CN101141243A - A device and method for performing security inspection and content filtering on communication data - Google Patents

Abstract

The present invention proposes a device for checking and filtering communication data, which is used for security checking and content filtering for the connection data sent between the client and the server, which includes: an SSL/TLS proxy server for The SSL/TLS protocol encrypted data sent by the client/server is decrypted into plaintext and sent to the security check and content filtering device, and the plaintext data processed by the security check and content filtering device is encrypted into SSL/TLS data and sent to the server End/client; security inspection and content filtering device, connected with SSL/TLS proxy server, used to accept and check plaintext data, if security threats are found, the threat data will be filtered, and the processed plaintext data Returning to the SSL/TLS proxy server, in addition, the present invention also proposes a method for checking and filtering communication data by using the above-mentioned device, which can effectively reduce or even eliminate malicious attackers' network attacks and security through protocols based on SSL/TLS encryption. threaten.

Description

A device and method for performing security inspection and content filtering on communication data

technical field

The invention relates to the field of information security, in particular to a device and method for performing security inspection and content filtering on communication data.

Background technique

In the prior art, the SSL/TLS encrypted connection between the client and the server is directly connected, as shown in Figure 1, the data transmitted between the client 110 and the server 120 is always encrypted, without plaintext Appear. for encrypted data. Security inspection and content filtering devices analyze and process data directly. Since protocols based on SSL/TLS (Secure Sockets Layer/Transport Layer Security, Secure Sockets Layer/Transport Layer Security) (such as HTTPS (Hyper Text Transfer Protocol over SSL/TLS), SMTPS (Short Message Transmission Protocol over SSL/TLS ), IMAPS (Internet Message Access Protocol over SSL/TLS), POP3S (Post Office Protocol version 3 over SSL/TLS), etc.), the communication data is encrypted, so security inspection and content filtering equipment cannot process this data. As a result, the client is vulnerable to network attacks and security threats carried out through the SSL/TLS communication tunnel, these attacks and threats include: 1) network attacks and virus propagation aimed at browser vulnerabilities through HTTPS, and phishing attacks (Phishing ); 2) Spreading of spam (Spam) through SMTPS/POP3S/IMAPS, these spam are likely to carry viruses and Phishing attack scripts; 3) reverse gateway access policy violation in SSL/TLS communication tunnel Connection problems; 4) other possible attacks.

Contents of the invention

In order to solve the above problems, the object of the present invention is to provide a device and a method for performing security checks and content filtering on communication data based on SSL/TLS encryption at the gateway, thereby reducing or even eliminating malicious attackers through SSL/TLS encryption. Network attacks and security threats by advanced protocols (such as HTTPS, IMAPS, SMTPS, POP3S, etc.).

In order to achieve the above object, the present invention proposes a device for performing security inspection and content filtering on communication data, which is used to perform security inspection and content filtering on the connection data sent between the client and the server, including:

The SSL/TLS proxy server is used to decrypt the SSL/TLS protocol encrypted data sent by the client/server into plain text, send it to the security check and content filtering device, and process the security check and content filtering device The plaintext data is encrypted as SSL/TLS data and sent to the server/client;

A security inspection and content filtering device, connected to the SSL/TLS proxy server, used to accept and check the plaintext data, if a security threat is found, filter the threatening data, and return the processed plaintext data The SSL/TLS proxy server.

The above-mentioned device for performing security inspection and content filtering on communication data, wherein the SSL/TLS proxy server further includes:

The client communication module is respectively connected with the client and the security check and content filtering device, and is used to accept the SSL/TLS protocol encrypted data sent by the client, and decrypt it as plaintext data and send it to the security check and content filter device; and

It is used to accept the plaintext data sent from the security inspection and content filtering device, encrypt the plaintext data with SSL/TLS protocol, and send the plaintext data to the client.

The above-mentioned device for performing security inspection and content filtering on communication data, wherein the SSL/TLS proxy server further includes:

The server-side communication module is connected to the server-side and the security check and content filtering device respectively, and is used to accept the SSL/TLS protocol encrypted data sent by the server-side, and decrypt it as plaintext data and send it to the security check and content filter device; and

It is used for accepting the plaintext data sent from the security inspection and content filtering device, encrypting the plaintext data with SSL/TLS protocol and sending it to the server.

