节点的网址，则用户代理还需要根据中间代理节点的网址获取中间代理节点的网页，以便用户在接收到网页后，触发该网页，用户代理根据该触发发送连接建立请求，并在与中间代理节点建立第二连接之后发送第一密文。
步骤204，中间代理节点根据第二密钥解密第一密文，得到业务信息，第一密钥和第二密钥是中间代理节点和用户代理在建立第二连接时约定的密钥。
中间代理节点确定与第一密钥对应的第二密钥，再使用第二密钥解密第一密文，得到业务信息。
本实施例中，当中间代理节点具有缓存网络服务器的业务数据的功能时，中间代理节点可以在缓存中查找业务信息所请求的业务数据，若存在该业务数据，则执行步骤210，此时可以提高对业务信息的响应速度；若不存在该业务数据，则执行步骤205。当中间代理节点不具有缓存网络服务器的业务数据的功能，则执行步骤205。
步骤205，中间代理节点与网络服务器建立第三连接，并约定第三密钥和第四密钥。
当业务信息包括网页指示信息或对网页指示信息进行转换后得到的信息时，中间代理节点从处理后的业务信息中解析出网络服务器的网址，与该网址所指示的网络服务器建立加密连接，并约定第三密钥和第四密钥。其中，中间代理节点和网络服务器建立加密连接的过程与中间代理节点和用户代理建立加密连接的过程类似，此处不赘述。
当业务信息包括对象指示信息或对对象指示信息进行转换后得到的信息时，在第一种实现方式中，当中间代理节点已经获取过网络服务器的网页，即，中间代理节点已经与网络服务器建立了加密连接，此时可以不执行步骤205，直接执行步骤206；在第二种实现方式中，当中间代理节点未获取过网络服务器的主页时，中间代理节点从处理后的业务信息中解析出网络服务器的网址，与该网址所指示的网络服务器建立加密连接，并约定第三密钥和第四密钥，此处不赘述。
步骤206，中间代理节点使用第三密钥加密业务信息，得到第四密文。
本步骤中的业务信息可以是去除了中间代理节点的网址的业务信息。即，此时的业务信息只包括网络服务器指示信息，或，业务信息只包括对象指示信息。
步骤207，中间代理节点将第四密文发送给网络服务器，以使网络服务器使用第四密钥解密第四密文，得到业务信息。
步骤208，中间代理节点接收网络服务器发送的第五密文，第五密文由网络服务器使用第四密钥对业务数据进行加密得到。
网络服务器根据业务信息获取对应的业务数据，并使用第四密钥加密该业务数据，得到第五密文，将第五密文发送给中间代理节点。比如，当业务信息包括www.ottserver.com时，业务数据可以是网络服务器的主页；当业务信息包括www.ottserver.com/picture1.gif时，业务数据可以是图片1。
步骤209，中间代理节点使用第三密钥解密第五密文，得到业务数据。
步骤210，中间代理节点使用第二密钥加密业务数据，得到第六密文。
其中，当业务数据是网络服务器的网页时，该网页中还可以包括对象指示信息，此时中间代理节点还需要对对象指示信息添加代理指示。比如，当网页包括图片1的URI时，中间代理节点可以对www.ottserver.com/picture1.gif添加中间代理节点的网址www.portal.com，得到www.portal.com/view？q＝www.ottserver.com/picture1.gif。
步骤211，中间代理节点将第六密文发送给用户代理，以使用户代理使用第一密钥解密第六密文，得到业务数据。
综上所述，本发明实施例提供的业务处理方法，通过与用户代理建立第一连接，第一连接是中间代理节点顶替网络服务器，与用户代理建立的加密连接；根据在第一连接上传输的第一指示信息触发与用户代理建立第二连接；通过第二连接接收用户代理发送的业务信息；对业务信息进行处理，可以在用户代理请求与网络服务器建立加密连接时，顶替网络服务器与用户代理建立加密的第一连接，再利用在第一连接上传输的第一指示信息触发与用户代理建立第二连接，通过第二连接对用户代理提供业务优化，解决了中间代理节点无法解密密文，导致中间代理节点无法为用户代理提供业务优化的问题，达到了优化业务的效果。
另外，通过获取与网络服务器对应的代理数字证书或假冒的数字证书，可以利用与网络服务器对应的代理数字证书或假冒的数字证书顶替网络服务器， 从而与用户代理建立第一连接，丰富了与用户代理建立第一连接的实现方式。
另外，重定向响应消息包括代理网址，代理网址由中间代理节点对网络服务器的第二指示信息添加代理指示得到，第二指示信息包括网页指示信息、网页中对象的对象指示信息、对网页指示信息或对象指示信息进行转换后得到的信息中的一种，可以直接向用户代理发送网页指示信息或对象指示信息或对上述两种信息中的一种进行转换后得到的信息，而不需要先获取中间代理节点的网页，再触发中间代理节点的网页来获取网页指示信息或对象指示信息或对上述两种信息中的一种进行转换后得到的信息，可以简化操作流程，提高了业务处理的效率。
下面以用户代理和中间代理节点建立加密的第二连接、中间代理节点和网络服务器建立加密的第三连接为例，对业务处理方法的流程进行描述。请参考图3所示的第一种业务处理方法的应用流程图，图3以中间代理节点是Portal、用户代理是UA、网络服务器是OTT Server。
步骤301，Portal截获UA向OTT Server发送的TCP连接请求，根据TCP连接请求中的信息顶替OTT Server与UA之间建立TCP连接(443端口)。
步骤302，Portal利用与OTT Server对应的数字证书与UA之间TLS握手过程。
步骤303，Portal截获UA向OTT Server发送的加密的GET请求。其中，GET请求是第一访问请求。
步骤304，Portal向UA发送加密后的重定向响应消息和/或需要通过HTTPS协议访问的加密后的类型信息。其中，HTTPS协议是下层使用了SSL/TLS协议的HTTP协议。
步骤305，UA和Portal之间建立TCP连接(443端口)，TCP连接建立完成后，UA和Portal之间TLS握手过程。此时Portal提供的是Portal自己的数字证书。
其中，当重定向响应消息包括www.portal.com时，执行步骤306；当重定向响应消息包括www.portal.com/view？q＝www.ottserver.com时，执行步骤308。
步骤306，UA向Portal发送加密的GET请求，GET请求包括www.portal.com。其中，GET请求是第二访问请求。
步骤307，Portal解密GET请求后，向UA回复加密的200ok响应，返回 www.portal.com的网页。
步骤308，UA向Portal发送加密的GET请求，GET请求包括www.portal.com/view？q＝www.ottserver.com。
步骤309，Portal解密GET请求后，从GET请求解析出www.ottserver.com。
步骤310，Portal和OTT Server之间建立TCP连接(443端口)。
步骤311，Portal和OTT Server之间TLS握手过程。
步骤312，Portal向OTT Server发送加密的GET请求，GET请求包括www.ottserver.com。
步骤313，OTT Server向Portal回复加密的200ok响应，返回www.ottserver.com的网页。
步骤314，Portal解密200ok响应后，对200ok响应添加www.portal.com的portal指示：如www.portal.com/view？q＝www.ottserver.com/picture1.gif。
步骤315，Portal向UA发送加密的200ok响应。
步骤316，UA向Portal发送加密的GET请求，GET请求包括www.portal.com/view？q＝www.ottserver.com/picture1.gif。
步骤317，Portal解密GET请求后，从GET请求解析出www.ottserver.com/picture1.gif。
步骤318，Portal向OTT Server发送加密的GET请求，GET请求包括www.ottserver.com/picture1.gif。
