Patent Application
20180176194
The disclosure relates to the communications field, and in particular, to a service processing method and apparatus.
The Secure Socket Layer (SSL for short) protocol and its successor, the Transport Layer Security (TLS for short) protocol are used to provide services such as encryption, identity authentication, and data integrity for network communication, and are already widely applied to secure communication between a browser and a network server. The SSL/TLS protocol is located between the Transmission Control Protocol (TCP for short) at a transport layer and the Hypertext Transfer Protocol (HTTP for short) at an application layer.
A service processing method in the prior art includes: user equipment (UE for short) and a network server set up an encrypted connection based on the Hypertext Transfer Security Protocol over the SSL/TLS protocol used at a lower layer (hyper text transfer protocol over secure socket layer, HTTPS for short), and agree upon a first key and a second key; after encrypting service information by using the first key, the user equipment sends the encrypted service information to the network server; the network server obtains the service information through decryption by using the second key, generates service data according to the service information, and after encrypting the service data, sends the encrypted service data to the user equipment; and the user equipment obtains the service data through decryption by using the first key. The service information may be used to request a web page from the network server, or may be used to request an object from the network server.
Generally, a proxy node may also be disposed between the user equipment and the network server. In a scenario in which a proxy node exists, when the encrypted connection is set up between the user equipment and the network server, a ciphertext obtained through encryption is transmitted between the user equipment and the network server. Because the proxy node cannot obtain the first key and the second key, the proxy node cannot decrypt the ciphertext. Consequently, the proxy node cannot provide service optimization for the user equipment.
To resolve a problem that a proxy node cannot provide service optimization for user equipment because the proxy node cannot decrypt a ciphertext, embodiments of the disclosure provide a service processing method and apparatus. The technical solutions are as follows:
According to a first aspect, a service processing method is provided. The method includes:
In a first possible implementation of the first aspect, the setting up, by a proxy node, in place of a network server in a connection setup process between user equipment UE and the network server, a first encrypted connection to the UE, and setting up a second encrypted connection to the network server includes:
In a second possible implementation of the first aspect, the setting up, by a proxy node, in place of a network server in a connection setup process between user equipment UE and the network server, a first encrypted connection to the UE, and setting up a second encrypted connection to the network server includes:
In a third possible implementation of the first aspect, the setting up, by a proxy node, in place of a network server in a connection setup process between user equipment UE and the network server, a first encrypted connection to the UE, and setting up a second encrypted connection to the network server includes:
With reference to the first possible implementation of the first aspect, or the second possible implementation of the first aspect, or the third possible implementation of the first aspect, in a fourth possible implementation of the first aspect, the obtaining, by the proxy node from the UE, an encryption context generated in the process of setting up the first encrypted connection includes:
According to a second aspect, a service processing method is provided. The method includes:
In a first possible implementation of the second aspect, the setting up, by UE, in a connection setup process between the UE and a network server, a first encrypted connection to a proxy node that is in place of the network server, where the proxy node is configured to set up a second encrypted connection to the network server includes:
In a second possible implementation of the second aspect, the setting up, by UE, in a connection setup process between the UE and a network server, a first encrypted connection to a proxy node that is in place of the network server, where the proxy node is configured to set up a second encrypted connection to the network server includes:
In a third possible implementation of the second aspect, the setting up, by UE, in a connection setup process between the UE and a network server, a first encrypted connection to a proxy node that is in place of the network server, where the proxy node is configured to set up a second encrypted connection to the network server includes:
With reference to the first possible implementation of the second aspect, or the second possible implementation of the second aspect, or the third possible implementation of the second aspect, in a fourth possible implementation of the second aspect, the providing, by the UE, the proxy node with an encryption context that is generated in the process of setting up the first encrypted connection includes:
According to a third aspect, a service processing apparatus is provided and applied to a proxy node. The apparatus includes:
In a first possible implementation of the third aspect, the connection setup module is specifically configured to:
In a second possible implementation of the third aspect, the connection setup module is specifically configured to:
In a third possible implementation of the third aspect, the connection setup module is specifically configured to:
With reference to the first possible implementation of the third aspect, or the second possible implementation of the third aspect, or the third possible implementation of the third aspect, in a fourth possible implementation of the third aspect, the key generation module is specifically configured to:
According to a fourth aspect, a service processing apparatus is provided and applied to user equipment UE. The apparatus includes:
In a first possible implementation of the fourth aspect, the connection setup module is specifically configured to:
In a second possible implementation of the fourth aspect, the connection setup module is specifically configured to:
In a third possible implementation of the fourth aspect, the connection setup module is specifically configured to:
With reference to the first possible implementation of the fourth aspect, or the second possible implementation of the fourth aspect, or the third possible implementation of the fourth aspect, in a fourth possible implementation of the fourth aspect, the key providing module is specifically configured to:
According to a fifth aspect, a service processing apparatus is provided and applied to a proxy node. The apparatus includes: a bus, and a processor, a memory, a transmitter, and a receiver that are connected to the bus, where the memory is configured to store several instructions, and the processor is configured to execute the instructions;
In a first possible implementation of the fifth aspect, the receiver is further configured to intercept a Transmission Control Protocol TCP setup request sent by the UE to the network server, where the TCP setup request includes an Internet Protocol IP address of the UE and an IP address of the network server;
In a second possible implementation of the fifth aspect, the receiver is further configured to intercept a TCP setup request sent by the UE to a tunnel gateway, where the TCP setup request includes an IP address of the UE and an IP address of the tunnel gateway, and the tunnel gateway is located between the proxy node and the network server;
In a third possible implementation of the fifth aspect, the receiver is further configured to intercept a TCP setup request sent by a tunnel gateway to the network server, where the TCP setup request is sent after the tunnel gateway sets up a TCP connection to the UE, the TCP setup request includes an IP address of the tunnel gateway and an IP address of the network server, and the tunnel gateway is located between the UE and the proxy node;
With reference to the first possible implementation of the fifth aspect, or the second possible implementation of the fifth aspect, or the third possible implementation of the fifth aspect, in a fourth possible implementation of the fifth aspect, the transmitter is further configured to send, to a key server, an obtaining request that carries a connection identifier of the TCP connection, where the obtaining request is used to instruct the key server to determine the UE according to the connection identifier, forward the obtaining request to the UE, receive the encryption context sent by the UE according to the connection identifier, and forward the encryption context to the proxy node; and the receiver is further configured to receive the encryption context forwarded by the key server; or
According to a sixth aspect, a service processing apparatus is provided and applied to user equipment UE. The apparatus includes: a bus, and a processor, a memory, a transmitter, and a receiver that are connected to the bus, where the memory is configured to store several instructions, and the processor is configured to execute the instructions;
In a first possible implementation of the sixth aspect, the transmitter is further configured to send a Transmission Control Protocol TCP setup request to the network server, where the TCP setup request includes an Internet Protocol IP address of the UE and an IP address of the network server;
In a second possible implementation of the sixth aspect, the transmitter is further configured to send a TCP setup request to a tunnel gateway, where the TCP setup request includes an IP address of the UE and an IP address of the tunnel gateway, and the tunnel gateway is located between the proxy node and the network server;
In a third possible implementation of the sixth aspect, the processor is further configured to set up a TCP connection to a tunnel gateway, where the tunnel gateway is configured to send a TCP setup request to the network server, the TCP setup request includes an IP address of the tunnel gateway and an IP address of the network server, the tunnel gateway is configured to set up, according to the IP address of the network server that is obtained by the proxy node after the proxy node intercepts the TCP setup request, a TCP connection to the proxy node that is in place of the network server, the proxy node is configured to set up, in place of the tunnel gateway, a TCP connection to the network server according to the IP address of the tunnel gateway, and the tunnel gateway is located between the UE and the proxy node;
With reference to the first possible implementation of the sixth aspect, or the second possible implementation of the sixth aspect, or the third possible implementation of the sixth aspect, in a first possible implementation of the sixth aspect, the receiver is configured to receive an obtaining request that carries a connection identifier of the TCP connection and is forwarded by a key server, and the transmitter is further configured to send the encryption context to the key server according to the connection identifier, where the encryption context is used to instruct the key server to forward the encryption context to the proxy node, and the obtaining request is sent by the proxy node to the key server and is sent by the key server after the key server determines the UE according to the connection identifier; or
Beneficial effects of the technical solutions provided in the embodiments of the disclosure are as follows:
A proxy node sets up, in place of a network server, a first encrypted connection to UE, obtains, from the UE, an encryption context generated in the process of setting up the first encrypted connection, and generates a first key according to the encryption context. The proxy node receives a ciphertext sent by the UE, decrypts the ciphertext by using the first key, and processes obtained service information. In this way, the proxy node may obtain the first key that the UE and the network server agree upon, decrypt, by using the first key, the ciphertext sent by the UE to the network server, and process the service information. Therefore, a problem that a proxy node cannot provide service optimization for UE because the proxy node cannot decrypt a ciphertext is resolved, and an effect of expanding a usage scope of service optimization is achieved.