The above-mentioned device for performing security inspection and content filtering on communication data further includes:

The gateway is connected to the client, the server, and the SSL/TLS proxy server respectively, and is used to send the encrypted data to the SSL/TLS protocol encrypted data when the communication data sent by the client is SSL/TLS protocol encrypted data. TLS proxy server, and accept the SSL/TLS protocol encrypted data processed by the security check and content filtering device from the SSL/TLS proxy server, and then forward it to the server; and

Used to send the encrypted data to the SSL/TLS proxy server when the communication data sent by the server is SSL/TLS protocol encrypted data, and accept the security check from the SSL/TLS proxy server The SSL/TLS protocol encrypted data processed by the content filtering device is forwarded to the client.

The above-mentioned device for performing security inspection and content filtering on communication data further includes:

A digital certificate analysis device, configured to receive the digital certificate in the SSL/TLS connection data sent by the SSL/TLS proxy server, and determine whether the digital certificate belongs to the digital certificate whitelist, or belongs to the digital certificate blacklist, or is Unknown digital certificate.

The above-mentioned device for performing security inspection and content filtering on communication data, wherein the digital certificate analysis device further includes:

The digital certificate database is used to store digital certificates in a digital certificate blacklist and a digital certificate whitelist respectively.

The above-mentioned device for performing security inspection and content filtering on communication data further includes:

A Uniform Resource Locator analyzing device, configured to determine whether the Uniform Resource Locator in the SSL/TLS protocol connection data sent by the client to the server belongs to the Uniform Resource Locator white list, or whether it belongs to the Uniform Resource Locator black list. list of lists, or is an unknown URL.

In the above-mentioned device for performing security inspection and content filtering on communication data, the said uniform resource locator analysis device further includes:

The uniform resource locator database is used to store the uniform resource locator list by using the uniform resource locator blacklist and the uniform resource locator whitelist.

The above-mentioned device for performing security inspection and content filtering on communication data, wherein the SSL/TLS proxy server, security inspection and content filtering device, digital certificate analysis device and/or uniform resource locator analysis device are set in the gateway .

In order to achieve the above object, the present invention also proposes a method for performing security inspection and content filtering on communication data, which includes the following steps:

Step 1, the client/server sends SSL/TLS protocol encrypted data to the SSL/TLS proxy server;

Step 2, the SSL/TLS proxy server decrypts the SSL/TLS protocol encrypted data into plaintext data and sends it to the security inspection and content filtering device;

Step 3, the security inspection and content filtering device performs a security inspection on the plaintext data, and when a security threat is found, the threatening data is filtered, and the filtered plaintext data is sent to the SSL/TLS proxy server;

Step 4, the SSL/TLS proxy server encrypts the processed plaintext data into SSL/TLS protocol encrypted data, and sends it to the server/client.

In the above-mentioned method for performing security inspection and content filtering on communication data, when the client and the server are connected to each other through a gateway, the step 1 further includes:

Step 111, the client/server sends connection data to the gateway;

Step 112, the gateway judges whether the data conforms to the access policy, if so, proceeds to step 113, and if not, rejects the connection;

Step 113, the gateway judges whether the data is SSL/TLS protocol encrypted data, if so, then sends the SSL/TLS protocol encrypted data to the SSL/TLS proxy server, if not, then sends the data directly sent to the server/client.

The above-mentioned method for performing security inspection and content filtering on communication data, wherein, when the client and the server perform data connection through a gateway, after step 1, further include:

Step 121, the SSL/TLS proxy server sends the digital certificate in the SSL/TLS protocol connection data to a digital certificate analysis device, and the digital certificate analysis device judges whether the digital certificate belongs to a digital certificate white list or belongs to a digital certificate. Certificate blacklist or unknown digital certificate;

Step 122, if it belongs to the digital certificate whitelist, then the SSL/TLS proxy server directly connects the client to the server, if it belongs to the digital certificate blacklist, then the SSL/TLS proxy server prevents all If the connection between the client and the server is an unknown digital certificate, then enter step 2.

The above-mentioned method for performing security inspection and content filtering on communication data, wherein, after step 1, further includes:

Step 131, the SSL/TLS proxy server sends the URL in the SSL/TLS protocol connection data to the URL analyzing device, and the URL analyzing device judges whether the URL belongs to Uniform resource locator whitelist or belonging to the uniform resource locator blacklist or unknown URL;

Step 132, if it belongs to the uniform resource locator whitelist, then the SSL/TLS proxy server directly connects the client to the server, if it belongs to the uniform resource locator blacklist, the SSL/TLS The proxy server prevents the connection between the client and the server, and if it is an unknown uniform resource locator, go to step 2.

