CN115277060A - URL (Uniform resource locator) filtering method based on HTTPS (Hypertext transfer protocol secure) protocol, security equipment and storage medium - Google Patents

Abstract

This application provides a URL filtering method based on the HTTPS protocol, a security device, and a storage medium. Among them, the URL filtering method based on the HTTPS protocol is applied to the security device, including preset URL rules that can be accessed or excluded from access; receiving the request protocol message sent by the client; judging whether the received request protocol message is HTTPS or HTTP protocol message If it is an HTTPS protocol packet, extract and parse the domain name in the URL of the protocol packet; judge whether the parsed domain name is within the preset URL rule; decide to release or block the client's access request according to the judgment result. The present application can realize the transmission of the request message without uninstalling the HTTPS, which greatly reduces the performance consumption and improves the data transmission speed.

Description

URL filtering method, security device and storage medium based on HTTPS protocol

technical field

The present application relates to the technical field of communication equipment, in particular to a URL filtering method based on the HTTPS protocol, a security device, and a storage medium.

Background technique

HTTP (HyperText Transfer Protocol, Hypertext Transfer Protocol), an application layer protocol for transmitting hypermedia documents, is designed for communication between web browsers and web servers. Used for client and server side requests and responses. Through a web browser, web crawler or other tools, the client initiates an HTTP request to a specified port on the server. Resources, such as HTML (Hyper Text Markup Language, hypertext markup language) files and images are stored on the responding server. The request carries a URL (Uniform Resource Locator, Uniform Resource Locator), which is the unique address of the resource, through which the server can find the resource to respond to the request.

HTTPS (Hyper Text Transfer Protocol over Secure Socket Layer, a security-oriented HTTP channel) uses encryption algorithms to solve data transmission security issues. The whole communication process can be divided into two stages: handshake and data transmission stage, and the data transmission stage can be divided into two stages: asymmetric encryption and symmetric encryption; asymmetric encryption or symmetric encryption of data is the result of negotiation in the handshake stage. The data transmitted at the time is encrypted HTTP data.

The inventor knows the existing URL filtering based on the HTTPS protocol, as shown in Figure 1,

(1) The security device accepts the client's request to establish an SSL/TLS connection.

(2) The security device acts as a proxy client to initiate an SSL/TLS connection request to the server.

(3) The server sends the server certificate to the security device.

(4) The security device verifies the certificate of the server, negotiates information such as the encryption algorithm of the protocol, completes the handshake, and successfully establishes the connection.

(5) The security device acts as a proxy server to respond to the request of the client, and according to the decrypted certificate of the server certificate content, the proxy server certificate is issued for the client to verify.

(6) The client completes the certificate verification and completes the handshake with the security device acting as the proxy server, and establishes a connection.

(7) The client sends an encrypted message to the server.

(8) The device decrypts the message sent by the client, and performs URL filtering service.

(9) After the URL filtering process, the released message is encrypted again and sent to the server.

After the proxy is established in the above process, all subsequent messages must be decrypted, secured, and encrypted. It can be seen that this implementation of URL filtering scheme consumes a lot of performance and is very slow.

Contents of the invention

In order to overcome the problems existing in the related technologies, the present application provides a URL filtering method based on the HTTPS protocol, a security device, and a storage medium.

This application provides a URL filtering method based on the HTTPS protocol, which is applied to security devices, including:

Preset URL rules that can be accessed or excluded from access;

Receive the request protocol message sent by the client;

Determine whether the received request protocol message is HTTPS or HTTP protocol message;

If it is an HTTPS protocol message, extracting and parsing the domain name in the URL of the protocol message;

Determine whether the resolved domain name is within the preset URL rules;

According to the judgment result, it is decided to allow or block the access request of the client.

Further, if it is judged to be an HTTP protocol message, it is directly judged whether the URL of the plain text of the protocol message is within the preset URL rule;

According to the judgment result, it is decided to allow or block the access request of the client.

Preferably, clients of different intranets are connected to different security devices;

The security device is also preset with customer security access policies;

Before judging the type of the received protocol message, judge the client's security access policy based on the protocol message sent by the client; if it is within the security access policy, then judge the access type of the protocol message.

