WO2020224341A1

WO2020224341A1 - Method and apparatus for identifying tls encrypted traffic

Info

Publication number: WO2020224341A1
Application number: PCT/CN2020/080236
Authority: WO
Inventors: 宋科; 李华光; 刘西亮
Original assignee: 中兴通讯股份有限公司
Priority date: 2019-05-09
Filing date: 2020-03-19
Publication date: 2020-11-12
Also published as: CN111917694A; CN111917694B

Abstract

Provided is a method for identifying TLS encrypted traffic. The method comprises: a DPI SERVER receiving application registration request information from a registration website, assigning application feature identification information to a target application, and sending same back to the registration website; the DPI SERVER exchanging application feature verification information of the application with an APP SERVER on the basis of a bidirectional verification TLS connection, wherein both parties have the same application feature identification information and application feature verification information after the exchange; the DPI SERVER sending the application feature identification information and the application feature verification information of the application to a DPI network element on the basis of the bidirectional verification TLS connection; and the DPI network element verifying, according to the application feature verification information, the legitimacy of the application feature identification information in the TLS traffic of a user, and identifying, according to the application feature identification information, the TLS traffic generated by the application.

Description

Method and device for identifying TLS encrypted flow

This disclosure claims the priority of the Chinese patent application CN201910396042.4 entitled "A method and device for identifying TLS encrypted traffic" filed on May 9, 2019, the entire content of which is incorporated herein by reference.

Technical field

The present disclosure relates to the field of mobile communication, and in particular to a method and device for identifying TLS encrypted traffic.

Background technique

With the continuous development of mobile broadband and smart terminals, as well as the strengthening of user information security and privacy protection, more and more network connections of iOS and Android applications are carried based on TLS (Transport Layer Security), resulting in TLS encryption The proportion of traffic is increasing. There are more and more demand scenarios for telecom operators to accurately identify users' TLS encrypted traffic. In the mobile network of telecom operators, whether in P-GW (Packet Data Network Gateway) network elements, MEC (Mobile Edge Computing) servers, or other related switches, routers, firewalls, traffic analyzers and other equipment , It may be necessary to accurately identify TLS encrypted traffic based on DPI (Deep Packet Inspection, deep packet inspection) technology.

Taking 5G MEC as an example, edge computing provides 5G terminals with a reliable mobile wireless network with high bandwidth and low latency. A possible typical operation mode is that when the network load is close to saturation, MEC equipment will provide services for different applications Different QoS guarantees, especially high-priority QoS guarantees for application services paid by SP (Service Provider) with cooperative relations. Therefore, it is particularly important to accurately identify the application service traffic based on TLS encryption of the cooperative SP through DPI technology.

However, conventional DPI technology usually follows the SNI (Server Name Indication) in the TLS CLIENT HELLO message or the server certificate CN (Common Name) and SAN (Subject Alternative Name) or DNS (Domain Name) in the TLS Certificate message. Name System) The DNS domain name of the server in the request/response message identifies the TLS encrypted traffic of the application service of the cooperative SP. This type of identification method usually has defects. For example, some VPN (Virtual Private Network) software uses such features as SNI, CN, SAN, DNS, etc., to disguise its VPN traffic as the application service of the cooperative SP of a telecom operator Traffic, so as to achieve the purpose of obtaining high priority QoS or avoiding billing.

At present, a common solution is that telecom operators obtain the public network IP address of the server of the cooperative SP in advance, and perform DPI identification for the TLS encrypted traffic of these designated IP addresses. However, this method is too extensive to accurately identify the refined business of the cooperative SP.

At present, another common solution is that telecom operators perform DPI identification on TLS encrypted traffic through the public network IP address of the cooperative SP server and one or more SNI/CN/SAN/DNS combination information. This method can refine the application business of the cooperative SP to a certain extent, but the degree of refinement is usually not ideal. Moreover, the IETF (Internet Engineering Task Force) has encrypted the Certificate message in the TLS 1.3 (RFC 8446) protocol, causing the CN/SAN feature to become invalid; and in the DoT (RFC 7858) and DoH (RFC8484) protocols DNS messages have been encrypted in China, resulting in the invalidation of DNS features; and the draft of encrypted SNI has been drafted and released for discussion, which will cause future SNI features to become invalid.