In the above-mentioned method for performing security inspection and content filtering on communication data, the SSL/TLS protocol encrypted data includes: HTTPS data, IMAPS data, SMTPS data and/or POP3S data.

The above-mentioned method for performing security inspection and content filtering on communication data, wherein, when the encrypted data of the SSL/TLS protocol is HTTPS data, the step 3 further includes: performing webpage filtering and anti-virus on the decrypted data , processing steps of intrusion detection, anti-phishing and/or access policy checking;

When the SSL/TLS protocol encrypted data is IMAPS, SMTPS or POP3S data, the step 3 further includes: performing anti-spam, anti-virus and/or access policy check on the decrypted data.

The present invention realizes security inspection and content filtering on the communication data encrypted by SSL/TLS at the gateway, thereby reducing or even eliminating malicious attackers through protocols based on SSL/TLS encryption (such as HTTPS, IMAPS, SMTPS, POP3S, etc.) Network attacks and security threats, these attacks and threats include: 1) network attacks and virus transmission against browser vulnerabilities through HTTPS, and phishing attacks (Phishing); 2) spam ( Spam), these spam are likely to carry viruses and Phishing attack scripts; 3) The problem of reverse connection that violates the gateway access policy in the SSL/TLS communication tunnel; 4) Other possible attacks.

Description of drawings

Fig. 1 is a schematic diagram of an SSL/TLS encrypted connection in the prior art;

Fig. 2 is the structural representation of the first embodiment of the present invention;

Fig. 3 is the structural representation of the second embodiment of the present invention;

Fig. 4 is a schematic diagram of the workflow of the second embodiment of the present invention;

Fig. 5 is a schematic structural view of a third embodiment of the present invention;

Fig. 6 is a schematic workflow diagram of the third embodiment of the present invention;

7 is a schematic structural view of a fourth embodiment of the present invention;

Fig. 8 is a schematic diagram of the workflow of the fourth embodiment of the present invention.

Detailed ways

Specific embodiments of the present invention will be described below in conjunction with the accompanying drawings.

Fig. 2 is a schematic structural diagram of the first embodiment of the present invention. As shown in the figure, the client 110 sends SSL/TLS protocol encrypted data to the client communication module 131 in the SSL/TLS proxy server 130, and the client communication module 131 decrypts the SSL/TLS protocol encrypted data into plaintext data and sends it to the security Inspection and content filtering device 140, safety inspection and content filtering device 140 carry out security inspection to this plaintext data, will filter out the content of threat, or directly return disconnection instruction, the plaintext data of checking and filtering, be checked and The content filtering device sends it to the server-side communication module 132 , and the server-side communication module 132 encrypts the filtered plaintext data into ciphertext data according to the SSL/TLS protocol, and sends it to the server side 120 .

In the same way, when the server end 120 sends SSL/TLS protocol encrypted data to the client 110, first, the data is sent to the server end communication module 132 in the SSL/TLS proxy server 130, and after being decrypted into plaintext data, it is sent to the secure Inspection and content filtering device 140, the security inspection and content filtering device 140 performs a series of checks on the plaintext data, and filters threatening data, or directly returns an instruction to refuse connection, and sends the plaintext data after checking and filtering to the client The terminal communication module 132 encrypts the plaintext data into ciphertext data with the SSL/TLS protocol, and sends it to the client 110.

Fig. 3 is a schematic structural diagram of the second embodiment of the present invention. As shown in FIG. 3 , it includes an SSL/TLS proxy server 130 , a security checking and content filtering device 140 and a digital certificate analyzing device 150 .

The SSL/TLS proxy server 130 is used to proxy the SSL/TLS connection between the client 110 and the server 120, and forwards the digital certificate in the SSL/TLS connection data sent by the client 110 to the server 120 to the digital certificate analysis device 150 , and decrypt the SSL/TLS connection data.

The digital certificate analysis device 150 also includes a digital certificate database 151, which is used to store data certificates, and classify and store digital certificates in two lists, namely a digital certificate blacklist and a digital certificate whitelist. The trusted digital certificates are listed in the digital certificate whitelist, and the digital certificates of known malicious websites are listed in the digital certificate blacklist. The digital certificate analyzing device 150 is used for judging whether the digital certificate forwarded by the SSL/TLS proxy server 130 belongs to the digital certificate whitelist or the digital certificate blacklist, and returns the analysis result to the SSL/TLS proxy server 130 . If the above-mentioned digital certificate belongs to the digital certificate white list, then the SSL/TLS proxy server 130 will directly connect the client 110 to the server 120, and no longer perform encryption, decryption and security checks; if the above-mentioned digital certificate belongs to the digital certificate blacklist list, then the SSL/TLS proxy server 130 will prevent the connection between the client 110 and the server end 120; if the above-mentioned digital certificate is an unknown certificate, that is, it is neither in the digital certificate whitelist nor in the digital certificate blacklist , the SSL/TLS proxy server 130 sends the decrypted plaintext data to the security checking and content filtering device 140 .