To describe the technical solutions in the embodiments of the disclosure more clearly, the following briefly describes the accompanying drawings required for describing the embodiments. Apparently, the accompanying drawings in the following description show merely some embodiments of the disclosure, and a person of ordinary skill in the art may still derive other drawings from these accompanying drawings without creative efforts.
To make the objectives, technical solutions, and advantages of the disclosure clearer, the following further describes the embodiments of the disclosure in detail with reference to the accompanying drawings.
Referring to
Step 101: A proxy node sets up, in place of a network server in a connection setup process between UE and the network server, a first encrypted connection to the UE, and sets up a second encrypted connection to the network server.
Step 102: The proxy node obtains, from the UE, an encryption context generated in the process of setting up the first encrypted connection, and generates a first key according to the encryption context.
Step 103: The proxy node receives a ciphertext sent by the UE, decrypts the ciphertext by using the first key, processes obtained service information, and sends the processed service information to the network server by using the second encrypted connection, where the ciphertext is obtained by the UE by encrypting the service information by using a second key, the first key corresponds to the second key, and the second key is generated by the UE according to the encryption context.
In summary, in the service processing method provided in this embodiment of the disclosure, a proxy node sets up, in place of a network server, a first encrypted connection to UE, obtains, from the UE, an encryption context generated in the process of setting up the first encrypted connection, and generates a first key according to the encryption context. The proxy node receives a ciphertext sent by the UE, decrypts the ciphertext by using the first key, and processes obtained service information. In this way, the proxy node may obtain the first key that the UE and the network server agree upon, decrypt, by using the first key, the ciphertext sent by the UE to the network server, and process the service information. Therefore, a problem that a proxy node cannot provide service optimization for UE because the proxy node cannot decrypt a ciphertext is resolved, and an effect of expanding a usage scope of service optimization is achieved.
Referring to
Step 201: UE sets up, in a connection setup process between the UE and a network server, a first encrypted connection to a proxy node that is in place of the network server, where the proxy node is configured to set up a second encrypted connection to the network server.
Step 202: The UE provides the proxy node with an encryption context that is generated in the process of setting up the first encrypted connection, where the encryption context is used to instruct the proxy node to generate a first key according to the encryption context; and the UE generates a second key according to the encryption context, where the second key corresponds to the first key.
Step 203: The UE encrypts service information by using the second key, and sends an obtained ciphertext to the proxy node, where the ciphertext is used to instruct the proxy node to decrypt the ciphertext by using the first key, process the obtained service information, and send the processed service information to the network server by using the second encrypted connection.
In summary, in the service processing method provided in this embodiment of the disclosure, UE sets up a first encrypted connection to a proxy node that is in place of a network server, and provides the proxy node with an encryption context that is generated in the process of setting up the first encrypted connection, where the encryption context is used to instruct the proxy node to generate a first key according to the encryption context. The UE encrypts service information by using a second key, and sends an obtained ciphertext to the proxy node, where the ciphertext is used to instruct the proxy node to decrypt the ciphertext by using the first key, and process the obtained service information, Therefore, a problem that a proxy node cannot provide service optimization for UE because the proxy node cannot decrypt a ciphertext is resolved, and an effect of expanding a usage scope of service optimization is achieved.
Referring to
Step 301: UE sends a Transmission Control Protocol (TCP for short) setup request to a network server, where the TCP setup request includes an Internet Protocol (IP for short) address of the UE and an IP address of the network server.
If the UE needs to access the network server, the UE needs to first set up a connection to the network server. The connection may be an unencrypted connection based on the Hypertext Transfer Protocol (HTTP for short), or may be an encrypted connection based on the Hypertext Transfer Security Protocol over the SSL/TLS protocol used at a lower layer (hyper text transfer protocol over secure socket layer, HTTPS for short). Then the UE accesses the network server by using the connection. This embodiment is described by using an example in which a user agent sets up an encrypted connection to the network server. Because a TCP connection needs to be first set up before the encrypted connection is set up, the UE needs to first send a TCP setup request to the network server.
Information in the TCP setup request includes: a source IP address, a source port, a destination IP address, and a destination port. A source is the UE, and a destination is the network server. Ports of the TCP connection include a port 80 and a port 443. If the user agent needs to access the network server based on the HTTP protocol, the port of the TCP connection is the port 80. If the user agent needs to access the network server based on the HTTPS protocol, the port of the TCP connection is the port 443. This embodiment is described by using an example in which the user agent accesses the network server based on the HTTPS protocol. In this case, the port of the TCP connection is the port 443.
Step 302: A proxy node intercepts the TCP setup request sent by the UE to the network server.
Step 303: The proxy node sets up, in place of the network server, a TCP connection to the UE according to the IP address of the network server, and sets up, in place of the UE, a TCP connection to the network server according to the IP address of the UE.
Specifically, in a three-way handshake phase of a TCP connection, the proxy node uses the IP address of the network server as a source IP address of the proxy node and the IP address of the UE as a destination IP address, interacts with the UE to complete a three-way handshake, and sets up, in place of the network server, a TCP connection to the UE.
The proxy node sends a TCP setup request to the network server. A source IP address in the TCP setup request is the IP address of the UE, and a destination IP address is the IP address of the network server. In a three-way handshake phase of a TCP connection, the proxy node uses the IP address of the UE as a source IP address of the proxy node and the IP address of the network server as a destination IP address, interacts with the network server to complete a three-way handshake, and sets up, in place of the UE, a TCP connection to the network server.
Step 304: The UE sends an encryption setup request to the network server by using the TCP connection.
After the TCP connection between the UE and the proxy node and the TCP connection between the proxy node and the network server are set up, a path is formed between the UE, the proxy node, and the network server. In this case, the UE may send the encryption setup connection to the network server by using the TCP connections.
Step 305: The proxy node intercepts the encryption setup request sent by the UE to the network server by using the TCP connection, sets up, in place of the network server, a first encrypted connection to the UE according to the encryption setup request, and sets up, in place of the UE, a second encrypted connection to the network server according to the encryption setup request.
Because the process of setting up an encrypted connection based on the SSL protocol is similar to the process of setting up an encrypted connection based on the TLS protocol, the following uses an encrypted connection based on the TLS protocol as an example for description.