步骤319，OTT Server向Portal加密的回复200ok响应，返回图片1。
步骤320，Portal解密200ok响应后，对200ok响应添加www.portal.com的portal指示。
步骤321，Portal向UA发送加密的200ok响应。
请参见图4，其示出了本发明实施例提供的又一种业务处理方法的方法流程图。该业务处理方法，可以包括：
步骤401，中间代理节点与用户代理建立第一连接，第一连接是中间代理节点顶替网络服务器，与用户代理建立的加密连接。
中间代理节点可以是Portal。当然，中间代理节点还可以是其它站点，本实施例不作限定。
由于用户代理请求与网络服务器建立加密连接，再通过该加密连接访问网 络服务器，此时中间代理节点无法解密用户代理与网络服务器之间传输的密文，从而无法为用户代理提供业务优化，因此，中间代理节点可以顶替网络服务器与用户代理建立第一连接。其中，第一连接可以是基于SSL/TLS协议的连接，此时第一连接是基于TCP连接的连接，是SSL连接和TLS连接这两种中的一种。由于基于SSL协议的加密连接和基于TLS协议的加密连接的建立过程类似，下文以基于TLS协议的加密连接为例进行说明。
具体地，中间代理节点与用户代理建立第一连接，包括：
1)中间代理节点截获用户代理向网络服务器发送的TCP连接请求；
2)中间代理节点读取TCP连接请求中的信息，根据该信息顶替网络服务器与用户代理建立TCP连接；
3)在TCP连接建立完成后，中间代理节点利用预存的与网络服务器对应的数字证书与用户代理建立第一连接。
首先，用户代理需要与网络服务器建立TCP连接。其中，TCP连接的端口包括80端口和443端口，若用户代理需要基于HTTP协议访问网络服务器，则TCP连接的端口为80端口；若用户代理需要基于下层使用了SSL/TLS协议的HTTPS访问网络服务器，则TCP连接的端口为443端口。中间代理节点截获用户代理发送的TCP连接请求，TCP连接请求中的信息包括源端IP地址，源端端口，目的端IP地址，目的端端口，源端为用户代理，目的端为网络服务器。中间代理节点利用上述信息顶替网络服务器与用户代理建立端口是443端口的TCP连接，在TCP连接建立完成后，中间代理节点再利用预存的与网络服务器对应的数字证书与用户代理建立第一连接，第一连接是指中间代理节点顶替网络服务器，与用户代理之间建立的加密连接。其中，用户代理与中间代理节点建立TLS连接的过程详见图2B，此处不赘述。
需要说明的是，中间代理节点在与用户代理建立第一连接之前，还需要获取与网络服务器对应的数字证书和私钥，数字证书至少包括公钥、拥有者名称和证书颁发机构的数字签名，数字签名是指对信息进行哈希运算得到的哈希值，用于验证信息是否被篡改。本实施例中的数字签名用于验证数字证书是否被篡改。
因此，中间代理节点利用预存的与网络服务器对应的数字证书与用户代理建立第一连接，包括：
1)中间代理节点向用户代理发送第一数字证书，第一数字证书是证书颁 发机构颁发的且与网络服务器对应的数字证书，证书颁发机构的第二数字证书预先配置在用户代理中或安装有用户代理的终端的操作系统中，以使用户代理根据第二数字证书验证第一数字证书，在验证通过后，与中间代理节点建立第一连接；或，
2)中间代理节点向用户代理发送第三数字证书和第四数字证书，第三数字证书是非授权证书颁发机构颁发的且与网络服务器对应的数字证书，第四数字证书是非授权证书颁发机构的数字证书，以使用户代理根据第四数字证书验证第三数字证书，在验证通过后，与中间代理节点建立第一连接。
具体地，中间代理节点根据与网络服务器对应的数字证书与用户代理建立第一连接的过程详见步骤201中的描述，此处不赘述。
步骤402，中间代理节点根据在第一连接上传输的第一指示信息触发与用户代理建立第二连接。
具体地，中间代理节点根据在第一连接上传输的第一指示信息触发与用户代理建立第二连接，包括：
1)中间代理节点通过第一连接截获用户代理向网络服务器发送的第一访问请求，第一访问请求用于请求访问网络服务器；
2)在中间代理节点截获到第一访问请求后，中间代理节点在第一连接上向用户代理发送第一指示信息，第一指示信息用于指示用户代理向中间代理节点发送连接建立请求；
3)中间代理节点根据连接建立请求与用户代理建立第二连接。
其中，第一访问请求可以具体请求访问网络服务器的主页或网络服务器中的对象。第一指示信息包括重定向响应消息。
重定向响应消息包括中间代理节点的网址，或，重定向响应消息包括代理网址，代理网址由中间代理节点对网络服务器的第二指示信息添加代理指示得到，第二指示信息包括网页指示信息、网页中对象的对象指示信息、对网页指示信息或对象指示信息进行转换后得到的信息中的一种。具体地，重定向响应消息的内容详见步骤201中的描述，此处不赘述。
本实施例中，中间代理节点可以在与用户代理建立第一连接的过程中，与用户代理约定加密密钥和解密密钥。此时，中间代理节点可以使用加密密钥对重定向响应消息进行加密，将加密得到的密文发送给用户代理，用户代理使用解密密钥对密文进行解密后，得到重定向响应消息。用户代理根据重定向响应 消息生成连接建立请求，将连接建立请求发送给中间代理节点，中间代理节点得到连接建立请求。
需要说明的是，本实施例中，第二连接是中间代理节点与用户代理建立的端口是80端口的TCP连接。
步骤403，中间代理节点通过第二连接接收用户代理发送的业务信息。
业务信息用于与网络服务器进行业务交互，可以具体用于向网络服务器请求业务，也可以具体用于向网络服务器发送业务数据。其中，当业务信息用于向网络服务器请求业务时，业务信息可以用于请求网络服务器的主页，也可以用于请求网络服务器中的对象(object)，该对象可以是网络服务器中存储的对象，也可以是其它服务器中存储的对象且该对象的统一资源标示符(英文：uniform resource identifier；简称：URI)包含在网络服务器的网页中。
比如，当网络服务器是OTT服务器且业务信息用于向OTT服务器请求OTT服务器的主页时，此时业务信息包括www.ottserver.com；当OTT服务器的网页包括URI且业务信息用于向OTT服务器请求该URI所指示的对象时，假设网页包括的URI为www.ottserver.com/picture1.gif且用户需要获取访问该URI所指示的图片1，此时业务信息包括www.ottserver.com/picture1.gif。
可选的，业务信息可以由中间代理节点对上述网址添加代理指示得到。其中，代理指示用于指示中转业务的中间代理节点，可以是中间代理节点的网址。比如，当中间代理节点是portal时，代理指示可以是中间代理节点的网址www.portal.com。
在添加代理指示，当业务信息用于请求网络服务器提供的主页时，指示信息是网页指示信息，即网络服务器的网址，此时业务信息可以是www.portal.com/view？q＝www.ottserver.com；当业务信息用于请求网络服务器中的对象时，指示信息是对象指示信息，即对象的URI，此时业务信息可以是www.portal.com/view？q＝www.ottserver.com/picture1.gif。
可选的，中间代理节点还可以对网页指示信息或对象指示信息进行转换，并对转换后得到的信息添加代理指示，得到业务信息。通过转换可以将明文转换为密文进行传输，可以提高数据传输的安全性。比如，www.ottserver.com可以用www.abcd1234指代，此时www.portal.com/view？q＝www.abcd1234为www.portal.com/view？q＝www.ottserver.com。
可选的，当重定向响应消息包括中间代理节点的网址时，中间代理节点根 据在第一连接上传输的第一指示信息触发与用户代理建立第二连接之后，还包括：
1)中间代理节点接收用户代理发送的第二访问请求，第二访问请求用于请求访问中间代理节点；
2)中间代理节点获取中间代理节点的网页；