The security checking and content filtering device 140 is used for checking and processing security threats in the plaintext data sent by the SSL/TLS proxy server 130 .

Fig. 4 is the system flow chart of the second embodiment of the present invention, as shown in Fig. 4, the method for security inspection and content filtering to the security threat in the SSL/TLS communication tunnel provided by the present invention comprises the following several steps:

Step S401, the client 110 sends SSL/TLS connection data to the server 120;

Step S402, the SSL/TLS proxy server 130 forwards the digital certificate in the SSL/TLS connection data to the digital certificate analysis device 150;

Step S403, the digital certificate analyzing device 150 compares the digital certificate sent by the SSL/TLS proxy server 130 with the digital certificate stored in the digital certificate database 151, if the digital certificate sent by the SSL/TLS proxy server 130 belongs to digital certificate whitelist list, then perform step S404; if the digital certificate sent by the SSL/TLS proxy server 130 belongs to the digital certificate blacklist list, then perform step S405; if the digital certificate sent by the SSL/TLS proxy server 130 is an unknown digital certificate, that is, it is neither in the digital certificate whitelist nor in the digital certificate blacklist, then execute step S406;

Step S404, the SSL/TLS proxy server 130 directly connects the client 110 to the server 120, and no longer performs encryption, decryption and security checks;

Step S405, the SSL/TLS proxy server 130 prevents the client 110 from connecting to the server 120;

Step S406, the SSL/TLS proxy server 130 converts the SSL/TLS connection into a connection from the client 110 to itself, and decrypts the SSL/TLS connection data into plaintext data, and then sends the decrypted plaintext data to the security check and content Filtration device 140;

Step S407, safety inspection and content filtering device 140 carry out safety inspection and content filtering to the plaintext data sent by SSL/TLS proxy server 130, including at least one of the following methods: web page filtering (Web Filter), anti-virus (Anti-Virus) , Intrusion Detection and Protection (IDS/IPS), Anti-Fishing (Anti-Fishing) and Access Policy (Access Policy) inspection, etc. If it is found that there is a security threat in the plaintext data, the security check and content filtering device 140 can disconnect the connection and notify the client 110 or delete the threatening data;

Step S408, after the security inspection and content filtering device 140 checks and processes, the above-mentioned plaintext data is sent back to the SSL/TLS proxy server 130, and the SSL/TLS proxy server 130 encrypts the above-mentioned plaintext data, and then replaces the client 110 to the server 120 send SSL/TLS connection data;

Step S409 , after receiving the above SSL/TLS connection data, the server 120 returns reply data to the SSL/TLS proxy server 130 , and the SSL/TLS proxy server 130 forwards the above reply data to the client 110 .

In the above process, the SSL/TLS proxy server 130 divides the connection from the client 110 to the server end 120 into two parts, one part is the connection from the client 110 to the SSL/TLS proxy server 130, and the other part is the SSL/TLS proxy server 130. To the connection to the server end 120, the above two connections are all SSL/TLS encrypted.

FIG. 5 is a schematic structural diagram of the third embodiment of the present invention. As shown in the figure, the client 110 in the internal network performs an SSL/TLS connection with the server 120 in the external network through the gateway 160 . The gateway 160 is connected to the SSL/TLS proxy server 130 , and the SSL/TLS proxy server 130 is connected to the security checking and content filtering device 140 . When the gateway 160 receives the connection data sent by the server 120/client 110, it will first judge whether the connection data conforms to the access policy, if not, then terminate the connection, if it does, then further judge whether the connection data belongs to SSL /TLS protocol encrypted data, if it does not belong, then it is directly sent to the client 110/server end 120, if it belongs, then the SSL/TLS protocol encrypted data is sent to the SSL/TLS proxy server 130 for decryption processing, and then through After the processing of the security check and content filtering device, and the re-encryption by the SSL/TLS proxy server 130, the processed SSL/TLS protocol decrypted data is sent back to the gateway 160, and then sent to the client 110/server 120 by the gateway 160.