(1) The proxy node intercepts a TLS protocol version number, an encryption algorithm list, and a first random number that are sent by the UE to the network server, and forwards the TLS protocol version number, the encryption algorithm list, and the first random number to the network server.
(2) If the network server supports the TLS protocol version, the network server selects an encryption algorithm from the encryption algorithm list, and sends the TLS protocol version number, the encryption algorithm, a session identifier, and a second random number to the UE.
(3) The proxy node intercepts the TLS protocol version number, the encryption algorithm, the session identifier, and the second random number that are sent by the network server to the UE, and forwards the TLS protocol version number, the encryption algorithm, the session identifier, and the second random number to the UE.
(4) The proxy node intercepts a digital certificate of the network server that is sent by the network server to the UE, and forwards the digital certificate to the UE.
(5) The proxy node intercepts a first complete message sent by the network server to the UE, and forwards the first complete message to the UE.
(6) The UE verifies the digital certificate, and after the verification succeeds, obtains a public key in the digital certificate, generates a premaster key, encrypts the premaster key by using the public key, and sends obtained public key exchange information to the network server.
In this case, the UE generates a second key according to the first random number, the second random number, the premaster key, and the encryption algorithm. In this embodiment, the first random number, the second random number, the premaster key, and the encryption algorithm are referred to as an encryption context, or the premaster key is referred to as an encryption context in this embodiment.
(7) The proxy node intercepts the public key exchange information sent by the UE to the network server, and forwards the public key exchange information to the network server.
(8) The proxy node intercepts a key change description sent by the UE to the network server, forwards the key change description to the network server, and instructs the network server to use negotiated parameters.
(9) The proxy node intercepts a second complete message sent by the UE to the network server, and forwards the second complete message to the network server.
The second complete message includes a hash value, so that the network server performs verification according to the hash value. The hash value is obtained by the UE by performing a hash operation on all content sent to the network server.
(10) The proxy node intercepts a key change description sent by the network server to the UE, forwards the key change description to the UE, and instructs the UE to use negotiated parameters.
In this case, the network server decrypts the public key exchange information by using a private key, so as to obtain the premaster key, and generates a first key according to the first random number, the second random number, the premaster key, and the encryption algorithm.
(11) The proxy node intercepts a third complete message sent by the network server to the UE, and forwards the third complete message to the UE.
The third complete message includes a hash value, so that the UE performs verification according to the hash value. The hash value is obtained by the network server by performing a hash operation on all content sent to the UE.
Step 306: The UE provides the proxy node with an encryption context generated in the process of setting up the first encrypted connection.
Although the proxy node sets up, in place of the network server, the first encrypted connection to the UE according to the encryption setup request, and sets up, in place of the UE, the second encrypted connection to the network server, the proxy node does not have the private key of the network server. Therefore, the proxy node cannot decrypt the public key exchange information, and cannot obtain the first key. In this embodiment, the proxy node may obtain the encryption context from the UE, and compute the first key according to the encryption context. A latest time for performing the step of computing the first key by the proxy node is a time at which a ciphertext sent by the UE is received. The ciphertext is obtained by the UE after the UE encrypts service information by using the second key. In a possible implementation, the proxy node computes the first key in the process of setting up an encrypted connection. In this way, after the ciphertext is received, the proxy node may directly use the first key to decrypt the ciphertext, so as to increase a speed of responding to the service information.
In this embodiment, the UE needs to provide the proxy node with the encryption context by using a key server. The key server is configured to manage the encryption context, and may be a trusted and authoritative server such as a server of an operator. For example, a domain name of the key server is
KeyServer1.node.epc.mnc<MNC>.mcc<MCC>.3gppnetwork.org.
Generally, the key server and the proxy node belong to a same operator, and the key server and the proxy node may be deployed on a same entity, or may be deployed on different entities. This is not limited in this embodiment. When the key server and the proxy node are deployed on different entities, the UE and the proxy node need to set up an encrypted connection to the key server separately. Interaction between the UE and the key server may be based on the SSL/TLS protocol, Internet Protocol Security (IPSEC for short), a non-access stratum (NAS for short) message, or the like. Interaction between the proxy node and the key server may be based on the SSL/TLS protocol, IPSEC, or the like. The UE may set up an encrypted connection to the key server during power-on, or may set up an encrypted connection to the key server in a communication process.
Before the UE sets up the encrypted connection to the key server, the UE further needs to discover the key server first. This embodiment provides three manners of discovering the key server by the UE. The following describes the three discovery manners separately.
In a first discovery manner, IP addresses or domain names of multiple key servers are configured in the UE, and the UE may set up an encrypted connection to the key servers in turn according to the IP addresses or the domain names.
In a second discovery manner, the proxy node may determine a key server serving the proxy node, for example, a key server closest to the proxy node, and send a server identifier of the key server to the UE. The UE sets up an encrypted connection to the key server according to the server identifier.
In a third implementation, when the proxy node and the key server are both located in a PDN gateway (PGW for short), because the UE needs to access the PGW, the PGW allocates an IP address to the UE. Therefore, the UE may directly determine the key server, and set up an encrypted connection to the key server.
This embodiment provides three implementations of providing the proxy node with the encryption context by the UE. The following describes the three implementations separately.
In a first implementation, the proxy node sends, to the key server, an obtaining request that carries a connection identifier of the TCP connection, where the obtaining request is used to instruct the key server to determine the UE according to the connection identifier and forward the obtaining request to the UE. The UE receives the obtaining request that carries the connection identifier of the TCP connection and is forwarded by the key server, and sends the encryption context to the key server according to the connection identifier. The key server is configured to forward the encryption context to the proxy node. The proxy node receives the encryption context forwarded by the key server.
The connection identifier is used to identify the TCP connection. For example, the connection identifier may be an IP quintuple. In this case, the IP quintuple includes: a source IP address, a source port, a destination IP address, a destination port, and the Transmission Control Protocol TCP. The key server may determine the UE according to the source IP address, and forward the obtaining request to the UE. After receiving the obtaining request, the UE determines the network server according to the destination IP address, and then obtains the encryption context of the first encrypted connection set up to the proxy node that is in place of the network server. The UE sends the encryption context to the key server. Because the proxy node adds an IP address of the proxy node to the obtaining request when sending the obtaining request to the key server, the key server forwards the encryption context to the proxy node according to the IP address.
In a second implementation, the proxy node sends, to the UE, an obtaining request that carries a connection identifier of the TCP connection. The UE receives the obtaining request that carries the connection identifier of the TCP connection and is sent by the proxy node, and sends the encryption context to the key server according to the connection identifier. The encryption context is used to instruct the key server to forward the encryption context to the proxy node. The proxy node receives the encryption context forwarded by the key server.
The obtaining request further includes an IP address of the proxy node, so that the UE sends the IP address of the proxy node and the encryption context to the key server after the UE determines the encryption context according to the connection identifier. The key server determines the proxy node according to the IP address of the proxy node, and sends the encryption context to the proxy node. Alternatively, when the proxy node is deployed in the PGW and the PGW allocates an IP address to the UE, the key server stores a correspondence between the PGW and the UE. After receiving the encryption context and the IP address of the UE that are sent by the UE, the key server determines the proxy node according to the UE and the correspondence, and then sends the encryption context to the proxy node.
After allocating the IP address to the UE, the PGW may push the correspondence between the PGW and the UE to the key server; or the key server may request the correspondence between the PGW and the UE from the PGW periodically. Alternatively, after receiving the encryption context and the IP address of the UE, the PGW may request the correspondence between the PGW and the UE from the PGW, or the like. This is not limited in this embodiment.