At present, there is a need for a precise and detailed and feasible DPI identification method for anti-fraud of the application service TLS encrypted traffic of the telecom operator's cooperative SP. By using the method of the present disclosure, precise and detailed DPI identification for anti-fraud of the application service TLS encrypted traffic of the application service of the telecom operator's cooperative SP can be realized, and the occurrence of traffic fraud can be reduced or prevented.

Summary of the invention

The following is an overview of the topics detailed in this article. This summary is not intended to limit the scope of protection of the claims.

In order to allow telecom operators to finely identify the application service traffic of their cooperative SP based on TLS encryption, and to reduce or prevent the occurrence of traffic fraud, this disclosure proposes a method for identifying traffic based on TLS encryption, including: DPI SERVER receives from registered websites App registration request information, and assign APP feature identification information to the target app, and send it back to the registration website; DPI SERVER exchanges the APP feature verification information of the APP with the APP SERVER based on the TLS connection with mutual verification, and both parties have the same APP after the exchange Characteristic identification information and APP characteristic verification information; DPI SERVER sends the APP characteristic identification information and APP characteristic verification information of the APP to the DPI network element based on the TLS connection of mutual verification; the DPI network element verifies the user according to the APP characteristic verification information The legality of the APP feature identification information in the TLS traffic, and the TLS traffic generated by the APP is identified according to the APP feature identification information.

The present disclosure also provides a TLS encrypted traffic characteristic information management device, including: an APP registration management module placed in DPI SERVER, which is used to receive APP registration request information from a registration website and allocate APP characteristic identification information to the target APP. And send it back to the registration website; the APP SERVER update management module placed in the DPI SERVER, which is based on the two-way verification TLS connection, exchanges the APP feature verification information of the APP with the APP SERVER, and both parties have the same APP feature identification information and APP Feature verification information: The DPI feature update management module placed in the DPI SERVER sends the APP feature identification information and APP feature verification information of the APP to the DPI network element based on the TLS connection of mutual verification.

The present disclosure also provides a server, including: a memory, a processor, and a computer program stored in the memory and capable of running on the processor, and the processor implements the TLS described in any one of the above claims when the processor executes the program Encrypted traffic identification method.

Description of the drawings

Figure 1 is a flow chart of the TLS encrypted traffic identification method provided by the present disclosure;

Figure 2 is a structural diagram of a TLS encrypted traffic characteristic information management device provided by the present disclosure;

Figure 3 is a structural diagram of a server provided by the present disclosure;

Figure 4 is a timing interaction diagram of the TLS encrypted traffic identification method provided by the present disclosure.

Detailed ways

Hereinafter, the embodiments of the present disclosure will be described in detail with reference to the accompanying drawings.

The steps shown in the flowchart of the drawings may be executed in a computer system such as a set of computer-executable instructions. And, although a logical sequence is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than here.

The DPI network elements described in the present disclosure may refer to DPI independent network element devices on the one hand, and may also refer to network element devices with built-in DPI functions such as PGW gateways, MEC servers, switches, routers, and firewalls.

This disclosure introduces DPI SERVER to allocate APP TOKEN and other information for APP. APP service traffic carries information such as APP TOKEN through the custom TLS extension of the SERVER HELLO message, so that the DPI network element can accurately identify the TLS-encrypted APP service traffic of the cooperative SP, so that the DPI network element can be prevented by a series of measures proposed in this disclosure Traffic fraud: verify the integrity of related data through MAC (Message Authentication Code), prevent replay attacks through multi-interval counter check, verify APP identity through public key cryptographic signature, and check APP SERVER public network IP address Strengthen the accuracy of feature recognition.

As shown in FIG. 1, an embodiment of the present disclosure provides a method for identifying TLS encrypted traffic.

S101, APP registration stage. As shown in the first step in Figure 1, DPI SERVER receives and processes the APP registration request message sent by the APP developer through the registration website. DPI SERVER returns the corresponding APP registration response message to the registration website to provide APP registration information for APP developers.

In one embodiment, the APP registration request message includes: APP name, SP name, APP SERVER name, APP SERVER certificate CN/SAN and other information used in the APP SERVER update phase. In one embodiment, the APP registration response message includes information such as a dedicated TLS extension type ID, APP TOKEN, and the date and time when the APP TOKEN is successfully allocated.

For example, DPI SERVER uses "SP name + APP name" as a unique identifier, and assigns a globally unique APP TOKEN to the APP of the SP. APP TOKEN can be a large integer of 128 bits (that is, 16 bytes).