3)中间代理节点将网页发送给用户代理，网页用于触发用户代理发送业务信息。
其中，第二访问请求可以具体请求访问中间代理节点的主页或中间代理节点中的对象。
若重定向响应消息只包括中间代理节点的网址，则用户代理还需要根据中间代理节点的网址获取中间代理节点的网页，以便用户在接收到网页后，触发该网页，用户代理根据该触发发送连接建立请求，并在与中间代理节点建立第二连接之后发送业务信息。
本实施例中，当中间代理节点具有缓存网络服务器的业务数据的功能时，中间代理节点可以在缓存中查找业务信息所请求的业务数据，若存在该业务数据，则执行步骤409，此时可以提高对业务信息的响应速度；若不存在该业务数据，则执行步骤404。当中间代理节点不具有缓存网络服务器的业务数据的功能，则执行步骤404。
步骤404，中间代理节点与网络服务器建立第三连接，并约定第三密钥和第四密钥。
当业务信息包括网页指示信息或对网页指示信息进行转换后得到的信息时，中间代理节点从处理后的业务信息中解析出网络服务器的网址，与该网址所指示的网络服务器建立加密连接，并约定第三密钥和第四密钥。其中，中间代理节点和网络服务器建立加密连接的过程与中间代理节点和用户代理建立加密连接的过程类似，此处不赘述。
当业务信息包括对象指示信息或对对象指示信息进行转换后得到的信息时，在第一种实现方式中，当中间代理节点已经获取过网络服务器的网页，即，中间代理节点已经与网络服务器建立了加密连接，此时可以不执行步骤404，直接执行步骤405；在第二种实现方式中，当中间代理节点未获取过网络服务器的主页时，中间代理节点从处理后的业务信息中解析出网络服务器的网址，与该网址所指示的网络服务器建立加密连接，并约定第三密钥和第四密钥，此 处不赘述。
步骤405，中间代理节点使用第三密钥加密业务信息，得到第四密文。
本步骤中的业务信息可以是去除了中间代理节点的网址的业务信息。即，此时的业务信息只包括网络服务器指示信息，或，业务信息只包括对象指示信息。
步骤406，中间代理节点将第四密文发送给网络服务器，以使网络服务器使用第四密钥解密第四密文，得到业务信息。
步骤407，中间代理节点接收网络服务器发送的第五密文，第五密文由网络服务器使用第四密钥对业务数据进行加密得到。
网络服务器根据业务信息获取对应的业务数据，并使用第四密钥加密该业务数据，得到第五密文，将第五密文发送给中间代理节点。比如，当业务信息包括www.ottserver.com时，业务数据可以是网络服务器的主页；当业务信息包括www.ottserver.com/picture1.gif时，业务数据可以是图片1。
步骤408，中间代理节点使用第三密钥解密第五密文，得到业务数据。
步骤409，中间代理节点使用第二密钥加密业务数据，得到第六密文。
其中，当业务数据是网络服务器的网页时，该网页中还可以包括对象指示信息，此时中间代理节点还需要对对象指示信息添加代理指示。比如，当网页包括图片1的URI时，中间代理节点可以对www.ottserver.com/picture1.gif添加中间代理节点的网址www.portal.com，得到www.portal.com/view？q＝www.ottserver.com/picture1.gif。
步骤410，中间代理节点将第六密文发送给用户代理，以使用户代理使用第一密钥解密第六密文，得到业务数据。
综上所述，本发明实施例提供的业务处理方法，通过与用户代理建立第一连接，第一连接是中间代理节点顶替网络服务器，与用户代理建立的加密连接；根据在第一连接上传输的第一指示信息触发与用户代理建立第二连接；通过第二连接接收用户代理发送的业务信息；对业务信息进行处理，可以在用户代理请求与网络服务器建立加密连接时，顶替网络服务器与用户代理建立加密的第一连接，再利用在第一连接上传输的第一指示信息触发与用户代理建立第二连接，通过第二连接对用户代理提供业务优化，解决了中间代理节点无法解密密文，导致中间代理节点无法为用户代理提供业务优化的问题，达到了优化业务的效果。
另外，通过获取与网络服务器对应的代理数字证书或假冒的数字证书，可以利用与网络服务器对应的代理数字证书或假冒的数字证书顶替网络服务器，从而与用户代理建立第一连接，丰富了与用户代理建立第一连接的实现方式。
另外，重定向响应消息包括代理网址，代理网址由中间代理节点对网络服务器的第二指示信息添加代理指示得到，第二指示信息包括网页指示信息、网页中对象的对象指示信息、对网页指示信息或对象指示信息进行转换后得到的信息中的一种，可以直接向用户代理发送网页指示信息或对象指示信息或对上述两种信息中的一种进行转换后得到的信息，而不需要先获取中间代理节点的网页，再触发中间代理节点的网页来获取网页指示信息或对象指示信息或对上述两种信息中的一种进行转换后得到的信息，可以简化操作流程，提高了业务处理的效率。
下面以用户代理和中间代理节点建立加密的第二连接、中间代理节点和网络服务器建立加密的第三连接为例，对业务处理方法的流程进行描述。请参考图5所示的第二种业务处理方法的应用流程图，图5以中间代理节点是Portal、用户代理是UA、网络服务器是OTT Server。
步骤501，Portal截获UA向OTT Server发送的TCP了连接请求，根据TCP连接请求中的信息顶替OTT Server与UA之间建立TCP连接(443端口)。
步骤502，Portal利用与OTT Server对应的数字证书与UA之间TLS握手过程。
步骤503，Portal截获UA向OTT Server发送的加密的GET请求。其中，GET请求是第一访问请求。
步骤504，Portal向UA发送加密后的重定向响应消息和/或需要通过HTTPS协议访问的加密后的类型信息。其中，HTTPS协议是下层使用了SSL/TLS协议的HTTP协议。
步骤505，UA和Portal之间建立TCP连接(80端口)。
其中，当重定向响应消息包括www.portal.com时，执行步骤506；当重定向响应消息包括www.portal.com/view？q＝www.ottserver.com时，执行步骤508。
步骤506，UA向Portal发送GET请求，GET请求包括www.portal.com。其中，GET请求是第二访问请求。
步骤507，Portal向UA回复200ok响应，返回www.portal.com的网页。
步骤508，UA向Portal发送GET请求，GET请求包括www.portal.com/view？q＝www.ottserver.com。
步骤509，Portal从GET请求解析出www.ottserver.com。
步骤510，Portal和OTT Server之间建立TCP连接(443端口)。
步骤511，Portal和OTT Server之间TLS握手过程。
步骤512，Portal向OTT Server发送加密的GET请求，GET请求包括www.ottserver.com。
步骤513，OTT Server向Portal回复加密的200ok响应，返回www.ottserver.com的网页。
步骤514，Portal解密200ok响应后，对200ok响应添加www.portal.com的portal指示：如www.portal.com/view？q＝www.ottserver.com/picture1.gif。
步骤515，Portal向UA发送200ok响应。
步骤516，UA向Portal发送GET请求，GET请求包括www.portal.com/view？q＝www.ottserver.com/picture1.gif。
步骤517，Portal从GET请求解析出www.ottserver.com/picture1.gif。
步骤518，Portal向OTT Server发送加密的GET请求，GET请求包括www.ottserver.com/picture1.gif。
步骤519，OTT Server向Portal加密的回复200ok响应，返回图片1。
步骤520，Portal解密200ok响应后，对200ok响应添加www.portal.com的portal指示。