In a third implementation, the UE sends the encryption context and a connection identifier of the TCP connection to the key server, where the encryption context is forwarded by the key server to the proxy node after the key server determines the proxy node corresponding to the connection identifier, and the proxy node receives the encryption context forwarded by the key server, where the correspondence is used to indicate a relationship between the connection identifier and the proxy node.
After generating the encryption context, the UE may push the encryption context and the IP address of the UE to the key server. The key server stores the correspondence between the PGW and the UE. After receiving the encryption context and the IP address of the UE that are sent by the UE, the key server determines the proxy node according to the UE and the correspondence, and then sends the encryption context to the proxy node. A process of obtaining the correspondence between the PGW and the UE by the key server is described in the second implementation, and details are not described herein.
Optionally, the UE may further push the encryption context and the IP address of the UE to the key server after a trigger condition is met. For example, when the UE detects that a currently accessed network is a third generation (3G for short) mobile communications network, and not a Wireless Fidelity (WiFi for short) network, the UE pushes the encryption context and the IP address of the UE to the key server.
It should be noted that, when the proxy node and the key server are deployed on a same entity, the proxy node and the key server may interact by using an internal module; and data transmitted between the UE and the key server needs to be encrypted. When the proxy node and the key server are deployed on different entities, data transmitted between the proxy node and the key server needs to be encrypted, and data transmitted between the UE and the key server needs to be encrypted. Details are not described in this embodiment.
In addition, when multiple proxy nodes serve the UE simultaneously, to provide the encryption context for the multiple proxy nodes, the UE needs to set up an encrypted connection only to the key server.
Step 307: The proxy node generates a first key according to the encryption context.
When the encryption context obtained by the proxy node is the premaster key, the proxy node may read the first random number, the second random number, and the encryption algorithm that are cached in the process of setting up the first encrypted connection, and generate the first key according to the first random number, the second random number, the premaster key, and the encryption algorithm. Alternatively, when the encryption context obtained by the proxy node includes the first random number, the second random number, the premaster key, and the encryption algorithm, the proxy node directly generates the first key according to the first random number, the second random number, the premaster key, and the encryption algorithm.
Step 308: The UE generates a second key according to the encryption context, where the second key corresponds to the first key.
Step 308 may be performed in the process of setting up the first encrypted connection between the UE and the proxy node.
Step 309: The UE encrypts service information by using the second key, and sends an obtained ciphertext to the proxy node.
Step 310: The proxy node receives the ciphertext sent by the UE, decrypts the ciphertext by using the first key, processes the obtained service information, and sends the processed service information to the network server by using the second encrypted connection.
In this embodiment, the proxy node may selectively process the service information. For example, the proxy node processes service information sent to a network server 1, but does not process service information sent to a network server 2. This is not limited in this embodiment.
Optionally, when the UE roams, the key server and the proxy node may be on a visited network or may be on a home network. This is not limited in this embodiment.
Optionally, after the proxy node sends the service information to the network server by using the second encrypted connection, the proxy node may further receive service data sent by the network server by using the second encrypted connection. The proxy node encrypts the service data by using the first key, and sends an obtained ciphertext to the UE. The UE decrypts the ciphertext by using the second key, to obtain the service data.
Referring to
1. The UE sets up an encrypted connection to the key server, and the TLS proxy sets up an encrypted connection to the key server.
2. The UE sets up a TCP connection to the TLS proxy, and the TLS proxy sets up a TCP connection to the server.
Specifically, the TLS proxy intercepts a TCP setup request sent by the UE to the server, sets up, in place of the server, a TCP connection to the UE according to the IP address of the server, and sets up, in place of the UE, a TCP connection to the server according to the IP address of the UE.
3. The TLS proxy intercepts a TLS protocol version number, an encryption algorithm list, and a first random number that are sent by the UE to the server, and forwards the TLS protocol version number, the encryption algorithm list, and the first random number to the server.
4. If the server supports the TLS protocol version, the server selects an encryption algorithm from the encryption algorithm list, and sends the TLS protocol version number, the encryption algorithm, a session identifier, and a second random number to the UE. The TLS proxy intercepts the TLS protocol version number, the encryption algorithm, the session identifier, and the second random number that are sent by the server to the UE, and forwards the TLS protocol version number, the encryption algorithm, the session identifier, and the second random number to the UE.
5. The server sends a digital certificate to the UE, and the TLS proxy intercepts the digital certificate, and forwards the digital certificate to the UE.
6. The server sends a first complete message to the UE, and the TLS proxy intercepts the first complete message, and forwards the first complete message to the UE.
7. The UE verifies the digital certificate, and after the verification succeeds, obtains a public key in the digital certificate, generates a premaster key, encrypts the premaster key by using the public key, and sends obtained public key exchange information to the server. The TLS proxy intercepts the public key exchange information, and forwards the public key exchange information to the server.
8. The TLS proxy sends an obtaining request to the key server; the key server forwards the obtaining request to the UE; the UE receives the obtaining request forwarded by the key server, and sends an encryption context to the key server; and the key server forwards the encryption context to the TLS proxy. Alternatively, the TLS proxy sends an obtaining request to the UE; the UE receives the obtaining request, and sends an encryption context to the key server; and the key server forwards the encryption context to the TLS proxy. Alternatively, the UE sends an encryption context to the key server; and the key server determines the TLS proxy and forwards the encryption context to the TLS proxy.
9. The UE sends a key change description to the server. The TLS proxy intercepts the key change description, and forwards the key change description to the server.
10. The UE sends a second complete message to the server. The TLS proxy intercepts the second complete message, and forwards the second complete message to the server.
11. The server sends a key change description to the UE. The TLS proxy intercepts the key change description, forwards the key change description to the UE, and instructs the UE to use negotiated parameters.
12. The server sends a third complete message to the UE. The TLS proxy intercepts the third complete message, and forwards the third complete message to the UE.
In summary, in the service processing method provided in this embodiment of the disclosure, a proxy node sets up, in place of a network server, a first encrypted connection to UE, obtains, from the UE, an encryption context generated in the process of setting up the first encrypted connection, and generates a first key according to the encryption context. The proxy node receives a ciphertext sent by the UE, decrypts the ciphertext by using the first key, and processes obtained service information. In this way, the proxy node may obtain the first key that the UE and the network server agree upon, decrypt, by using the first key, the ciphertext sent by the UE to the network server, and process the service information. Therefore, a problem that a proxy node cannot provide service optimization for UE because the proxy node cannot decrypt a ciphertext is resolved, and an effect of expanding a usage scope of service optimization is achieved.
Referring to
Step 401: UE sends a TCP setup request to a network server, where the TCP setup request includes an IP address of the UE and an IP address of the network server.
Step 402: A proxy node intercepts the TCP setup request sent by the UE to the network server.
Content of steps 401 and 402 is the same as content of steps 301 and 302, and details are not described herein.
Step 403: The proxy node sets up, in place of the network server, a TCP connection to the UE according to the IP address of the network server, and sets up a TCP connection to the network server according to an IP address of the proxy node.
For the process in which the proxy node sets up, in place of the network server, the TCP connection to the UE according to the IP address of the network server, refer to the description in step 303. Details are not described herein.
In this embodiment, the proxy node sets up the TCP connection to the network server according to the IP address of the proxy node. This process is the prior art, and details are not described in this embodiment.
Step 404: The UE sends an encryption setup request to the network server by using the TCP connection.
After the TCP connection between the UE and the proxy node and the TCP connection between the proxy node and the network server are set up, a path is formed between the UE, the proxy node, and the network server. In this case, the UE may send the encryption setup connection to the network server by using the TCP connections.