Fig. 6 is a schematic workflow diagram of the third embodiment of the present invention. As shown in Figure 6, take the client 110 of the internal network to send connection data to the server 120 of the external network as an example, as shown in the figure, specifically include:

Step S601, the intranet client 110 sends connection data to the gateway 160;

Step S602, the gateway 160 checks whether the connection complies with its access policy, and for connection data that does not conform to the access policy, proceed to step S603, and for connection data that conforms to the access policy, proceed to step S604;

Step S603, the gateway 160 rejects the connection initiated by the client 110;

Step S604, the gateway 160 checks whether the connection data is SSL/TLS protocol decrypted data, if not, then enters step S605, if so, then enters step S606;

Step S605, the gateway 160 directly forwards the connection data to the server 120;

Step S606, the gateway 160 sends the SSL/TLS protocol encrypted data to the SSL/TLS proxy server 130, the SSL/TLS proxy server 130 proxies the connection, and the SSL/TLS proxy server 130 processes the connection. It converts the connection request from the client 110 to the server 120 into connection data from the client 110 to itself, and then sends the connection data to the security inspection and content filtering device 140, and decrypts the encrypted data sent to plaintext data for transmission. to the security checking and content filtering means 140;

Step S607 , the security checking and content filtering device 140 processes the plaintext data sent by the SSL/TLS proxy server 130 . When the plaintext data is HTTPS protocol, the processing that can be performed includes web filter (Web Filter), anti-virus (Anti-Virus), intrusion detection (IDS/IPS), anti-phishing (Anti-Phishing) and access policy (Access Policy) Check, when the plaintext data is IMAPS, SMTPS or POP3S protocol, the processing that can be performed includes anti-spam (Anti-Spam), anti-virus (Anti-Virus), and access policy (Access Policy) checks. If a security threat is found in the connected data, the security inspection and content filtering device can choose to disconnect the connection and notify the user, or delete the threatening data;

Step S608, the security inspection and content filtering device 140 returns the processed plaintext data to the SSL/TLS proxy server 130, and the SSL/TLS proxy server 130 encrypts the plaintext data, and then converts the plaintext data into SSL/TLS proxy server 130 and sends it to the server end 120 and send the connection data back to the gateway 160;

In step S609, the gateway 160 sends the SSL/TLS encrypted data to the server 120 on the external network.

The server 120 receives the data. From the perspective of the server 120, the data is sent by the SSL/TLS proxy server 130, so it returns a reply data to the SSL/TLS proxy server 130. This data returns to the client 110 using the intranet along the path sent above, that is, along the path: server end 120->gateway 160->SSL/TLS proxy server 130->security inspection and content filtering device 140-> SSL/TLS proxy server 130 -> gateway 160 -> client 110.

In this process, the role of the SSL/TLS proxy server 130 is to divide the original connection from the client 110 to the server 120 into two parts, one part is the connection from the client 110 to the SSL/TLS proxy server 130, and the other is the SSL /TLS proxy server 130 to server end 120 connection. Both connections are SSL/TLS encrypted. But the data between these two connections, that is, the data sent by the SSL/TLS server 130 to the security checking and content filtering device 140 and the returned data are all unencrypted plaintext.

Fig. 7 is a schematic structural diagram of a fourth embodiment of the present invention. As shown in FIG. 7 , this embodiment includes an SSL/TLS proxy server 130 , a security check and content filtering device 140 , and a digital certificate analyzing device 150 , and also includes a URL (Uniform Resource Locator) analyzing device 170 .

Also comprise URL database 171 in the URL (uniform resource locator) analysis device 170, this URL database 171 is used for storing URL list, and URL list classification is stored in two lists, is respectively URL blacklist list and URL whitelist list . Trusted URLs are listed in the URL whitelist, and known malicious URLs are listed in the URL blacklist. The URL analysis device 170 judges whether the URL in the SSL/TLS connection data sent from the client 110 to the server 120 belongs to the URL whitelist or the URL blacklist according to the URL list stored in the URL database 171 . If the above-mentioned URL belongs to the URL whitelist, then the client 110 will be directly connected to the server 120, and no longer perform work such as encryption, decryption and security checks; if the above-mentioned URL belongs to the URL blacklist, then the client 110 is prevented from connecting with the server If the above-mentioned URL is an unknown URL, that is, it is neither in the URL whitelist nor in the URL blacklist, then the HTTPS connection data sent by the client 110 to the server 120 is sent to the SSL/ TLS proxy server 130 .