Furthermore, security access policies of clients in different intranets are different.

Preferably, the domain name is extracted from the SNI field of the extension field of the HTTPS protocol message.

The application also provides a URL filtering system based on the HTTPS protocol, including a client, a security device and a server,

The client is used to initiate a request protocol message;

Security device, used to preset URL rules that can be accessed or excluded from access; receive the request protocol message sent by the client; determine whether the received protocol message is HTTPS or HTTP protocol message; if it is an HTTPS protocol message, extract and parse it Get the domain name in the URL of the protocol message; judge whether the resolved domain name is in the preset URL rule; decide to release or block the client’s access request according to the judgment result;

The server is configured to respond to a protocol message, and the response protocol message corresponds to the released client request protocol message.

Further, the security device is also used to directly judge whether the URL of the plain text of the protocol message is within the preset URL rules if it is judged to be an HTTP protocol message; and decide to allow or block the client's access request according to the judgment result.

Preferably, the security device is also used to preset client security access policies, and when clients of different intranets are connected to different security devices, before judging the type of the received protocol message, it is judged based on the protocol message sent by the client The client's security access policy; if it is within the security access policy, then judge the access type of the protocol message.

Preferably, security access policies of clients in different intranets are different.

Preferably, the domain name is extracted from the SNI field of the extension field of the HTTPS protocol message.

The present application also provides a security device, including a memory, a processor, and a computer program stored on the memory and operable on the processor. When the processor executes the program, it executes the URL filtering method based on the HTTPS protocol.

Finally, the present application also provides a storage medium on which computer program instructions are stored, and when the program instructions are executed by a processor, the above URL filtering method based on the HTTPS protocol is implemented.

The technical solutions provided by the embodiments of the present application may include the following beneficial effects:

In the embodiment of the present application, the transmission of the request message can be realized without unloading the HTTPS, which greatly reduces the performance consumption and improves the data transmission speed.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the application.

Description of drawings

The accompanying drawings, which are incorporated in and constitute a part of this application, illustrate embodiments consistent with the application and together with the application serve to explain the principles of the application.

Fig. 1 is a logical block diagram of prior art URL filtering based on HTTPS protocol;

Fig. 2 is a schematic diagram of an embodiment of the present application;

Fig. 3 is the schematic diagram of the second embodiment of the present application;

Fig. 4 is the schematic diagram of the third embodiment of the present application;

Fig. 5 is a logic block diagram of the security device of the present application.

Detailed ways

Reference will now be made in detail to the exemplary embodiments, examples of which are illustrated in the accompanying drawings. When the following description refers to the accompanying drawings, the same numerals in different drawings refer to the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with aspects of the present application as recited in the appended claims.

This application provides an HTTPS protocol-based URL filtering method, which is applied to an embodiment of a security device, as shown in FIG. 2 . include:

Preset URL rules that can be accessed or excluded from access;

Receive the request protocol message sent by the client;

Determine whether the received request protocol message is HTTPS or HTTP protocol message;

If it is an HTTPS protocol message, extracting and parsing the domain name in the URL of the protocol message;

Determine whether the resolved domain name is within the preset URL rules;

According to the judgment result, it is decided to allow or block the access request of the client.

As a preferred embodiment, as shown in Figure 3, if it is judged to be an HTTP protocol message, then directly judge whether the URL of the plain text of the protocol message is in the preset URL rule;

According to the judgment result, it is decided to allow or block the access request of the client.

Of course, if it is judged to be an HTTP protocol message, other processing methods may also be adopted, such as direct blocking.

A domain name is a component of a URL and can be used for URL filtering. In one embodiment of the present application, the domain name is extracted from the SNI field of the extension field of the HTTPS protocol message.

Since security access policies of different customers are different, the present application also provides an embodiment, in which security access policies of customers are preset in the security device. Clients on different intranets connect to different security devices; before judging the type of protocol message received, judge the client’s security access policy based on the protocol message sent by the client; if it is within the client’s security access policy, then judge the above protocol Whether the access type of the packet is HTTP or HTTPS protocol, as shown in Figure 4. Of course, the preset customer security access policy does not necessarily require the process sequence shown in Figure 4, and can be performed together with the preset URL rules, and Figure 4 does not limit the sequence.