Step 405: The proxy node intercepts the encryption setup request sent by the UE to the network server by using the TCP connection, sets up, in place of the network server, a first encrypted connection to the UE according to the encryption setup request, and sets up a second encrypted connection to the network server according to the IP address of the proxy node.
Because the process of setting up an encrypted connection based on the SSL protocol is similar to the process of setting up an encrypted connection based on the TLS protocol, the following uses an encrypted connection based on the TLS protocol as an example to describe the process in which the proxy node sets up, in place of the network server, the first encrypted connection to the UE according to the encryption setup request.
(1) The proxy node intercepts a TLS protocol version number, an encryption algorithm list, and a first random number that are sent by the UE to the network server.
(2) If the proxy node supports the TLS protocol version, the proxy node selects an encryption algorithm from the encryption algorithm list, and sends the TLS protocol version number, the encryption algorithm, a session identifier, and a second random number to the UE.
(3) The proxy node obtains a digital certificate of the network server, and forwards the digital certificate to the UE.
(4) The proxy node sends a first complete message to the UE.
(5) The UE verifies the digital certificate, and after the verification succeeds, obtains a public key in the digital certificate, generates a premaster key, encrypts the premaster key by using the public key, and sends obtained public key exchange information to the network server.
In this case, the UE generates a second key according to the first random number, the second random number, the premaster key, and the encryption algorithm. In this embodiment, the first random number, the second random number, the premaster key, and the encryption algorithm are referred to as an encryption context, or the premaster key is referred to as an encryption context in this embodiment.
(6) The proxy node intercepts the public key exchange information sent by the UE to the network server.
(7) The proxy node intercepts a key change description sent by the UE to the network server, and instructs the network server to use negotiated parameters.
(8) The proxy node intercepts a second complete message sent by the UE to the network server.
The second complete message includes a hash value, so that the proxy node performs verification according to the hash value. The hash value is obtained by the UE by performing a hash operation on all content sent to the network server.
(9) The proxy node sends a key change description to the UE, and instructs the UE to use negotiated parameters.
(10) The proxy node sends a third complete message to the UE.
The third complete message includes a hash value, so that the UE performs verification according to the hash value. The hash value is obtained by the proxy node by performing a hash operation on all content sent to the UE.
The following uses an encrypted connection based on the TLS protocol as an example to describe the process in which the proxy node sets up the second encrypted connection to the network server according to the IP address of the proxy node.
(1) The proxy node sends a TLS protocol version number, an encryption algorithm list, and a first random number to the network server.
(2) If the network server supports the TLS protocol version, the network server selects an encryption algorithm from the encryption algorithm list, and sends the TLS protocol version number, the encryption algorithm, a session identifier, and a second random number to the proxy node.
(3) The network server sends a digital certificate of the network server to the proxy node.
(4) The network server sends a first complete message to the proxy node.
(5) The proxy node verifies the digital certificate, and after the verification succeeds, obtains a public key in the digital certificate, generates a premaster key, encrypts the premaster key by using the public key, and sends obtained public key exchange information to the network server.
In this case, the proxy node generates a second key according to the first random number, the second random number, the premaster key, and the encryption algorithm. In this embodiment, the first random number, the second random number, the premaster key, and the encryption algorithm are referred to as an encryption context, or the premaster key is referred to as an encryption context in this embodiment.
(6) The proxy node sends the public key exchange information to the network server.
(7) The proxy node sends a key change description to the network server, and instructs the network server to use negotiated parameters.
(8) The proxy node sends a second complete message to the network server.
The second complete message includes a hash value, so that the network server performs verification according to the hash value. The hash value is obtained by the proxy node by performing a hash operation on all content sent to the network server.
(9) The network server sends a key change description to the proxy node, and instructs the proxy node to use negotiated parameters.
(10) The network server sends a third complete message to the proxy node.
The third complete message includes a hash value, so that the proxy node performs verification according to the hash value. The hash value is obtained by the network server by performing a hash operation on all content sent to the UE.
Step 406: The UE provides the proxy node with an encryption context generated in the process of setting up the first encrypted connection.
This embodiment provides three implementations of providing the proxy node with the encryption context by the UE. The following describes the three implementations separately.
In a first implementation, the proxy node sends, to a key server, an obtaining request that carries a connection identifier of the TCP connection, where the obtaining request is used to instruct the key server to determine the UE according to the connection identifier and forward the obtaining request to the UE. The UE receives the obtaining request that carries the connection identifier of the TCP connection and is forwarded by the key server, and sends the encryption context to the key server according to the connection identifier; the key server is configured to forward the encryption context to the proxy node. The proxy node receives the encryption context forwarded by the key server.
In a second implementation, the proxy node sends, to the UE, an obtaining request that carries a connection identifier of the TCP connection. The UE receives the obtaining request that carries the connection identifier of the TCP connection and is sent by the proxy node, and sends the encryption context to a key server according to the connection identifier. The encryption context is used to instruct the key server to forward the encryption context to the proxy node. The proxy node receives the encryption context forwarded by the key server.
In a third implementation, the UE sends the encryption context and a connection identifier of the TCP connection to a key server, where the encryption context is forwarded by the key server to the proxy node after the key server determines the proxy node corresponding to the connection identifier, and the proxy node receives the encryption context forwarded by the key server, where the correspondence is used to indicate a relationship between the connection identifier and the proxy node.
Step 407: The proxy node generates a first key according to the encryption context.
Step 408: The UE generates a second key according to the encryption context, where the second key corresponds to the first key.
Step 409: The UE encrypts service information by using the second key, and sends an obtained ciphertext to the proxy node.
Step 410: The proxy node receives the ciphertext sent by the UE, decrypts the ciphertext by using the first key, processes the obtained service information, and sends the processed service information to the network server by using the second encrypted connection.
Content of steps 406 to 410 is the same as content of steps 306 to 310, and details are not described herein.
Referring to
1. The UE sets up an encrypted connection to the key server, and the TLS proxy sets up an encrypted connection to the key server.
2. The UE sets up a TCP connection to the TLS proxy, and the TLS proxy sets up a TCP connection to the server.
Specifically, the TLS proxy intercepts a TCP setup request sent by the UE to the server, sets up, in place of the server, a TCP connection to the UE according to the IP address of the server, and sets up a TCP connection to the server according to the IP address of the TLS proxy.
3. The TLS proxy intercepts a TLS protocol version number, an encryption algorithm list, and a first random number that are sent by the UE to the server.
4. The TLS proxy sets up a TLS connection to the server according to the IP address of the TLS proxy.
5. If the TLS proxy supports the TLS protocol version, the TLS proxy selects an encryption algorithm from the encryption algorithm list, and sends the TLS protocol version number, the encryption algorithm, a session identifier, and a second random number to the UE.
6. The TLS proxy sends a digital certificate of the server to the UE.
7. The TLS proxy sends a first complete message to the UE.
8. The UE verifies the digital certificate, and after the verification succeeds, obtains a public key in the digital certificate, generates a premaster key, encrypts the premaster key by using the public key, and sends obtained public key exchange information to the server. The TLS proxy intercepts the public key exchange information.
9. The TLS proxy sends an obtaining request to the key server; the key server forwards the obtaining request to the UE; the UE receives the obtaining request forwarded by the key server, and sends an encryption context to the key server; and the key server forwards the encryption context to the TLS proxy. Alternatively, the TLS proxy sends an obtaining request to the UE; the UE receives the obtaining request, and sends an encryption context to the key server; and the key server forwards the encryption context to the TLS proxy. Alternatively, the UE sends an encryption context to the key server; and the key server determines the TLS proxy and forwards the encryption context to the TLS proxy.