步骤521，Portal向UA发送200ok响应。
请参考图6，其示出了本发明实施例提供的一种业务处理装置的结构示意图。该业务处理装置用于中间代理节点中，可以包括：
第一建立模块601，用于与用户代理建立第一连接，第一连接是中间代理节点顶替网络服务器，与用户代理建立的加密连接；
第二建立模块602，用于根据在第一建立模块601建立的第一连接上传输的第一指示信息触发与用户代理建立第二连接；
第一接收模块603，用于通过第二建立模块602建立的第二连接接收用户代理发送的业务信息；
信息处理模块604，用于对第一接收模块603接收到的业务信息进行处理。
综上所述，本发明实施例提供的业务处理装置，通过与用户代理建立第一连接，第一连接是中间代理节点顶替网络服务器，与用户代理建立的加密连接；根据在第一连接上传输的第一指示信息触发与用户代理建立第二连接；通过第二连接接收用户代理发送的业务信息；对业务信息进行处理，可以在用户代理请求与网络服务器建立加密连接时，顶替网络服务器与用户代理建立加密的第一连接，再利用在第一连接上传输的第一指示信息触发与用户代理建立第二连接，通过第二连接对用户代理提供业务优化，解决了中间代理节点无法解密密文，导致中间代理节点无法为用户代理提供业务优化的问题，达到了优化业务的效果。
请参考图7，其示出了本发明实施例提供的又一种业务处理装置的结构示意图。该业务处理装置用于中间代理节点中，可以包括：
第一建立模块701，用于与用户代理建立第一连接，第一连接是中间代理节点顶替网络服务器，与用户代理建立的加密连接；
第二建立模块702，用于根据在第一建立模块701建立的第一连接上传输的第一指示信息触发与用户代理建立第二连接；
第一接收模块703，用于通过第二建立模块702建立的第二连接接收用户代理发送的业务信息；
信息处理模块704，用于对第一接收模块703接收到的业务信息进行处理。
可选的，第一建立模块701，具体用于：
截获用户代理向网络服务器发送的TCP连接请求；
读取TCP连接请求中的信息，根据该信息顶替网络服务器与用户代理建立TCP连接；
在TCP连接建立完成后，利用预存的与网络服务器对应的数字证书与用户代理建立第一连接。
可选的，第一建立模块701，具体用于：
向用户代理发送第一数字证书，第一数字证书是证书颁发机构颁发的且与网络服务器对应的数字证书，证书颁发机构的第二数字证书预先配置在用户代理中或安装有用户代理的终端的操作系统中，以使用户代理根据第二数字证书验证第一数字证书，在验证通过后，与中间代理节点建立第一连接；或，
向用户代理发送第三数字证书和第四数字证书，第三数字证书是非授权证 书颁发机构颁发的且与网络服务器对应的数字证书，第四数字证书是非授权证书颁发机构的数字证书，以使用户代理根据第四数字证书验证第三数字证书，在验证通过后，与中间代理节点建立第一连接。
可选的，第二建立模块702，具体用于：
通过第一连接截获用户代理向网络服务器发送的第一访问请求，第一访问请求用于请求访问网络服务器；
在截获到第一访问请求后，在第一连接上向用户代理发送第一指示信息，第一指示信息用于指示用户代理向中间代理节点发送连接建立请求；
根据连接建立请求与用户代理建立第二连接。
可选的，第一指示信息包括重定向响应消息。
可选的，重定向响应消息包括中间代理节点的网址，或，重定向响应消息包括代理网址，代理网址由中间代理节点对网络服务器的第二指示信息添加代理指示得到，第二指示信息包括网页指示信息、网页中对象的对象指示信息、对网页指示信息或对象指示信息进行转换后得到的信息中的一种。
可选的，第二建立模块702，还用于：根据连接建立请求与用户代理建立TCP连接；在TCP连接建立完成后，利用中间代理节点的数字证书与用户代理建立第二连接。
可选的，第一接收模块703，具体用于：
接收用户代理通过第二连接发送的第一密文，第一密文由用户代理使用第一密钥对业务信息进行加密得到；
根据第二密钥解密第一密文，得到业务信息；
其中，第一密钥和第二密钥是中间代理节点和用户代理在建立第二连接时约定的密钥。
可选的，当重定向响应消息包括中间代理节点的网址时，装置，还包括：
第二接收模块705，用于第一接收模块703接收用户代理通过第二连接发送的第一密文之前，接收用户代理发送的第二密文，第二密文由用户代理使用第一密钥对第二访问请求进行加密得到，第二访问请求用于请求访问中间代理节点；
第一解密模块706，用于使用第二密钥解密第二接收模块705接收到的第二密文，得到第二访问请求；
第一获取模块707，用于获取中间代理节点的网页；
第一加密模块708，用于使用第二密钥加密第一获取模块707获取到的网页，得到第三密文；
第一发送模块709，用于将第一加密模块708加密得到的第三密文发送给用户代理，以使用户代理使用第一密钥解密第三密文，得到网页，网页用于触发用户代理发送第一密文。
可选的，当重定向响应消息包括中间代理节点的网址时，装置，还包括：
第三接收模块710，用于第二建立模块702根据在第一连接上传输的第一指示信息触发与用户代理建立第二连接之后，接收用户代理发送的第二访问请求，第二访问请求用于请求访问中间代理节点；
第二获取模块711，用于获取中间代理节点的网页；
第二发送模块712，用于将第二获取模块711获取到的网页发送给用户代理，网页用于触发用户代理发送业务信息。
可选的，信息处理模块704，具体用于：
与网络服务器建立第三连接，并约定第三密钥和第四密钥；
使用第三密钥加密业务信息，得到第四密文；
将第四密文发送给网络服务器，以使网络服务器使用第四密钥解密第四密文，得到业务信息。
可选的，装置，还包括：
第四接收模块713，用于信息处理模块704将第四密文发送给网络服务器之后，接收网络服务器发送的第五密文，第五密文由网络服务器使用第四密钥对业务数据进行加密得到；
第二解密模块714，用于使用第三密钥解密第四接收模块713接收到的第五密文，得到业务数据；
第二加密模块715，用于使用第二密钥加密第二解密模块714解密得到的业务数据，得到第六密文；
第三发送模块716，用于将第二加密模块715加密得到的第六密文发送给用户代理，以使用户代理使用第一密钥解密第六密文，得到业务数据。
综上所述，本发明实施例提供的业务处理装置，通过与用户代理建立第一连接，第一连接是中间代理节点顶替网络服务器，与用户代理建立的加密连接；根据在第一连接上传输的第一指示信息触发与用户代理建立第二连接；通过第二连接接收用户代理发送的业务信息；对业务信息进行处理，可以在用户代理 请求与网络服务器建立加密连接时，顶替网络服务器与用户代理建立加密的第一连接，再利用在第一连接上传输的第一指示信息触发与用户代理建立第二连接，通过第二连接对用户代理提供业务优化，解决了中间代理节点无法解密密文，导致中间代理节点无法为用户代理提供业务优化的问题，达到了优化业务的效果。
另外，通过获取与网络服务器对应的代理数字证书或假冒的数字证书，可以利用与网络服务器对应的代理数字证书或假冒的数字证书顶替网络服务器，从而与用户代理建立第一连接，丰富了与用户代理建立第一连接的实现方式。
另外，重定向响应消息包括代理网址，代理网址由中间代理节点对网络服务器的第二指示信息添加代理指示得到，第二指示信息包括网页指示信息、网页中对象的对象指示信息、对网页指示信息或对象指示信息进行转换后得到的信息中的一种，可以直接向用户代理发送网页指示信息或对象指示信息或对上述两种信息中的一种进行转换后得到的信息，而不需要先获取中间代理节点的网页，再触发中间代理节点的网页来获取网页指示信息或对象指示信息或对上述两种信息中的一种进行转换后得到的信息，可以简化操作流程，提高了业务处理的效率。
请参考图8，其示出了本发明实施例提供的一种业务处理装置的结构示意图。该业务处理装置用于中间代理节点中，可以包括：总线801，以及连接到总线的处理器802、存储器803、发射器804和接收器805。其中，存储器803用于存储若干个指令，指令被配置成由处理器802执行：
处理器802，用于与用户代理建立第一连接，第一连接是中间代理节点顶替网络服务器，与用户代理建立的加密连接；根据在第一连接上传输的第一指示信息触发与用户代理建立第二连接；