For the allocation of a dedicated TLS extension type ID, DPI SERVER first ensures that the selected extension type ID cannot be a well-known extension type ID that has been assigned by IANA (Internet Assigned Numbers Authority). The official IANA (www.iana.org) document "Transport Layer Security (TLS) Extensions" records the latest well-known extension type ID, such as 0 for SERVER_NAME, 1 for MAX_FRAGMENT_LENGTH, 16 for APPLICATION_LAYER_PROTOCOL_NEGOTIATION (ALPN), 35 for SESSION_TICKET, 41 for PRE_SHARED_KEY (PSK), 43 is SUPPORTED_VERSIONS, wait for dozens, these well-known extension type IDs cannot be selected. DPI SERVER can select the extended type ID from the current more than 65,000 "UNASSIGNED" numbers, or select the extended type ID from the current more than 200 "RESERVED FOR PRIVATE USE" numbers.

In one embodiment, DPI SERVER may support that the APP registration request message includes one or more value ranges of the TLS extension type ID that needs to be excluded. APP may add other custom extension type IDs unrelated to the present disclosure in TLS, so the dedicated TLS extension type ID allocated by DPI SERVER cannot conflict with other custom extension type IDs of APP. In one embodiment, after excluding the well-known TLS extension type ID of IANA and other extension type IDs specified by the APP, the DPI SERVER allocates a dedicated TLS extension type ID for DPI identification to the APP.

In one embodiment, in order to increase the difficulty and cost of traffic fraud, DPI SERVER can give different SPs (ie "SP names") after excluding the well-known IANA TLS extension type ID and excluding other extension type IDs specified by APP. The same or different dedicated TLS extension type IDs are allocated; alternatively, the same or different dedicated TLS extension type IDs can also be allocated to different APPs (ie, "SP name+APP name").

In one embodiment, the APP developer deploys information such as the dedicated TLS extension type ID, APP TOKEN, and the date and time when the APP TOKEN is successfully allocated through the registration website to the APP SERVER. The APP developer deploys the special TLS extension type ID and other information obtained through the registration website to the APP CLIENT.

Deploy a dedicated TLS extension type ID in the APP CLIENT, so that the APP CLIENT generates a CLIENT HELLO message for TLS traffic to carry the dedicated TLS extension type ID.

A dedicated TLS extension type ID is deployed in the APP SERVER, so that the APP SERVER carries the extension type ID and the corresponding extended content when replying to the SERVER HELLO response to the CLIENT HELLO containing the extension type ID.

For the TLS 1.0 protocol, TLS 1.1 protocol, and TLS 1.2 protocol, CLIENT HELLO is not encrypted, and SERVER HELLO is not encrypted. The dedicated TLS extension introduced at this stage can be added to CLIENT HELLO and SERVER HELLO normally.

For the TLS 1.3 protocol, CLIENT HELLO is not encrypted, and SERVER HELLO is not encrypted. The dedicated TLS extension introduced at this stage can be normally added to CLIENT HELLO and SERVER HELLO. However, because the TLS1.3 protocol introduces the ENCRYPTED EXTENSIONS message to encrypt extensions that do not require clear text transmission, it is necessary to ensure that the dedicated TLS extension introduced at this stage should be added to the SERVER HELLO instead of ENCRYPTED EXTENSIONS when implementing this disclosure in. In one embodiment, taking the OpenSSL-1.1.1 library as an example, when setting a custom extension through the OPENSSL API function SSL_CTX_add_custom_ext(), by setting the relevant parameters of the function to include "SSL_EXT_TLS1_3_SERVER_HELLO" instead of "SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS" So that the dedicated TLS extension introduced at this stage can be added to SERVER HELLO normally.

S102, APP SERVER update stage. As shown in the second step in Figure 1, the DPI SERVER receives the TLS connection establishment request initiated by the APP SERVER, and uses the mutual certificate verification mechanism to establish the TLS connection. The DPI SERVER receives the APP SERVER update request message and processes the DPI identification and verification information periodically updated by the APP SERVER. At the same time, the DPI SERVER also sends the new DPI identification and verification information to the APP SERVER through the APP SERVER update response message.

In one embodiment, the APP SERVER update request message includes: APP TOKEN, the date and time when the APP TOKEN is successfully allocated, the APP SERVER public network IP address (optional), and the APP SERVER public key information used for DPI identification. The APP SERVER update response message contains information such as the legal range of the multi-interval counter, MAC key, and MAC algorithm.