The application also provides a URL filtering system based on the HTTPS protocol, including a client, a security device and a server.

The client is used to initiate a request protocol message;

Security device, used to preset URL rules that can be accessed or excluded from access; receive the request protocol message sent by the client; determine whether the received protocol message is HTTPS or HTTP protocol message; if it is an HTTPS protocol message, extract and parse it Get the domain name in the URL of the protocol message; judge whether the resolved domain name is in the preset URL rule; decide to release or block the client’s access request according to the judgment result;

The server is configured to respond to a protocol message, and the response protocol message corresponds to the released client request protocol message.

In the above embodiment, as an embodiment of domain name extraction and resolution, the domain name is extracted from the SNI field of the extension field of the HTTPS protocol message. It is of course not limited to the examples given.

As yet another embodiment, the security device of the present application is also used to directly judge whether the URL of the plain text of the protocol message is within the preset URL rules if it is judged to be an HTTP protocol message; and decide to release or block the client's access according to the judgment result ask.

As yet another embodiment, the security device of the present application is also used to preset client security access policies. Clients in different intranets are connected to different security devices, and clients in different intranets have different security access policies. Before judging the type of the received protocol message, judge the security access policy of the client based on the protocol message sent by the client; if it is within the security access policy, judge the access type of the protocol message.

This application uses the TCP protocol as an example for illustration.

The URL rules that can be accessed or excluded are preset in the security device

The client establishes a session with the server through the TCP three-way handshake;

The client sends an HTTPS message protocol request to the server, including sending a clear text Clienthello request protocol message to the server; (the Clienthello request protocol message contains information such as version information, cipher suite candidate list, compression algorithm candidate list, random number, extension field, etc. .)

The Clienthello request protocol message arrives at the security device, and the security device confirms the HTTPS protocol type and its Clienthello request protocol message;

The security device extracts and parses the domain name in the SNI field in the extension field;

Judge whether the domain name is within the preset URL rules, and decide to release or block the client's access request according to the judgment result;

If allowed, the security device forwards the access request sent by the client;

The server responds with an access request message.

If there are multiple intranets accessing the external network, and the client security access policies in each intranet are different, each client in the intranet is connected to a corresponding security device. Each corresponding security device is equipped with a client security access policy in the connected intranet, and a corresponding URL rule is preset.

After clients in different intranets send request protocol packets, the corresponding security device first checks the security access policy, and then judges the type of the request protocol packet if it meets the requirements of the security access policy. If it is an HTTPS protocol packet, it The domain name of the SNI field in the extension field of the protocol message is extracted and parsed. Judge whether the domain name is within the preset URL rules, and decide to allow or block the client's access request according to the judgment result.

The present application also provides a security device, including a memory, a processor, and a computer program stored on the memory and operable on the processor. When the processor executes the program, the above URL filtering method based on the HTTPS protocol is executed, as shown in FIG. 5 .

The storage medium stores computer program instructions thereon, and the program instructions are used to implement the URL filtering method based on the HTTPS protocol when executed by the processor.

Finally, the embodiment of the present application also provides a storage medium on which computer program instructions are stored, and when the program instructions are executed by a processor, they are used to implement the above-mentioned dynamic access authentication method under the zero-trust network.

Here, a storage medium may be any electronic, magnetic, optical, or other physical storage device that may contain or store information, such as executable instructions, data, and the like. For example, the storage medium can be: RAM (Radom Access Memory, random access memory), volatile memory, non-volatile memory, flash memory, storage driver (such as hard disk drive), solid-state hard disk, any type of storage disk (such as optical disk , dvd, etc.), or similar storage media, or a combination thereof.

The systems described in the above embodiments can be specifically implemented by computer chips or entities, or by products with certain functions. A typical implementing device is a computer, which may take the form of a personal computer, laptop computer, cellular phone, camera phone, smart phone, personal digital assistant, media player, navigation device, e-mail device, game control device, etc. desktops, tablets, wearables, or any combination of these.