接收器805，用于通过处理器802建立的第二连接接收用户代理发送的业务信息；
处理器802，还用于对接收器805接收到的业务信息进行处理。
综上所述，本发明实施例提供的业务处理装置，通过与用户代理建立第一连接，第一连接是中间代理节点顶替网络服务器，与用户代理建立的加密连接；根据在第一连接上传输的第一指示信息触发与用户代理建立第二连接；通过第二连接接收用户代理发送的业务信息；对业务信息进行处理，可以在用户代理 请求与网络服务器建立加密连接时，顶替网络服务器与用户代理建立加密的第一连接，再利用在第一连接上传输的第一指示信息触发与用户代理建立第二连接，通过第二连接对用户代理提供业务优化，解决了中间代理节点无法解密密文，导致中间代理节点无法为用户代理提供业务优化的问题，达到了优化业务的效果。
本发明实施例还提供的一种业务处理装置，该业务处理装置用于中间代理节点中，可以包括：总线801，以及连接到总线的处理器802、存储器803、发射器804和接收器805。其中，存储器803用于存储若干个指令，指令被配置成由处理器802执行：
处理器802，用于与用户代理建立第一连接，第一连接是中间代理节点顶替网络服务器，与用户代理建立的加密连接；根据在第一连接上传输的第一指示信息触发与用户代理建立第二连接；
接收器805，用于通过处理器802建立的第二连接接收用户代理发送的业务信息；
处理器802，还用于对接收器805接收到的业务信息进行处理。
可选的，接收器805，还用于截获用户代理向网络服务器发送的TCP连接请求；
处理器802，还用于读取接收器805截获的TCP连接请求中的信息，根据该信息顶替网络服务器与用户代理建立TCP连接；在TCP连接建立完成后，利用预存的与网络服务器对应的数字证书与用户代理建立第一连接。
可选的，发射器804，还用于向用户代理发送第一数字证书，第一数字证书是证书颁发机构颁发的且与网络服务器对应的数字证书，证书颁发机构的第二数字证书预先配置在用户代理中或安装有用户代理的终端的操作系统中，以使用户代理根据第二数字证书验证第一数字证书，在验证通过后，与中间代理节点建立第一连接；或，
发射器804，还用于向用户代理发送第三数字证书和第四数字证书，第三数字证书是非授权证书颁发机构颁发的且与网络服务器对应的数字证书，第四数字证书是非授权证书颁发机构的数字证书，以使用户代理根据第四数字证书验证第三数字证书，在验证通过后，与中间代理节点建立第一连接。
可选的，接收器805，还用于通过第一连接截获用户代理向网络服务器发 送的第一访问请求，第一访问请求用于请求访问网络服务器；
发射器804，还用于在接收器805截获到第一访问请求后，在第一连接上向用户代理发送第一指示信息，第一指示信息用于指示用户代理向中间代理节点发送连接建立请求；
处理器802，具体用于根据连接建立请求与用户代理建立第二连接。
可选的，第一指示信息包括重定向响应消息。
可选的，重定向响应消息包括中间代理节点的网址，或，重定向响应消息包括代理网址，代理网址由中间代理节点对网络服务器的第二指示信息添加代理指示得到，第二指示信息包括网页指示信息、网页中对象的对象指示信息、对网页指示信息或对象指示信息进行转换后得到的信息中的一种。
可选的，处理器802，还用于根据连接建立请求与用户代理建立TCP连接；在TCP连接建立完成后，利用中间代理节点的数字证书与用户代理建立第二连接。
可选的，接收器805，具体用于接收用户代理通过第二连接发送的第一密文，第一密文由用户代理使用第一密钥对业务信息进行加密得到；
处理器802，具体用于根据第二密钥解密接收器805接收到的第一密文，得到业务信息；
其中，第一密钥和第二密钥是中间代理节点和用户代理在建立第二连接时约定的密钥。
可选的，当重定向响应消息包括中间代理节点的网址时，
接收器805，还用于接收用户代理通过第二连接发送的第一密文之前，接收用户代理发送的第二密文，第二密文由用户代理使用第一密钥对第二访问请求进行加密得到，第二访问请求用于请求访问中间代理节点；
处理器802，还用于使用第二密钥解密接收器805接收到的第二密文，得到第二访问请求；获取中间代理节点的网页；使用第二密钥加密网页，得到第三密文；
发射器804，还用于将处理器802加密得到的第三密文发送给用户代理，以使用户代理使用第一密钥解密第三密文，得到网页，网页用于触发用户代理发送第一密文。
可选的，当重定向响应消息包括中间代理节点的网址时，
接收器805，还用于处理器802根据在第一连接上传输的第一指示信息触 发与用户代理建立第二连接之后，接收用户代理发送的第二访问请求，第二访问请求用于请求访问中间代理节点；
处理器802，还用于获取中间代理节点的网页；
发射器804，还用于将处理器802获取到的网页发送给用户代理，网页用于触发用户代理发送业务信息。
可选的，处理器802，具体用于与网络服务器建立第三连接，并约定第三密钥和第四密钥；使用第三密钥加密业务信息，得到第四密文；
发射器804，具体用于将处理器802加密得到的第四密文发送给网络服务器，以使网络服务器使用第四密钥解密第四密文，得到业务信息。
可选的，接收器805，还用于发射器804将第四密文发送给网络服务器之后，接收网络服务器发送的第五密文，第五密文由网络服务器使用第四密钥对业务数据进行加密得到；
处理器802，还用于使用第三密钥解密接收器805接收到的第五密文，得到业务数据；使用第二密钥加密业务数据，得到第六密文；
发射器804，还用于将处理器802加密得到的第六密文发送给用户代理，以使用户代理使用第一密钥解密第六密文，得到业务数据。
综上所述，本发明实施例提供的业务处理装置，通过与用户代理建立第一连接，第一连接是中间代理节点顶替网络服务器，与用户代理建立的加密连接；根据在第一连接上传输的第一指示信息触发与用户代理建立第二连接；通过第二连接接收用户代理发送的业务信息；对业务信息进行处理，可以在用户代理请求与网络服务器建立加密连接时，顶替网络服务器与用户代理建立加密的第一连接，再利用在第一连接上传输的第一指示信息触发与用户代理建立第二连接，通过第二连接对用户代理提供业务优化，解决了中间代理节点无法解密密文，导致中间代理节点无法为用户代理提供业务优化的问题，达到了优化业务的效果。
另外，通过获取与网络服务器对应的代理数字证书或假冒的数字证书，可以利用与网络服务器对应的代理数字证书或假冒的数字证书顶替网络服务器，从而与用户代理建立第一连接，丰富了与用户代理建立第一连接的实现方式。
另外，重定向响应消息包括代理网址，代理网址由中间代理节点对网络服务器的第二指示信息添加代理指示得到，第二指示信息包括网页指示信息、网页中对象的对象指示信息、对网页指示信息或对象指示信息进行转换后得到的 信息中的一种，可以直接向用户代理发送网页指示信息或对象指示信息或对上述两种信息中的一种进行转换后得到的信息，而不需要先获取中间代理节点的网页，再触发中间代理节点的网页来获取网页指示信息或对象指示信息或对上述两种信息中的一种进行转换后得到的信息，可以简化操作流程，提高了业务处理的效率。
需要说明的是：上述实施例提供的业务处理装置在进行业务处理时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将业务处理装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。另外，上述实施例提供的业务处理装置与业务处理方法实施例属于同一构思，其具体实现过程详见方法实施例，这里不再赘述。
上述本发明实施例序号仅仅为了描述，不代表实施例的优劣。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，可以仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部 单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应所述以权利要求的保护范围为准。