In one embodiment, the TLS connection between APP SERVER and DPI SERVER adopts a two-way certificate verification mechanism, which increases the difficulty and cost of traffic fraud. As a TLS client, APP SERVER sends its own certificate to DPI SERVER through an uplink CERTIFICATE message, and DPI SERVER as a TLS server sends its own certificate to APP SERVER through a downlink CERTIFICATE message. The respective certificates of APP SERVER and DPI SERVER must be issued by a third-party legal CA (Certificate Authority) to ensure that both parties can verify the legal identity of each other through each other's certificate. Among them, DPI SERVER obtains the "APP SERVER certificate CN/SAN used in the APP SERVER update phase" through the first step of APP registration, and verifies the CN and SAN sent by the APP SERVER through the uplink CERTIFICATE to verify the legality of the APP SERVER Identity.

In one embodiment, APP SERVER periodically sends APP SERVER update request message to DPI SERVER through the TLS connection with DPI SERVER, adding APP SERVER public network IP address (optional), APP SERVER public key used for DPI identification The information is sent to the DPI SERVER; at the same time, the APP TOKEN and the date and time of the successful allocation of the APP TOKEN are carried in the message, so that the DPI SERVER can be associated with the relevant information of the APP formed in the first step of APP registration.

For example, the APP SERVER update request message includes APP SERVER public key information used for DPI identification. In one embodiment, APP SERVER can periodically regenerate the public key and its paired private key, and send the newly generated public key to DPI SERVER through this message. The public key is used in the subsequent DPI feature identification phase of the fourth step, and the DPI network element verifies the signature of the APP SERVER to the relevant part of the APP TOKEN extension.

In one embodiment, in the APP SERVER update request message, if the APP SERVER can obtain the APP SERVER public network IP address for the service provided by the APP CLIENT, it should report these IP addresses to the DPI SERVER for the subsequent fourth step In the DPI feature recognition stage, DPI network elements strengthen the accuracy of feature recognition. In one embodiment, these IP addresses can be described in the form of "include" and "exclude from inclusion" through multiple groups/pairs. For example, taking IPv4 as an example, it can be described as including X1.X2. IP addresses in the range from X3.X4 to Y1.Y2.Y3.Y4, and exclude IP addresses in the range from M1.M2.M3.M4 to N1.N2.N3.N4, and include or exclude the description The content can be one or more address ranges.

In one embodiment, the APP SERVER update response message includes the legal range of the multi-interval counter allocated by the DPI SERVER. In an embodiment, the value range of the multi-interval counter can be a positive integer (denoted as MAX64) starting from 1 to a maximum of 64 bits (8 bytes). The legal range of the multi-interval counter can be one or more ranges from 1 to MAX64.

For example, the APP SERVER update response message contains MAC key and MAC algorithm information. In one embodiment, the MAC algorithm can use the HMAC algorithm (RFC 2104), and the algorithm description format in this message can be "HMAC-MD5", "HMAC-SHA1", "HMAC-SHA224", "HMAC-SHA256" , "HMAC-SHA384", "HMAC-SHA512", etc.

S103, the DPI feature update stage. As shown in the third step in Figure 1, the DPI SERVER receives the TLS connection establishment request initiated by the DPI network element, and uses the mutual certificate verification mechanism to establish the TLS connection. The DPI SERVER receives and processes the DPI feature update request initiated by the DPI network element, and provides the DPI network element with the latest DPI feature information of the APP through the corresponding DPI feature update response.

In one embodiment, the DPI feature update response message includes: APP name, SP name, APP SERVER name, dedicated TLS extension type ID, APP TOKEN, date and time of successful APP TOKEN allocation, APP SERVER public network IP address (optional) , App SERVER public key used for DPI identification, legal range of multi-interval counter, MAC key, MAC algorithm and other information.

In one embodiment, the TLS connection between the DPI network element and the DPI SERVER adopts a two-way certificate verification mechanism, which increases the difficulty and cost of traffic fraud. As a TLS client, the DPI network element sends its own certificate to the DPI SERVER through an uplink CERTIFICATE message, and the DPI SERVER as a TLS server sends its own certificate to the DPI network element through a downlink CERTIFICATE message. The DPI SERVER certificate must be issued by a third-party legal CA to ensure that the DPI network element can verify the legal identity of the DPI SERVER through the certificate. The certificate of the DPI network element can be issued by the DPI SERVER as a private CA for the DPI network element, and is preset in the DPI network element as the legal identity certificate of the DPI network element.