10. The UE sends a key change description to the server, and the TLS proxy intercepts the key change description.
11. The UE sends a second complete message to the server, and the TLS proxy intercepts the second complete message.
12. The TLS proxy sends a key change description to the UE, and instructs the UE to use negotiated parameters.
13. The TLS proxy sends a third complete message to the UE.
In summary, in the service processing method provided in this embodiment of the disclosure, a proxy node sets up, in place of a network server, a first encrypted connection to UE, obtains, from the UE, an encryption context generated in the process of setting up the first encrypted connection, and generates a first key according to the encryption context. The proxy node receives a ciphertext sent by the UE, decrypts the ciphertext by using the first key, and processes obtained service information. In this way, the proxy node may obtain the first key that the UE and the network server agree upon, decrypt, by using the first key, the ciphertext sent by the UE to the network server, and process the service information. Therefore, a problem that a proxy node cannot provide service optimization for UE because the proxy node cannot decrypt a ciphertext is resolved, and an effect of expanding a usage scope of service optimization is achieved.
Referring to
Step 501: UE sends a TCP setup request to a tunnel gateway, where the TCP setup request includes an IP address of the UE and an IP address of the tunnel gateway, and the tunnel gateway is located between a proxy node and a network server.
A connect method is used to request to set up a TCP connection to the tunnel gateway to reach any network server and port, so that the tunnel gateway blindly forwards subsequent data between the UE and the network server. The tunnel gateway may be an HTTP proxy.
Step 502: The proxy node intercepts the TCP setup request sent by the UE to the tunnel gateway.
Step 503: The proxy node sets up, in place of the tunnel gateway, a TCP connection to the UE according to the IP address of the tunnel gateway, sets up, in place of the UE, a TCP connection to the tunnel gateway according to the IP address of the UE, and triggers the tunnel gateway to set up a TCP connection to the network server according to the IP address of the tunnel gateway.
Specifically, in a three-way handshake phase of a TCP connection, the proxy node uses the IP address of the tunnel gateway as a source IP address of the proxy node and the IP address of the UE as a destination IP address, interacts with the UE to complete a three-way handshake, and sets up, in place of the tunnel gateway, a TCP connection to the UE.
The proxy node sends a TCP setup request to the tunnel gateway, where a source IP address in the TCP setup request is the IP address of the UE, and a destination IP address is the IP address of the tunnel gateway. In a three-way handshake phase of a TCP connection, the proxy node uses the IP address of the UE as a source IP address of the proxy node and the IP address of the tunnel gateway as a destination IP address, interacts with the tunnel gateway to complete a three-way handshake, and sets up, in place of the UE, a TCP connection to the tunnel gateway.
In addition, the tunnel gateway further needs to send a TCP setup request to the network server. This process is the prior art, and details are not described in this embodiment.
Step 504: The UE sends an encryption setup request to the tunnel gateway by using the TCP connection, where the encryption setup request includes the IP address of the UE and an IP address of the network server.
After the TCP connection between the UE and the proxy node, the TCP connection between the proxy node and the tunnel gateway, and the TCP connection between the tunnel gateway and the network server are set up, a path is formed between the UE, the proxy node, the tunnel gateway, and the network server. In this case, the UE may send the encryption setup connection to the network server by using the TCP connections.
Step 505: The proxy node intercepts the encryption setup request sent by the UE to the tunnel gateway by using the TCP connection.
In this embodiment, because the UE cannot perceive existence of the proxy node, the UE considers that a TCP connection is set up to the tunnel gateway. Therefore, the UE sends the encryption setup request to the tunnel gateway by using the TCP connection, so that the tunnel gateway blindly forwards the encryption setup request to the network server. In this case, the proxy node may intercept the encryption setup request sent by the UE to the tunnel gateway by using the TCP connection.
When a domain name of the network server is www.ottserver.com, a connection method is: CONNECT www.ottserver.com:443 HTTP1.1. Certainly, the HTTP protocol version may be another protocol version in addition to 1.1, and is not limited in this embodiment.
Step 506: The proxy node sets up, in place of the network server, a first encrypted connection to the UE according to the IP address of the network server, and forwards the encryption setup request to the tunnel gateway by using the TCP connection, where the tunnel gateway is configured to forward the encryption setup request to the network server by using the TCP connection, and the encryption setup request is used to instruct the network server to set up a second encrypted connection to the proxy node that is in place of the UE.
For the process in which the proxy node sets up, in place of the network server, the first encrypted connection to the UE according to the IP address of the network server, refer to the description in step 305. Details are not described herein.
The proxy node further needs to forward the encryption setup request to the tunnel gateway. The tunnel gateway blindly forwards the encryption setup request to the network server. The network server sets up, according to the IP address of the UE that is carried in the encryption setup request, the second encrypted connection to the proxy node that is in place of the UE. For the process in which the proxy node sets up, in place of the UE, the second encrypted connection to the network server, refer to the description in step 305. Details are not described herein.
Step 507: The UE provides the proxy node with an encryption context generated in the process of setting up the first encrypted connection.
This embodiment provides three implementations of providing the proxy node with the encryption context by the UE. The following describes the three implementations separately.
In a first implementation, the proxy node sends, to a key server, an obtaining request that carries a connection identifier of the TCP connection, where the obtaining request is used to instruct the key server to determine the UE according to the connection identifier and forward the obtaining request to the UE. The UE receives the obtaining request that carries the connection identifier of the TCP connection and is forwarded by the key server, and sends the encryption context to the key server according to the connection identifier; the key server is configured to forward the encryption context to the proxy node. The proxy node receives the encryption context forwarded by the key server.
In a second implementation, the proxy node sends, to the UE, an obtaining request that carries a connection identifier of the TCP connection. The UE receives the obtaining request that carries the connection identifier of the TCP connection and is sent by the proxy node, and sends the encryption context to a key server according to the connection identifier. The encryption context is used to instruct the key server to forward the encryption context to the proxy node. The proxy node receives the encryption context forwarded by the key server.
In a third implementation, the UE sends the encryption context and a connection identifier of the TCP connection to a key server, where the encryption context is forwarded by the key server to the proxy node after the key server determines the proxy node corresponding to the connection identifier, and the proxy node receives the encryption context forwarded by the key server, where the correspondence is used to indicate a relationship between the connection identifier and the proxy node.
Step 508: The proxy node generates a first key according to the encryption context.
Step 509: The UE generates a second key according to the encryption context, where the second key corresponds to the first key.
Step 510: The UE encrypts service information by using the second key, and sends an obtained ciphertext to the proxy node.
Step 511: The proxy node receives the ciphertext sent by the UE, decrypts the ciphertext by using the first key, processes the obtained service information, and sends the processed service information to the network server by using the second encrypted connection.
Content of steps 507 to 511 is the same as content of steps 306 to 310, and details are not described herein.
Referring to
1. The UE sets up an encrypted connection to the key server, and the TLS proxy sets up an encrypted connection to the key server.
2. The UE sets up a TCP connection to the TLS proxy, the TLS proxy sets up a TCP connection to the HTTP proxy, and the HTTP proxy sets up a TCP connection to the server.
Specifically, the TLS proxy intercepts a TCP setup request sent by the UE to the HTTP proxy, sets up, in place of the HTTP proxy, a TCP connection to the UE according to the IP address of the HTTP proxy, and sets up, in place of the UE, a TCP connection to the HTTP proxy according to the IP address of the UE. The HTTP proxy sets up a TCP connection to the server.