The SSL/TLS proxy server 130 forwards the digital certificate in the SSL/TLS connection data sent by the client 110 to the server 120 to the digital certificate analysis device 150, and decrypts the SSL/TLS connection data.

The digital certificate analysis device 150 also includes a digital certificate database 151, which is used to store data certificates, and classify and store digital certificates in two lists, namely a digital certificate blacklist and a digital certificate whitelist. The trusted digital certificates are listed in the digital certificate whitelist, and the digital certificates of known malicious websites are listed in the digital certificate blacklist. The digital certificate analyzing device 150 is used for judging whether the digital certificate forwarded by the SSL/TLS proxy server 120 belongs to the digital certificate whitelist or the digital certificate blacklist, and returns the analysis result to the SSL/TLS proxy server 130 . If the above-mentioned digital certificate belongs to the digital certificate white list, then the SSL/TLS proxy server 130 will directly connect the client 110 to the server 120, and no longer perform encryption, decryption and security checks; if the above-mentioned digital certificate belongs to the digital certificate blacklist list, then the SSL/TLS proxy server 130 will prevent the connection between the client 110 and the server end 120; if the above-mentioned digital certificate is an unknown certificate, that is, it is neither in the digital certificate whitelist nor in the digital certificate blacklist , the SSL/TLS proxy server 130 sends the decrypted plaintext data to the security checking and content filtering device 140 .

The security checking and content filtering device 140 is used for checking and processing security threats in the plaintext data sent by the SSL/TLS proxy server 130 . Safety inspection and content filtering device 140 comprise one or more in the following devices: web page filtering (Web Filter) device, is used for shielding webpage, as shielding lottery website, pornographic website, banner etc.; Anti-virus (Anti-Virus) device , used to detect and remove viruses in data; intrusion detection and prevention (IDS/IPS) devices, used to detect and protect network intrusions, such as hackers attacking systems through the network; anti-phishing (Anti-Fishing) devices, used Used to eliminate identity theft and fraud in the form of phishing; and access policy (Access Policy) inspection device to prevent unauthorized access to the network.

Fig. 8 is a system flow chart of the fourth embodiment of the present invention. As shown in Fig. 8, the method for performing security inspection and content filtering on SSL/TLS communication data provided by the present invention includes the following steps:

Step S801, the URL analysis device 170 judges whether the URL in the SSL/TLS connection data sent by the client 110 to the server 120 belongs to the URL whitelist or the URL blacklist according to the URL list stored in the URL database 171; Belong to the URL whitelist list, then perform step S802; If the above-mentioned URL belongs to the URL blacklist list, then perform step S803; if the above-mentioned URL is an unknown URL, that is, it is neither in the URL whitelist list nor in the URL blacklist list , execute step S804;

In step S802, the client 110 is directly connected to the server 120, and encryption, decryption and security check are no longer performed;

Step S803, preventing the connection between the client 110 and the server 120;

Step S804, sending the SSL/TLS connection data sent by the client 110 to the server 120 to the SSL/TLS proxy server 130;

Step S805, the SSL/TLS proxy server 130 forwards the digital certificate in the SSL/TLS connection data to the digital certificate analysis device 150;

Step S806, the digital certificate analyzing device 150 compares the digital certificate sent by the SSL/TLS proxy server 130 with the digital certificate stored in the digital certificate database 131, if the digital certificate sent by the SSL/TLS proxy server 130 belongs to digital Certificate white list list, then perform step S807; If the digital certificate sent by the SSL/TLS proxy server 130 belongs to the digital certificate step S807; If the digital certificate sent by the SSL/TLS proxy server 130 belongs to the digital certificate blacklist , then execute step S808; if the digital certificate sent by the SSL/TLS proxy server 130 is an unknown digital certificate, that is, it is neither in the digital certificate whitelist nor in the digital certificate blacklist, then execute step S809;

Step S807, the SSL/TLS proxy server 130 directly connects the client 110 to the server 120, and no longer performs encryption, decryption and security checks;

Step S808, the SSL/TLS proxy server 130 prevents the client 110 from connecting to the server 120;

Step S809, the SSL/TLS proxy server 130 converts the SSL/TLS connection into a connection from the client 110 to itself, and decrypts the SSL/TLS connection data into plaintext data, and then sends the decrypted plaintext data to the security check and content Filtration device 140;

Step S810, safety inspection and content filtering device 140 carry out safety inspection and content filtering to the plaintext data sent by SSL/TLS proxy server 130, including at least one of the following methods: web page filtering (Web Filter), anti-virus (Anti-Virus) , Intrusion Detection and Protection (IDS/IPS), Anti-Fishing (Anti-Fishing) and Access Policy (Access Policy) inspection, etc. If it is found that there is a security threat in the plaintext data, the security check and content filtering device 140 can disconnect the connection and notify the client 110 or delete the threatening data;

Step S811, after the security inspection and content filtering device 140 completes the inspection and processing, the above-mentioned plaintext data is sent back to the SSL/TLS proxy server 130. 120 send SSL/TLS connection data;

Step S812 , after receiving the above SSL/TLS connection data, the server 120 returns reply data to the SSL/TLS proxy server 130 , and the SSL/TLS proxy server 130 forwards the above reply data to the client 110 .