In one embodiment, the DPI network element periodically sends a DPI feature update request message to the DPI SERVER through a TLS connection with the DPI SERVER to obtain the latest identification feature information of each APP in the DPI SERVER.

In one embodiment, the DPI SERVER sends the identification feature information of each APP whose relevant information has been updated after the last DPI network element request, to the DPI network element through a DPI feature update response message. In one embodiment, the DPI SERVER puts each APP TOKEN or "SP name + APP name" that has not been updated since the last DPI network element request into a message and sends it to the DPI network element.

In one embodiment, in the DPI feature update request message sent by the DPI network element, one or more APP TOKEN or "SP name + APP name" may be specified or excluded. Correspondingly, the DPI feature update response message sent by the DPI SERVER only carries the latest identification feature information of the corresponding APP.

S104, DPI feature recognition stage. As shown in the fourth step in Figure 1, the DPI network element detects the specified extension type and content in the CLIENT HELLO and SERVER HELLO messages in the APP Internet traffic, matches the APP TOKEN and verifies the APP SERVER signature and MAC to confirm the authenticity of the APP traffic , So as to accurately identify APP business traffic.

In one embodiment, the CLIENT HELLO message sent by the APP CLIENT in the APP service traffic includes: the previously allocated dedicated TLS extension type ID and the content is empty. The SERVER HELLO message sent by the APP SERVER in the APP business traffic contains: the previously allocated special TLS extension type ID, the extension content includes the APP TOKEN, the date and time of the successful allocation of the APP TOKEN, and a multi-section within the legal range of the multi-section counter Counter value, signature of the extended content of the previous part, signature algorithm, MAC value of the extended content of the previous part, MAC algorithm and other information.

In one embodiment, the CLIENT HELLO message sent by the APP CLIENT includes a custom TLS extension whose extension type ID is the special TLS extension type ID allocated during the first step of APP registration, and its extension content is empty.

In one embodiment, the SERVER HELLO message sent by APP SERVER contains a custom TLS extension whose extension type ID is the special TLS extension type ID allocated during the first step of APP registration. The extension content is as follows:

In one embodiment, the extended content 1: APP TOKEN. The APP TOKEN comes from the first stage of APP registration.

In one embodiment, the extended content 2: the date and time when the APP TOKEN is successfully allocated. The date and time information comes from the first step of APP registration.

In one embodiment, the extended content 3: a multi-interval counter value within the legal range of the multi-interval counter. The legal range of the multi-interval counter comes from the second step of APP SERVER update phase. In one embodiment, for the same APP CLIENT user (identified by IP address), the APP SERVER is within the legal range of the multi-interval counter, and the value is from small to large. For each TLS connection SERVER HELLO message, its multi-interval counter The value is increased by 1, and after reaching the maximum value of the multi-interval counter, it will wrap around to the minimum value and start again.

In one embodiment, extended content 4: a signature for the entire extended content 1 to extended content 3. APP SERVERr uses the signature algorithm of the extended content 5 to sign the entire extended content 1 to the extended content 3. In one embodiment, the content is first hashed to obtain a fixed-length hash result, and then the hash result is used for the APP SERVER public key generated in the second step of the APP SERVER update phase for DPI identification. The private key is encrypted, and the result of the encryption is the signature.

In one embodiment, extended content 5: signature algorithm. The signature algorithm is determined by APP SERVER, including hash algorithm and public key encryption algorithm. In one implementation, such as "MD5-RSA", "SHA1-RSA", "SHA224-RSA", "SHA256-RSA", " One of "SHA384-RSA", "SHA512-RSA", etc.

In one embodiment, extended content 6: the MAC value of the entire extended content 1 to extended content 5. APP SERVER adopts the MAC algorithm of extended content 7, and uses the MAC key obtained from DPI SERVER in the second step of APP SERVER update stage to generate a MAC value for the entire extended content 1 to 5.

In one embodiment, extended content 7: MAC algorithm. The MAC algorithm is determined by the APP SERVER, and one of the multiple MAC algorithms allocated by the DPI SERVER in the second step of the APP SERVER update phase is selected for use.