3. The TLS proxy intercepts a TLS protocol version number, an encryption algorithm list, and a first random number that are sent by the UE to the HTTP proxy, and forwards the TLS protocol version number, the encryption algorithm list, and the first random number to the HTTP proxy. The HTTP proxy forwards the TLS protocol version number, the encryption algorithm list, and the first random number to the server.
4. If the server supports the TLS protocol version, the server selects an encryption algorithm from the encryption algorithm list, and sends the TLS protocol version number, the encryption algorithm, a session identifier, and a second random number to the HTTP proxy. The TLS proxy intercepts the TLS protocol version number, the encryption algorithm, the session identifier, and the second random number that are sent by the HTTP proxy to the UE, and forwards the TLS protocol version number, the encryption algorithm, the session identifier, and the second random number to the UE.
5. The server sends a digital certificate to the HTTP proxy. The TLS proxy intercepts the digital certificate forwarded by the HTTP proxy to the UE, and forwards the digital certificate to the UE.
6. The server sends a first complete message to the HTTP proxy. The TLS proxy intercepts the first complete message forwarded by the HTTP proxy to the UE, and forwards the first complete message to the UE.
7. The UE verifies the digital certificate, and after the verification succeeds, obtains a public key in the digital certificate, generates a premaster key, encrypts the premaster key by using the public key, and sends obtained public key exchange information to the HTTP proxy. The TLS proxy intercepts the public key exchange information, and forwards the public key exchange information to the HTTP proxy. The HTTP proxy forwards the public key exchange information to the server.
8. The TLS proxy sends an obtaining request to the key server; the key server forwards the obtaining request to the UE; the UE receives the obtaining request forwarded by the key server, and sends an encryption context to the key server; and the key server forwards the encryption context to the TLS proxy. Alternatively, the TLS proxy sends an obtaining request to the UE; the UE receives the obtaining request, and sends an encryption context to the key server; and the key server forwards the encryption context to the TLS proxy. Alternatively, the UE sends an encryption context to the key server; and the key server determines the TLS proxy and forwards the encryption context to the TLS proxy.
9. The UE sends a key change description to the HTTP proxy. The TLS proxy intercepts the key change description, and forwards the key change description to the HTTP proxy. The HTTP proxy forwards the key change description to the server.
10. The UE sends a second complete message to the HTTP proxy. The TLS proxy intercepts the second complete message, and forwards the second complete message to the HTTP proxy. The HTTP proxy forwards the second complete message to the server.
11. The server sends a key change description to the HTTP proxy. The TLS proxy intercepts the key change description forwarded by the HTTP proxy to the UE, forwards the key change description to the UE, and instructs the UE to use negotiated parameters.
12. The server sends a third complete message to the HTTP proxy. The TLS proxy intercepts the third complete message forwarded by the HTTP proxy to the UE, and forwards the third complete message to the UE.
In summary, in the service processing method provided in this embodiment of the disclosure, a proxy node sets up, in place of a network server, a first encrypted connection to UE, obtains, from the UE, an encryption context generated in the process of setting up the first encrypted connection, and generates a first key according to the encryption context. The proxy node receives a ciphertext sent by the UE, decrypts the ciphertext by using the first key, and processes obtained service information. In this way, the proxy node may obtain the first key that the UE and the network server agree upon, decrypt, by using the first key, the ciphertext sent by the UE to the network server, and process the service information. Therefore, a problem that a proxy node cannot provide service optimization for UE because the proxy node cannot decrypt a ciphertext is resolved, and an effect of expanding a usage scope of service optimization is achieved.
Referring to
Step 601: UE sets up a TCP connection to a tunnel gateway, where the tunnel gateway is configured to send a TCP setup request to a network server, the TCP setup request includes an IP address of the tunnel gateway and an IP address of the network server, and the tunnel gateway is located between the UE and a proxy node.
Because the tunnel gateway is located between the UE and the proxy node, the UE first sets up a TCP connection to the tunnel gateway. The TCP connection setup process is the prior art, and details are not described herein. After the TCP connection between the UE and the tunnel gateway is set up, the tunnel gateway needs to set up a TCP connection to the network server to ensure that a path is formed between the UE and the tunnel gateway and between the tunnel gateway and the network server.
Step 602: The proxy node intercepts the TCP setup request sent by the tunnel gateway to the network server.
Step 603: The proxy node sets up, in place of the network server, a TCP connection to the tunnel gateway according to the IP address of the network server, and sets up, in place of the tunnel gateway, a TCP connection to the network server according to the IP address of the tunnel gateway.
Specifically, in a three-way handshake phase of a TCP connection, the proxy node uses the IP address of the network server as a source IP address of the proxy node and the IP address of the tunnel gateway as a destination IP address, interacts with the tunnel gateway to complete a three-way handshake, and sets up, in place of the network server, a TCP connection to the tunnel gateway.
The proxy node sends a TCP setup request to the network server, where a source IP address in the TCP setup request is the IP address of the tunnel gateway, and a destination IP address is the IP address of the network server. In a three-way handshake phase of a TCP connection, the proxy node uses the IP address of the tunnel gateway as a source IP address of the proxy node and the IP address of the network server as a destination IP address, interacts with the network server to complete a three-way handshake, and sets up, in place of the tunnel gateway, a TCP connection to the network server.
Step 604: The UE sends an encryption setup request to the tunnel gateway by using the TCP connection, where the encryption setup request is used to instruct the tunnel gateway to forward the encryption setup request to the network server, and the encryption setup request includes an IP address of the UE and the IP address of the network server.
After the TCP connection between the UE and the proxy node, the TCP connection between the proxy node and the tunnel gateway, and the TCP connection between the tunnel gateway and the network server are set up, a path is formed between the UE, the proxy node, the tunnel gateway, and the network server. In this case, the UE may send the encryption setup connection to the network server by using the TCP connections.
Step 605: The proxy node intercepts the encryption setup request sent by the tunnel gateway to the network server by using the TCP connection.
Step 606: The proxy node sets up, in place of the network server, a first encrypted connection to the UE according to the IP address of the network server, and forwards the encryption setup request to the network server by using the TCP connection, where the encryption setup request is used to instruct the network server to set up a second encrypted connection to the proxy node that is in place of the UE.
For the process in which the proxy node sets up, in place of the network server, the first encrypted connection to the UE according to the IP address of the network server, refer to the description in step 305. Details are not described herein.
The proxy node further needs to forward the encryption setup request to the network server, and the network server sets up, according to the IP address of the UE that is carried in the encryption setup request, the second encrypted connection to the proxy node that is place of the UE. For the process in which the proxy node sets up, in place of the UE, the second encrypted connection to the network server, refer to the description in step 305. Details are not described herein.
Step 607: The UE provides the proxy node with an encryption context generated in the process of setting up the first encrypted connection.
This embodiment provides three implementations of providing the proxy node with the encryption context by the UE. The following describes the three implementations separately.
In a first implementation, the proxy node sends, to a key server, an obtaining request that carries a connection identifier of the TCP connection, where the obtaining request is used to instruct the key server to determine the UE according to the connection identifier and forward the obtaining request to the UE. The UE receives the obtaining request that carries the connection identifier of the TCP connection and is forwarded by the key server, and sends the encryption context to the key server according to the connection identifier; the key server is configured to forward the encryption context to the proxy node. The proxy node receives the encryption context forwarded by the key server.
In a second implementation, the proxy node sends, to the UE, an obtaining request that carries a connection identifier of the TCP connection. The UE receives the obtaining request that carries the connection identifier of the TCP connection and is sent by the proxy node, and sends the encryption context to a key server according to the connection identifier. The encryption context is used to instruct the key server to forward the encryption context to the proxy node. The proxy node receives the encryption context forwarded by the key server.