Claims (36)

  1. 一种业务处理方法，其特征在于，所述方法包括：
    中间代理节点与用户代理建立第一连接，所述第一连接是所述中间代理节点顶替网络服务器，与所述用户代理建立的加密连接；
    所述中间代理节点根据在所述第一连接上传输的第一指示信息触发与所述用户代理建立第二连接；
    所述中间代理节点通过所述第二连接接收所述用户代理发送的业务信息；
    所述中间代理节点对所述业务信息进行处理。
  2. 根据权利要求1所述的方法，其特征在于，所述中间代理节点与用户代理建立第一连接，包括：
    所述中间代理节点截获所述用户代理向所述网络服务器发送的传输控制协议TCP连接请求；
    所述中间代理节点读取所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接；
    在所述TCP连接建立完成后，所述中间代理节点利用预存的与所述网络服务器对应的数字证书与所述用户代理建立所述第一连接。
  3. 根据权利要求2所述的方法，其特征在于，所述中间代理节点利用预存的与所述网络服务器对应的数字证书与所述用户代理建立所述第一连接，包括：
    所述中间代理节点向所述用户代理发送第一数字证书，所述第一数字证书是证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述证书颁发机构的第二数字证书预先配置在所述用户代理中或安装有所述用户代理的终端的操作系统中，以使所述用户代理根据所述第二数字证书验证所述第一数字证书，在验证通过后，与所述中间代理节点建立所述第一连接；或，
    所述中间代理节点向所述用户代理发送第三数字证书和第四数字证书，所述第三数字证书是非授权证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述第四数字证书是所述非授权证书颁发机构的数字证书，以使所述用户代理根据所述第四数字证书验证所述第三数字证书，在验证通过后，与所述中间代理节点建立所述第一连接。
  4. 根据权利要求2或3所述的方法，其特征在于，所述中间代理节点根据在所述第一连接上传输的第一指示信息触发与所述用户代理建立第二连接，包括：
    所述中间代理节点通过所述第一连接截获所述用户代理向所述网络服务器发送的第一访问请求，所述第一访问请求用于请求访问所述网络服务器；
    在所述中间代理节点截获到所述第一访问请求后，所述中间代理节点在所述第一连接上向所述用户代理发送所述第一指示信息，所述第一指示信息用于指示所述用户代理向所述中间代理节点发送连接建立请求；
    所述中间代理节点根据所述连接建立请求与所述用户代理建立所述第二连接。
  5. 根据权利要求1至4任一项所述的方法，其特征在于，所述第一指示信息包括重定向响应消息。
  6. 根据权利要求5所述的方法，其特征在于，
    所述重定向响应消息包括所述中间代理节点的网址，或，
    所述重定向响应消息包括代理网址，所述代理网址由所述中间代理节点对所述网络服务器的第二指示信息添加代理指示得到，所述第二指示信息包括网页指示信息、网页中对象的对象指示信息、对所述网页指示信息或所述对象指示信息进行转换后得到的信息中的一种。
  7. 根据权利要求6所述的方法，其特征在于，所述中间代理节点根据所述连接建立请求与所述用户代理建立所述第二连接，包括：
    所述中间代理节点根据所述连接建立请求与所述用户代理建立TCP连接；
    在所述TCP连接建立完成后，所述中间代理节点利用所述中间代理节点的数字证书与所述用户代理建立所述第二连接。
  8. 根据权利要求7所述的方法，其特征在于，所述中间代理节点通过所述第二连接接收所述用户代理发送的业务信息，包括：
    所述中间代理节点接收所述用户代理通过所述第二连接发送的第一密文， 所述第一密文由所述用户代理使用第一密钥对所述业务信息进行加密得到；
    所述中间代理节点根据第二密钥解密所述第一密文，得到所述业务信息；
    其中，所述第一密钥和所述第二密钥是所述中间代理节点和所述用户代理在建立所述第二连接时约定的密钥。
  9. 根据权利要求8所述的方法，其特征在于，当所述重定向响应消息包括所述中间代理节点的网址时，所述中间代理节点接收所述用户代理通过所述第二连接发送的第一密文之前，还包括：
    所述中间代理节点接收所述用户代理发送的第二密文，所述第二密文由所述用户代理使用所述第一密钥对第二访问请求进行加密得到，所述第二访问请求用于请求访问所述中间代理节点；
    所述中间代理节点使用所述第二密钥解密所述第二密文，得到所述第二访问请求；
    所述中间代理节点获取所述中间代理节点的网页；
    所述中间代理节点使用所述第二密钥加密所述网页，得到第三密文；
    所述中间代理节点将所述第三密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第三密文，得到所述网页，所述网页用于触发所述用户代理发送所述第一密文。
  10. 根据权利要求6所述的方法，其特征在于，当所述重定向响应消息包括所述中间代理节点的网址时，所述中间代理节点根据在所述第一连接上传输的第一指示信息触发与所述用户代理建立第二连接之后，还包括：
    所述中间代理节点接收所述用户代理发送的第二访问请求，所述第二访问请求用于请求访问所述中间代理节点；
    所述中间代理节点获取所述中间代理节点的网页；
    所述中间代理节点将所述网页发送给所述用户代理，所述网页用于触发所述用户代理发送所述业务信息。
  11. 根据权利要求1至10任一项所述的方法，其特征在于，所述中间代理节点对所述业务信息进行处理，包括：
    所述中间代理节点与所述网络服务器建立第三连接，并约定第三密钥和第 四密钥；
    所述中间代理节点使用所述第三密钥加密所述业务信息，得到第四密文；
    所述中间代理节点将所述第四密文发送给所述网络服务器，以使所述网络服务器使用所述第四密钥解密所述第四密文，得到所述业务信息。
  12. 根据权利要求11所述的方法，其特征在于，所述中间代理节点将所述第四密文发送给所述网络服务器之后，还包括：
    所述中间代理节点接收所述网络服务器发送的第五密文，所述第五密文由所述网络服务器使用所述第四密钥对业务数据进行加密得到；
    所述中间代理节点使用所述第三密钥解密所述第五密文，得到所述业务数据；
    所述中间代理节点使用所述第二密钥加密所述业务数据，得到第六密文；
    所述中间代理节点将所述第六密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第六密文，得到所述业务数据。
  13. 一种业务处理装置，其特征在于，用于中间代理节点中，所述装置包括：
    第一建立模块，用于与用户代理建立第一连接，所述第一连接是所述中间代理节点顶替网络服务器，与所述用户代理建立的加密连接；
    第二建立模块，用于根据在所述第一建立模块建立的所述第一连接上传输的第一指示信息触发与所述用户代理建立第二连接；
    第一接收模块，用于通过所述第二建立模块建立的所述第二连接接收所述用户代理发送的业务信息；
    信息处理模块，用于对所述第一接收模块接收到的所述业务信息进行处理。
  14. 根据权利要求13所述的装置，其特征在于，所述第一建立模块，具体用于：
    截获所述用户代理向所述网络服务器发送的传输控制协议TCP连接请求；
    读取所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接；
    在所述TCP连接建立完成后，利用预存的与所述网络服务器对应的数字证 书与所述用户代理建立所述第一连接。
  15. 根据权利要求14所述的装置，其特征在于，所述第一建立模块，具体用于：
    向所述用户代理发送第一数字证书，所述第一数字证书是证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述证书颁发机构的第二数字证书预先配置在所述用户代理中或安装有所述用户代理的终端的操作系统中，以使所述用户代理根据所述第二数字证书验证所述第一数字证书，在验证通过后，与所述中间代理节点建立所述第一连接；或，
    向所述用户代理发送第三数字证书和第四数字证书，所述第三数字证书是非授权证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述第四数字证书是所述非授权证书颁发机构的数字证书，以使所述用户代理根据所述第四数字证书验证所述第三数字证书，在验证通过后，与所述中间代理节点建立所述第一连接。
  16. 根据权利要求14或15所述的装置，其特征在于，所述第二建立模块，具体用于：
    通过所述第一连接截获所述用户代理向所述网络服务器发送的第一访问请求，所述第一访问请求用于请求访问所述网络服务器；
    在截获到所述第一访问请求后，在所述第一连接上向所述用户代理发送所述第一指示信息，所述第一指示信息用于指示所述用户代理向所述中间代理节点发送连接建立请求；
    根据所述连接建立请求与所述用户代理建立所述第二连接。
  17. 根据权利要求13至16任一项所述的装置，其特征在于，所述第一指示信息包括重定向响应消息。
  18. 根据权利要求17所述的装置，其特征在于，
    所述重定向响应消息包括所述中间代理节点的网址，或，
    所述重定向响应消息包括代理网址，所述代理网址由所述中间代理节点对所述网络服务器的第二指示信息添加代理指示得到，所述第二指示信息包括网 页指示信息、网页中对象的对象指示信息、对所述网页指示信息或所述对象指示信息进行转换后得到的信息中的一种。
  19. 根据权利要求18所述的装置，其特征在于，所述第二建立模块，还用于：
    根据所述连接建立请求与所述用户代理建立TCP连接；
    在所述TCP连接建立完成后，利用所述中间代理节点的数字证书与所述用户代理建立所述第二连接。
  20. 根据权利要求19所述的装置，其特征在于，第一接收模块，具体用于：