In one embodiment, the DPI network element detects whether the CLIENT HELLO message in the TLS traffic contains the relevant dedicated TLS extension type ID. If it does, it needs to continue the SERVER HELLO for the TLS-TCP (Transmission Control Protocol) flow The message is further checked; if it is not included, there is no need to continue to check the SERVER HELLO message of the TLS-TCP stream.

In one embodiment, the DPI network element detects whether the SERVER HELLO message in the TLS traffic contains the relevant dedicated TLS extension type ID, and if it does, it will continue to check and verify the extension content; if it does not, it does not need to continue to do so. The extended content is further tested and verified. In one embodiment, the method for detecting and verifying the extended content by the DPI network element is as follows:

In one embodiment, the DPI network element extracts extended content 1 as the APP TOKEN. If the subsequent verification is passed, the APP TOKEN is identified as the corresponding APP, that is, the current TLS traffic is accurately identified as the corresponding APP service.

In one embodiment, the DPI network element extracts the extended content 2 as the date and time for successfully assigning the APP TOKEN. On the one hand, it can be used to verify the uniqueness of the APP TOKEN, and on the other hand, it can be used to describe the APP TOKEN version information.

In an embodiment, the DPI network element extracts the extended content 3 as the multi-interval counter value. The DPI network element detects whether the multi-interval counter value is within the legal range of the multi-interval counter. If it is within the legal range, check the multiple intervals of SERVER HELLO messages for different TLS flows of the same APP CLIENT user (distinguated by the user side IP address) under the same APP SERVER (distinguished by the network side IP address + network side PORT) Whether the counter value is incremented or reaches the maximum value and rewinds, if it is incremented or reaches the maximum rewind, the multi-interval counter value is deemed to pass the check, otherwise it is deemed to fail the check. If it is not within the legal scope, it is also deemed to have failed the inspection. The legal value check of the multi-range counter is used to prevent traffic fraud based on replay attacks.

In one embodiment, the DPI network element extracts the extended content 4 as the APP SERVER's signature for the entire extended content 1 to the extended content 3; the DPI network element uses the extended content 1 to the extended content 3 as a whole, using the extracted content from the extended content 5. The signature algorithm, and the APP SERVER public key for DPI identification obtained in the DPI feature update phase of the third step, verify the signature. In one embodiment, the signature algorithm extracted from the extended content 5 includes a hash algorithm and a public key encryption algorithm. The hash algorithm is used to hash the entire extended content 1 to 3 to obtain the hash result; The key encryption algorithm uses the APP SERVER public key for DPI identification obtained in the third step of the DPI feature update stage to decrypt the extended content 4 to obtain the decryption result; if the hash result is consistent with the decryption result, it is considered passed Signature verification; otherwise, it is considered that the signature verification has not passed. The extended signature verification is used to verify the legitimacy of the APP SERVER's identity to reduce or prevent traffic fraud.

In one embodiment, the DPI network element extracts the extended content 5 as a signature algorithm for verifying the extended content 4.

In one embodiment, the DPI network element extracts the extended content 6 as the MAC value of the APP SERVER for the entire extended content 1 to the extended content 5; the DPI network element uses the extended content 1 to the extended content 5 as a whole to extract from the extended content 7 to The MAC algorithm and the MAC key obtained from the DPI feature update phase in the third step are calculated to generate the MAC value; if the generated MAC value is consistent with the extracted MAC value, the MAC check is considered passed, otherwise the MAC check is not considered by. The extended MAC check is used to ensure the integrity of the extended content and reduce the possibility of traffic fraud.

In an embodiment, the DPI network element extracts the extended content 7 as a MAC algorithm for verifying the extended content 6.

In an embodiment, the DPI network element can identify the APP TOKEN that has passed the multi-interval counter check, signature verification, and MAC verification as the corresponding APP, that is, accurately identify the current TLS traffic as the corresponding APP service.

In one embodiment, in the case of accurately identifying APP services described above, if the DPI network element obtains the APP SERVER public network IP address from the DPI feature update stage in the third step, it can check the network side of the current TLS-TCP flow Whether the IP address is within the range of the APP SERVER public network IP address, if it is, the accuracy of the identification result can be enhanced.

As shown in FIG. 2, an embodiment of the present disclosure also provides a TLS encrypted traffic characteristic information management device, including: an APP registration management module 201 set in the DPI SERVER 200. The APP registration management module receives APP registration request information from the registration website, assigns APP characteristic identification information to the target APP, and sends it back to the registration website. The APP SERVER installed in the DPI SERVER 200 updates the management module 202. The APP SERVER update management module exchanges the APP feature verification information of the APP with the APP SERVER based on a two-way verification TLS connection. After the exchange, both parties have the same APP feature identification information and APP feature verification information. The DPI feature update management module 203 set in the DPI SERVER 200. The DPI feature update management module sends the APP feature identification information and APP feature verification information of the APP to the DPI network element based on the TLS connection of mutual verification.