The above-mentioned four embodiments can be implemented independently, and can also be combined among multiple embodiments, wherein, the SSL/TLS proxy server 130, the security check and content filtering device 140, the digital certificate analyzing device 150 and the Uniform Resource Locator analyzing device 170 can all be set in the gateway 160 to facilitate maintenance and use.

Certainly, the present invention also can have other various embodiments, without departing from the spirit and essence of the present invention, those skilled in the art can make various corresponding changes and deformations according to the present invention, but these Corresponding changes and deformations should belong to the scope of protection of the appended claims of the present invention.

Claims (15)

1. one kind is carried out the device of safety inspection and information filtering to communication data, is used for the connection data that send mutually between the client and server end are carried out safety inspection and information filtering, it is characterized in that, comprising:

The SSL/TLS acting server, be used for the SSL/TLS agreement enciphered data that described client end/server end sends is decrypted into expressly, be sent to safety inspection and content filtering device, and the described clear data that described safety inspection and content filtering device dispose is encrypted as the SSL/TLS data, and be sent to described server end/client;

Safety inspection and content filtering device, be connected with described SSL/TLS acting server, be used for accepting and checking described clear data, if find to have security threat to exist, the data filter that threat then will be arranged, and the clear data after will handling returns described SSL/TLS acting server.

2. according to claim 1 communication data is carried out the device of safety inspection and information filtering, it is characterized in that described SSL/TLS acting server further comprises:

The client communication module is connected respectively with content filtering device with safety inspection with described client, be used to accept the SSL/TLS agreement enciphered data that described client sends, and deciphering is sent to described safety inspection and content filtering device for clear data; With

Be used to accept the clear data that sends from described safety inspection and content filtering device, encrypt described clear data with the SSL/TLS agreement, and be sent to described client.

3. according to claim 1 communication data is carried out the device of safety inspection and information filtering, it is characterized in that described SSL/TLS acting server further comprises:

The server end communication module, be connected respectively with content filtering device with safety inspection with described server end, be used to accept the SSL/TLS agreement enciphered data that described server end sends, and deciphering is sent to described safety inspection and content filtering device for clear data; With

Be used to accept the clear data that sends from described safety inspection and content filtering device, encrypt described clear data and be sent to described server end with the SSL/TLS agreement.

4. according to claim 1 communication data is carried out the device of safety inspection and information filtering, it is characterized in that, further comprise:

Gateway, be connected respectively with described client, server end, SSL/TLS acting server, be used for when the communication data of described client transmission is SSL/TLS agreement enciphered data, described enciphered data is sent to described SSL/TLS acting server, and accept SSL/TLS agreement enciphered data after described safety inspection and content filtering device are handled from described SSL/TLS acting server, be forwarded to described server end then; With

Be used for when the communication data of described server end transmission is SSL/TLS agreement enciphered data, described enciphered data is sent to described SSL/TLS acting server, and be subjected to SSL/TLS agreement enciphered data after described safety inspection and content filtering device are handled from described SSL/TLS acting server termination, be forwarded to described client.

5. according to claim 1 communication data is carried out the device of safety inspection and information filtering, it is characterized in that, further comprise:

The digital certificate analytical equipment, be used for receiving the digital certificate that SSL/TLS that described SSL/TLS acting server sends connects data, judge whether described digital certificate belongs to the digital certificate white list tabulation, perhaps belongs to the digital certificate blacklist list, or unknown digital certificate.

6. according to claim 5 communication data is carried out the device of safety inspection and information filtering, it is characterized in that described digital certificate analytical equipment further comprises:

The digital certificate data storehouse, being used for tabulates with digital certificate blacklist list and digital certificate white list respectively stores digital certificate.