    接收所述用户代理通过所述第二连接发送的第一密文，所述第一密文由所述用户代理使用第一密钥对所述业务信息进行加密得到；
    根据第二密钥解密所述第一密文，得到所述业务信息；
    其中，所述第一密钥和所述第二密钥是所述中间代理节点和所述用户代理在建立所述第二连接时约定的密钥。
  21. 根据权利要求20所述的装置，其特征在于，当所述重定向响应消息包括所述中间代理节点的网址时，所述装置，还包括：
    第二接收模块，用于所述第一接收模块接收所述用户代理通过所述第二连接发送的第一密文之前，接收所述用户代理发送的第二密文，所述第二密文由所述用户代理使用所述第一密钥对第二访问请求进行加密得到，所述第二访问请求用于请求访问所述中间代理节点；
    第一解密模块，用于使用所述第二密钥解密所述第二接收模块接收到的所述第二密文，得到所述第二访问请求；
    第三获取模块，用于获取所述中间代理节点的网页；
    第一加密模块，用于使用所述第二密钥加密所述第三获取模块获取到的所述网页，得到第三密文；
    第一发送模块，用于将所述第一加密模块加密得到的所述第三密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第三密文，得到所述网页，所述网页用于触发所述用户代理发送所述第一密文。
  22. 根据权利要求18所述的装置，其特征在于，当所述重定向响应消息包括所述中间代理节点的网址时，所述装置，还包括：
    第三接收模块，用于所述第二建立模块根据在所述第一连接上传输的第一指示信息触发与所述用户代理建立第二连接之后，接收所述用户代理发送的第二访问请求，所述第二访问请求用于请求访问所述中间代理节点；
    第四获取模块，用于获取所述中间代理节点的网页；
    第二发送模块，用于将所述第四获取模块获取到的所述网页发送给所述用户代理，所述网页用于触发所述用户代理发送所述业务信息。
  23. 根据权利要求13至22任一项所述的装置，其特征在于，所述信息处理模块，具体用于：
    与所述网络服务器建立第三连接，并约定第三密钥和第四密钥；
    使用所述第三密钥加密所述业务信息，得到第四密文；
    将所述第四密文发送给所述网络服务器，以使所述网络服务器使用所述第四密钥解密所述第四密文，得到所述业务信息。
  24. 根据权利要求23所述的装置，其特征在于，所述装置，还包括：
    第四接收模块，用于所述信息处理模块将所述第四密文发送给所述网络服务器之后，接收所述网络服务器发送的第五密文，所述第五密文由所述网络服务器使用所述第四密钥对业务数据进行加密得到；
    第二解密模块，用于使用所述第三密钥解密所述第四接收模块接收到的所述第五密文，得到所述业务数据；
    第二加密模块，用于使用所述第二密钥加密所述第二解密模块解密得到的所述业务数据，得到第六密文；
    第三发送模块，用于将所述第二加密模块加密得到的所述第六密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第六密文，得到所述业务数据。
  25. 一种业务处理装置，其特征在于，用于中间代理节点中，所述装置包括：总线，以及连接到所述总线的处理器、存储器、发射器和接收器。其中，所述存储器用于存储若干个指令，所述指令被配置成由所述处理器执行；
    所述处理器，用于与用户代理建立第一连接，所述第一连接是所述中间代理节点顶替网络服务器，与所述用户代理建立的加密连接；根据在所述第一连接上传输的第一指示信息触发与所述用户代理建立第二连接；
    所述接收器，用于通过所述处理器建立的所述第二连接接收所述用户代理发送的业务信息；
    所述处理器，用于对所述接收器接收到的所述业务信息进行处理。
  26. 根据权利要求25所述的装置，其特征在于，
    所述接收器，还用于截获所述用户代理向所述网络服务器发送的传输控制协议TCP请求；
    所述处理器，还用于读取所述接收器截获的所述TCP连接请求中的信息，根据所述信息顶替所述网络服务器与所述用户代理建立TCP连接；在所述TCP连接建立完成后，利用预存的与所述网络服务器对应的数字证书与所述用户代理建立所述第一连接。
  27. 根据权利要求26所述的装置，其特征在于，
    所述发射器，还用于向所述用户代理发送第一数字证书，所述第一数字证书是证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述证书颁发机构的第二数字证书预先配置在所述用户代理中或安装有所述用户代理的终端的操作系统中，以使所述用户代理根据所述第二数字证书验证所述第一数字证书，在验证通过后，与所述中间代理节点建立所述第一连接；或，
    所述发射器，还用于向所述用户代理发送第三数字证书和第四数字证书，所述第三数字证书是非授权证书颁发机构颁发的且与所述网络服务器对应的数字证书，所述第四数字证书是所述非授权证书颁发机构的数字证书，以使所述用户代理根据所述第四数字证书验证所述第三数字证书，在验证通过后，与所述中间代理节点建立所述第一连接。
  28. 根据权利要求26或27所述的装置，其特征在于，
    所述接收器，还用于通过所述第一连接截获所述用户代理向所述网络服务器发送的第一访问请求，所述第一访问请求用于请求访问所述网络服务器；
    所述发射器，还用于在所述接收器截获到所述第一访问请求后，在所述第 一连接上向所述用户代理发送所述第一指示信息，所述第一指示信息用于指示所述用户代理向所述中间代理节点发送连接建立请求；
    所述处理器，具体用于根据所述连接建立请求与所述用户代理建立所述第二连接。
  29. 根据权利要求25至28任一项所述的装置，其特征在于，所述第一指示信息包括重定向响应消息。
  30. 根据权利要求29所述的装置，其特征在于，
    所述重定向响应消息包括所述中间代理节点的网址，或，
    所述重定向响应消息包括代理网址，所述代理网址由所述中间代理节点对所述网络服务器的第二指示信息添加代理指示得到，所述第二指示信息包括网页指示信息、网页中对象的对象指示信息、对所述网页指示信息或所述对象指示信息进行转换后得到的信息中的一种。
  31. 根据权利要求30所述的装置，其特征在于，所述处理器，还用于根据所述连接建立请求与所述用户代理建立TCP连接；在所述TCP连接建立完成后，利用所述中间代理节点的数字证书与所述用户代理建立所述第二连接。
  32. 根据权利要求31所述的装置，其特征在于，
    所述接收器，具体用于接收所述用户代理通过所述第二连接发送的第一密文，所述第一密文由所述用户代理使用第一密钥对所述业务信息进行加密得到；
    所述处理器，具体用于根据第二密钥解密所述接收器接收到的所述第一密文，得到所述业务信息；
    其中，所述第一密钥和所述第二密钥是所述中间代理节点和所述用户代理在建立所述第二连接时约定的密钥。
  33. 根据权利要求32所述的装置，其特征在于，当所述重定向响应消息包括所述中间代理节点的网址时，
    所述接收器，还用于接收所述用户代理通过所述第二连接发送的第一密文之前，接收所述用户代理发送的第二密文，所述第二密文由所述用户代理使用 所述第一密钥对第二访问请求进行加密得到，所述第二访问请求用于请求访问所述中间代理节点；
    所述处理器，还用于使用所述第二密钥解密所述接收器接收到的所述第二密文，得到所述第二访问请求；获取所述中间代理节点的网页；使用所述第二密钥加密所述网页，得到第三密文；
    所述发射器，还用于将所述处理器加密得到的所述第三密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第三密文，得到所述网页，所述网页用于触发所述用户代理发送所述第一密文。
  34. 根据权利要求30所述的装置，其特征在于，当所述重定向响应消息包括所述中间代理节点的网址时，
    所述接收器，还用于所述处理器根据在所述第一连接上传输的第一指示信息触发与所述用户代理建立第二连接之后，接收所述用户代理发送的第二访问请求，所述第二访问请求用于请求访问所述中间代理节点；
    所述处理器，还用于获取所述中间代理节点的网页；
    所述发射器，还用于将所述处理器获取到的所述网页发送给所述用户代理，所述网页用于触发所述用户代理发送所述业务信息。
  35. 根据权利要求25至34任一项所述的装置，其特征在于，
    所述处理器，具体用于与所述网络服务器建立第三连接，并约定第三密钥和第四密钥；使用所述第三密钥加密所述业务信息，得到第四密文；
    所述发射器，具体用于将所述处理器加密得到的所述第四密文发送给所述网络服务器，以使所述网络服务器使用所述第四密钥解密所述第四密文，得到所述业务信息。
  36. 根据权利要求35所述的装置，其特征在于，
    所述接收器，还用于所述发射器将所述第四密文发送给所述网络服务器之后，接收所述网络服务器发送的第五密文，所述第五密文由所述网络服务器使用所述第四密钥对业务数据进行加密得到；
    所述处理器，还用于使用所述第三密钥解密所述接收器接收到的所述第五密文，得到所述业务数据；使用所述第二密钥加密所述业务数据，得到第六密 文；
    所述发射器，还用于将所述处理器加密得到的所述第六密文发送给所述用户代理，以使所述用户代理使用所述第一密钥解密所述第六密文，得到所述业务数据。
PCT/CN2015/073797 2015-03-06 2015-03-06 业务处理方法及装置 WO2016141513A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN201580027319.6A CN106464684B (zh) 2015-03-06 2015-03-06 业务处理方法及装置
PCT/CN2015/073797 WO2016141513A1 (zh) 2015-03-06 2015-03-06 业务处理方法及装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2015/073797 WO2016141513A1 (zh) 2015-03-06 2015-03-06 业务处理方法及装置