Those skilled in the art should understand that the embodiments of the present disclosure may be provided as methods, systems, or computer program products. Accordingly, the present disclosure may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, embodiments of the present disclosure may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present disclosure is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present disclosure. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

Moreover, these computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, The instruction means implements the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operational steps are performed on the computer or other programmable equipment to produce computer-implemented processing, so that the information executed on the computer or other programmable equipment The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

Those skilled in the art should understand that the embodiments of the present disclosure may be provided as methods, systems or computer program products. Accordingly, the present disclosure can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present disclosure may take the form of a computer program product embodied on one or more computer-usable storage media (which may include, but is not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

It should be understood that the present application is not limited to the precise constructions which have been described above and shown in the accompanying drawings, and various modifications and changes may be made without departing from the scope thereof. The scope of the application is limited only by the appended claims.

The above are only preferred embodiments of the application, and are not intended to limit the application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the application shall be included in the protection of the application. within range.

Claims (12)

1. The URL filtering method based on the HTTPS protocol, applied to a security device, is characterized in that, comprising: Preset URL rules that can be accessed or excluded from access; Receive the request protocol message sent by the client; Determine whether the received request protocol message is HTTPS or HTTP protocol message; If it is an HTTPS protocol message, extracting and parsing the domain name in the URL of the protocol message; Determine whether the resolved domain name is within the preset URL rules; According to the judgment result, it is decided to allow or block the access request of the client. 2. the URL filtering method based on HTTPS protocol according to claim 1, is characterized in that, if it is judged that it is an HTTP protocol message, then directly judge whether the URL of the plain text of the protocol message is in the preset URL rule; According to the judgment result, it is decided to allow or block the access request of the client. 3. the URL filtering method based on HTTPS protocol according to claim 1, is characterized in that, the clients of different intranets are connected to different security devices; The security device is also preset with a customer security access policy; Before judging the type of the received protocol message, judge the security access policy of the client based on the protocol message sent by the client; if it is within the security access policy, then judge the access type of the protocol message. 4. The URL filtering method based on the HTTPS protocol according to claim 3, wherein the security access policies of clients in different intranets are different. 5. The URL filtering method based on the HTTPS protocol according to claim 1, wherein the domain name is extracted from the SNI field of the extension field of the HTTPS protocol message. 6. The URL filtering system based on the HTTPS protocol, comprising a client, a security device and a server, is characterized in that, The client is used to initiate a request protocol message; Security device, used to preset URL rules that can be accessed or excluded from access; receive the request protocol message sent by the client; determine whether the received protocol message is HTTPS or HTTP protocol message; if it is an HTTPS protocol message, extract and parse it Get the domain name in the URL of the protocol message; judge whether the resolved domain name is in the preset URL rule; decide to release or block the client’s access request according to the judgment result; The server is configured to respond to a protocol message, and the response protocol message corresponds to the released client request protocol message. 7. The URL filtering system based on the HTTPS protocol according to claim 6, wherein the safety device is also used to directly judge whether the URL of the plain text of the protocol message is at the preset URL if it is judged to be an HTTP protocol message. Within the rules; according to the judgment result, it is decided to allow or block the client's access request. 8. The URL filtering system based on HTTPS protocol according to claim 6, characterized in that, the security device is also used for clients of different intranets to connect to different security devices; the security device is also preset with client security access Policy; before judging the type of the received protocol message, judge the security access policy of the client based on the protocol message sent by the client; if it is within the security access policy, then judge the access type of the protocol message. 9. The URL filtering system based on HTTPS protocol according to claim 8, characterized in that the security access policies of clients in different intranets are different. 10. The URL filtering system based on the HTTPS protocol according to claim 6, wherein the domain name is extracted from the SNI field of the extension field of the HTTPS protocol message. 11. A security device, comprising a memory, a processor, and a computer program stored on the memory and operable on the processor, characterized in that, when the processor executes the program, it executes the URL based on the HTTPS protocol of any one of claims 1-5 filter method. 12. A storage medium on which computer program instructions are stored, wherein the program instructions are used to implement the URL filtering method based on the HTTPS protocol in any one of claims 1-5 when executed by a processor.

Images