7. according to claim 1 communication data is carried out the device of safety inspection and information filtering, it is characterized in that, further comprise:

The URL(uniform resource locator) analytical equipment, be used for judging whether described client belongs to the tabulation of URL(uniform resource locator) white list to the URL(uniform resource locator) of the SSL/TLS agreement connection data of described server end transmission, perhaps belong to the URL(uniform resource locator) blacklist list, or unknown URL(uniform resource locator).

8. according to claim 7 communication data is carried out the device of safety inspection and information filtering, it is characterized in that described URL(uniform resource locator) analytical equipment further comprises:

The URL(uniform resource locator) database is used for tabulating with URL(uniform resource locator) blacklist list and URL(uniform resource locator) white list and stores the URL(uniform resource locator) list.

9. according to claim 4,5, the 7 described devices that communication data carried out safety inspection and information filtering, it is characterized in that described SSL/TLS acting server, safety inspection and content filtering device, digital certificate analytical equipment and/or URL(uniform resource locator) analytical equipment are arranged in the described gateway.

10. one kind is carried out the method for safety inspection and information filtering to communication data, it is characterized in that, may further comprise the steps:

Step 1, client end/server end send SSL/TLS agreement enciphered data to the SSL/TLS acting server;

Step 2, described SSL/TLS acting server is clear data and is sent to safety inspection and content filtering device described SSL/TLS agreement enciphered data deciphering;

Step 3, described safety inspection and content filtering device are carried out safety inspection to described clear data, when finding security threat is arranged, the data filter of threat will be arranged, and the clear data after will filtering are sent to described SSL/TLS acting server;

Step 4, the described SSL/TLS acting server clear data after with described processing is encrypted as SSL/TLS agreement enciphered data, is sent to described server end/client.

11. according to claim 10 communication data is carried out the method for safety inspection and information filtering, it is characterized in that when described client and server end carries out data when connecting by gateway, described step 1 further comprises:

Step 111, described client end/server end send and connect data to gateway;

Step 112, described gateway judge whether described data meet access strategy, if meet, then enter step 113, if do not meet, then refusal connects;

Step 113, described gateway judges whether described data are SSL/TLS agreement enciphered data, if then described SSL/TLS agreement enciphered data is sent to described SSL/TLS acting server, if not, then described data directly are sent to described server end/client.

12. according to claim 10 communication data is carried out the method for safety inspection and information filtering, it is characterized in that, when described client and server end carries out data when connecting by gateway, further comprise after the described step 1:

Step 121, described SSL/TLS acting server sends the digital certificate analytical equipment with the digital certificate that described SSL/TLS agreement connects in the data, and described digital certificate analytical equipment judges whether described digital certificate belongs to the digital certificate white list tabulation or belong to digital certificate blacklist list or unknown digital certificate;

Step 122, if belong to the digital certificate white list tabulation, then described SSl/TLS acting server directly is connected described client with described server end, if belong to the digital certificate blacklist list, then described SSL/TLS acting server stops being connected of described client and described server end, if unknown digital certificate then enters described step 2.

13. according to claim 10 communication data is carried out the method for safety inspection and information filtering, it is characterized in that, further comprise after the described step 1:

Step 131, described SSL/TLS acting server sends the URL(uniform resource locator) analytical equipment with the URL(uniform resource locator) that described SSL/TLS agreement connects in the data, and described URL(uniform resource locator) analytical equipment judges whether described URL(uniform resource locator) belongs to the tabulation of URL(uniform resource locator) white list or belong to the URL(uniform resource locator) blacklist list or unknown URL(uniform resource locator);

Step 132, if belong to the tabulation of URL(uniform resource locator) white list, then described SSl/TLS acting server directly is connected described client with described server end, if belong to the URL(uniform resource locator) blacklist list, then described SSL/TLS acting server stops being connected of described client and described server end, if unknown URL(uniform resource locator) then enters described step 2.

14. according to claim 10 communication data is carried out the method for safety inspection and information filtering, it is characterized in that described SSL/TLS agreement enciphered data comprises: HTTPS data, IMAPS data, SMTPS data and/or POP3S data.

15. method of communication data being carried out safety inspection and information filtering according to claim 14, it is characterized in that, when described SSL/TLS agreement enciphered data was the HTTPS data, described step 3 further comprised: the step of the data after the described deciphering being carried out the processing of home page filter, anti-virus, intrusion detection, anti-phishing and/or access strategy inspection;

When described SSL/TLS agreement enciphered data was IMAPS, SMTPS or POP3S data, described step 3 further comprised: the step of the data after the described deciphering being carried out the processing of anti-rubbish mail, anti-virus and/or access strategy inspection.

Images