Publications (1)

Publication Number Publication Date
WO2016141513A1 true WO2016141513A1 (zh) 2016-09-15

Family

ID=56878533

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/073797 WO2016141513A1 (zh) 2015-03-06 2015-03-06 业务处理方法及装置

Country Status (2)

Country Link
CN (1) CN106464684B (zh)
WO (1) WO2016141513A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018076183A1 (zh) * 2016-10-25 2018-05-03 华为技术有限公司 一种传输数据的方法、装置和系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101459650A (zh) * 2007-12-15 2009-06-17 华为技术有限公司 业务路由方法、业务路由器、客户端设备及业务网络系统
CN101741807A (zh) * 2008-11-19 2010-06-16 中兴通讯股份有限公司 一种sip会话刷新过程中协商更新时间的方法
US20140108521A1 (en) * 2011-06-30 2014-04-17 Openwave Mobility Inc. Persisting user preferences in an intermediate network device
CN103929784A (zh) * 2013-01-10 2014-07-16 中国移动通信集团上海有限公司 一种用户带宽控制方法、装置及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101459650A (zh) * 2007-12-15 2009-06-17 华为技术有限公司 业务路由方法、业务路由器、客户端设备及业务网络系统
CN101741807A (zh) * 2008-11-19 2010-06-16 中兴通讯股份有限公司 一种sip会话刷新过程中协商更新时间的方法
US20140108521A1 (en) * 2011-06-30 2014-04-17 Openwave Mobility Inc. Persisting user preferences in an intermediate network device
CN103929784A (zh) * 2013-01-10 2014-07-16 中国移动通信集团上海有限公司 一种用户带宽控制方法、装置及系统

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018076183A1 (zh) * 2016-10-25 2018-05-03 华为技术有限公司 一种传输数据的方法、装置和系统

Also Published As

Publication number Publication date
CN106464684B (zh) 2020-06-02
CN106464684A (zh) 2017-02-22

Similar Documents

Publication Publication Date Title
US20210385201A1 (en) Systems and methods for secure multi-party communications using aproxy
CN109088889B (zh) 一种ssl加解密方法、系统及计算机可读存储介质
US10693848B2 (en) Installation of a terminal in a secure system
US8532620B2 (en) Trusted mobile device based security
JP5021215B2 (ja) Ｗｅｂサービス用の信頼できる第三者認証
EP3205048B1 (en) Generating a symmetric encryption key
US10356090B2 (en) Method and system for establishing a secure communication channel
CN103139185A (zh) 一种实现安全反向代理服务的方法
US10511596B2 (en) Mutual authentication
US20170317836A1 (en) Service Processing Method and Apparatus
US20170293768A1 (en) Security through authentication tokens
US20130019092A1 (en) System to Embed Enhanced Security / Privacy Functions Into a User Client
KR101839048B1 (ko) 사물 인터넷 환경의 종단간 보안 플랫폼
CN105516161A (zh) 安全获取http请求的方法及系统
WO2016141513A1 (zh) 业务处理方法及装置
KR101962349B1 (ko) 인증서 기반 통합 인증 방법
CN107209751B (zh) 业务处理方法及装置
US20230041783A1 (en) Provision of digital content via a communication network
GB2590954A (en) Provision of digital content via a communication network
CN114003892A (zh) 可信认证方法、安全认证设备及用户终端

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15884196

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15884196

Country of ref document: EP

Kind code of ref document: A1