As shown in FIG. 3, an embodiment of the present disclosure also provides a server 300, which includes a memory 301, a processor 302, a bus interface 303, a user interface 304, and an output interface 305. The processor 302 executes the TLS encrypted traffic identification method.

The present disclosure can realize the precise and detailed DPI identification for anti-fraud of the application service TLS encrypted traffic of the telecommunications operator's cooperative SP, thereby reducing or preventing the occurrence of traffic fraud.

The present disclosure is not limited to the above embodiments, and all equivalent changes made in accordance with the scope of the claims of the present disclosure fall within the scope of the claims of the present disclosure.

A person of ordinary skill in the art can understand that all or some of the steps, functional modules/units in the system, and apparatus in the methods disclosed above can be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may consist of several physical components. The components are executed cooperatively. Some or all components may be implemented as software executed by a processor, such as a digital signal processor or a microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on a computer-readable medium, and the computer-readable medium may include a computer storage medium (or non-transitory medium) and a communication medium (or transitory medium). As is well known to those of ordinary skill in the art, the term computer storage medium includes volatile and non-volatile memory implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Flexible, removable and non-removable media. Computer storage media include but are not limited to RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassette, tape, magnetic disk storage or other magnetic storage device, or Any other medium used to store desired information and that can be accessed by a computer. In addition, as is well known to those of ordinary skill in the art, communication media usually contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as carrier waves or other transmission mechanisms, and may include any information delivery media .

Claims

A method for identifying TLS encrypted traffic, including:

DPI SERVER receives APP registration request information from the registration website, assigns APP feature identification information to the target APP, and sends it back to the registration website;

DPI SERVER exchanges the APP feature verification information of the target APP with the APP SERVER based on a two-way verification TLS connection. After the exchange, both parties have the same APP feature identification information and APP feature verification information;

DPI SERVER sends the APP feature identification information and APP feature verification information of the target APP to the DPI network element based on the TLS connection with mutual verification;

The DPI network element verifies the validity of the APP characteristic identification information in the user's TLS traffic according to the APP characteristic verification information, and identifies the TLS traffic generated by the target APP according to the APP characteristic identification information.
8. The method of claim 1, wherein the APP feature verification information includes APP public key information, MAC key and MAC algorithm information used for DPI identification, and legal range information of a multi-interval counter.
The method according to claim 2, wherein, in the TLS connection established between the DPI SERVER and the APP SERVER, the certificate of the APP SERVER and the certificate of the DPI SERVER are both issued by a legal third-party certification authority.
The method according to claim 3, wherein the DPI network element matches the APP feature identification information in the SERVER HELLO message in the user APP flow information to identify the flow information of the corresponding APP.
The method according to claim 4, wherein the DPI network element verifies the validity of the corresponding APP characteristic identification information according to the APP characteristic verification information in the SERVER HELLO message in the user APP flow information.
A TLS encrypted flow characteristic information management device, including:

The APP registration management module placed in DPI SERVER is used to receive APP registration request information from the registration website, and assign APP characteristic identification information to the target APP, and send it back to the registration website;

The APP SERVER update management module placed in the DPI SERVER exchanges the APP feature verification information of the target APP with the APP SERVER based on the TLS connection of mutual verification. After the exchange, both parties have the same APP feature identification information and APP feature verification information;

The DPI feature update management module placed in the DPI SERVER sends the APP feature identification information and APP feature verification information of the target APP to the DPI network element based on the TLS connection with mutual verification.
7. The device of claim 6, wherein the APP feature verification information includes APP public key information, MAC key and MAC algorithm information used for DPI identification, and legal range information of a multi-interval counter.
The device according to claim 7, wherein in the TLS connection established between the APP SERVER update management module and the APP SERVER, the certificate of the APP SERVER and the certificate of the DPI SERVER are both issued by a legal third-party certification authority.
A server, comprising: a memory, a processor, and a computer program stored on the memory and capable of running on the processor, wherein the processor executes the program as described in any one of claims 1-8 TLS encrypted traffic identification method.