In a third implementation, the UE sends the encryption context and a connection identifier of the TCP connection to a key server, where the encryption context is forwarded by the key server to the proxy node after the key server determines the proxy node corresponding to the connection identifier, and the proxy node receives the encryption context forwarded by the key server, where the correspondence is used to indicate a relationship between the connection identifier and the proxy node.
Step 608: The proxy node generates a first key according to the encryption context.
Step 609: The UE generates a second key according to the encryption context, where the second key corresponds to the first key.
Step 610: The UE encrypts service information by using the second key, and sends an obtained ciphertext to the proxy node.
Step 611: The proxy node receives the ciphertext sent by the UE, decrypts the ciphertext by using the first key, processes the obtained service information, and sends the processed service information to the network server by using the second encrypted connection.
Content of steps 607 to 611 is the same as content of steps 306 to 310, and details are not described herein.
Referring to
1. The UE sets up an encrypted connection to the key server, and the TLS proxy sets up an encrypted connection to the key server.
2. The UE sets up a TCP connection to the HTTP proxy; the HTTP proxy sets up a TCP connection to the TLS proxy; and the TLS proxy sets up a TCP connection to the server.
Specifically, the TLS proxy intercepts a TCP setup request sent by the HTTP proxy to the server, sets up, in place of the server, a TCP connection to the HTTP proxy according to the IP address of the server, and sets up, in place of the HTTP proxy, a TCP connection to the server according to the IP address of the HTTP proxy.
3. The UE sends a TLS protocol version number, an encryption algorithm list, and a first random number to the HTTP proxy. The TLS proxy intercepts the TLS protocol version number, the encryption algorithm list, and the first random number that are forwarded by the HTTP proxy to the server, and forwards the TLS protocol version number, the encryption algorithm list, and the first random number to the server.
4. If the server supports the TLS protocol version, the server selects an encryption algorithm from the encryption algorithm list. The TLS proxy intercepts the TLS protocol version number, the encryption algorithm, a session identifier, and a second random number that are sent by the server to the HTTP proxy, and forwards the TLS protocol version number, the encryption algorithm, the session identifier, and the second random number to the HTTP proxy. The HTTP proxy forwards the TLS protocol version number, the encryption algorithm, the session identifier, and the second random number to the UE.
5. The TLS proxy intercepts a digital certificate sent by the server to the HTTP proxy, and forwards the digital certificate to the HTTP proxy. The HTTP proxy forwards the digital certificate to the UE.
6. The TLS proxy intercepts a first complete message sent by the server to the HTTP proxy. The TLS proxy forwards the first complete message to the HTTP proxy. The HTTP proxy forwards the first complete message to the UE.
7. The UE verifies the digital certificate, and after the verification succeeds, obtains a public key in the digital certificate, generates a premaster key, encrypts the premaster key by using the public key, and sends obtained public key exchange information to the HTTP proxy. The TLS proxy intercepts the public key exchange information that is forwarded by the HTTP proxy to the server, and forwards the public key exchange information to the server.
8. The TLS proxy sends an obtaining request to the key server; the key server forwards the obtaining request to the UE; the UE receives the obtaining request forwarded by the key server, and sends an encryption context to the key server; and the key server forwards the encryption context to the TLS proxy. Alternatively, the TLS proxy sends an obtaining request to the UE; the UE receives the obtaining request, and sends an encryption context to the key server; and the key server forwards the encryption context to the TLS proxy. Alternatively, the UE sends an encryption context to the key server; and the key server determines the TLS proxy and forwards the encryption context to the TLS proxy.
9. The UE sends a key change description to the HTTP proxy. The TLS proxy intercepts the key change description that is forwarded by the HTTP proxy to the server, and forwards the key change description to the server.
10. The UE sends a second complete message to the HTTP proxy. The TLS proxy intercepts the second complete message, and forwards the second complete message to the HTTP proxy. The HTTP proxy forwards the second complete message to the server.
11. The TLS proxy intercepts a key change description sent by the server to the HTTP proxy. The TLS proxy forwards the key change description to the HTTP proxy. The HTTP proxy forwards the key change description to the UE, and instructs the UE to use negotiated parameters.
12. The TLS proxy intercepts a third complete message sent by the server to the HTTP proxy. The TLS proxy forwards the third complete message to the HTTP proxy. The HTTP proxy forwards the third complete message to the UE.
In summary, in the service processing method provided in this embodiment of the disclosure, a proxy node sets up, in place of a network server, a first encrypted connection to UE, obtains, from the UE, an encryption context generated in the process of setting up the first encrypted connection, and generates a first key according to the encryption context. The proxy node receives a ciphertext sent by the UE, decrypts the ciphertext by using the first key, and processes obtained service information. In this way, the proxy node may obtain the first key that the UE and the network server agree upon, decrypt, by using the first key, the ciphertext sent by the UE to the network server, and process the service information. Therefore, a problem that a proxy node cannot provide service optimization for UE because the proxy node cannot decrypt a ciphertext is resolved, and an effect of expanding a usage scope of service optimization is achieved.
Referring to
In summary, the service processing apparatus provided in this embodiment of the disclosure sets up, in place of a network server, a first encrypted connection to UE, obtains, from the UE, an encryption context generated in the process of setting up the first encrypted connection, and generates a first key according to the encryption context. The service processing apparatus receives a ciphertext sent by the UE, decrypts the ciphertext by using the first key, and processes obtained service information. In this way, the service processing apparatus may obtain the first key that the UE and the network server agree upon, decrypt, by using the first key, the ciphertext sent by the UE to the network server, and process the service information. Therefore, a problem that a proxy node cannot provide service optimization for UE because the proxy node cannot decrypt a ciphertext is resolved, and an effect of expanding a usage scope of service optimization is achieved.
Referring to
In a first possible implementation, the connection setup module 710 is specifically configured to:
In a second possible implementation, the connection setup module 710 is specifically configured to:
In a third possible implementation, the connection setup module 710 is specifically configured to:
In a fourth possible implementation, the key generation module 720 is specifically configured to:
In summary, the service processing apparatus provided in this embodiment of the disclosure sets up, in place of a network server, a first encrypted connection to UE, obtains, from the UE, an encryption context generated in the process of setting up the first encrypted connection, and generates a first key according to the encryption context. The service processing apparatus receives a ciphertext sent by the UE, decrypts the ciphertext by using the first key, and processes obtained service information. In this way, the service processing apparatus may obtain the first key that the UE and the network server agree upon, decrypt, by using the first key, the ciphertext sent by the UE to the network server, and process the service information. Therefore, a problem that a proxy node cannot provide service optimization for UE because the proxy node cannot decrypt a ciphertext is resolved, and an effect of expanding a usage scope of service optimization is achieved.
Referring to
In summary, the service processing apparatus provided in this embodiment of the disclosure sets up a first encrypted connection to a proxy node that is in place of a network server, and provides the proxy node with an encryption context that is generated in the process of setting up the first encrypted connection, where the encryption context is used to instruct the proxy node to generate a first key according to the encryption context. The service processing apparatus encrypts service information by using a second key, and sends an obtained ciphertext to the proxy node, where the ciphertext is used to instruct the proxy node to decrypt the ciphertext by using the first key, and process the obtained service information, Therefore, a problem that a proxy node cannot provide service optimization for UE because the proxy node cannot decrypt a ciphertext is resolved, and an effect of expanding a usage scope of service optimization is achieved.
Referring to
In a first possible implementation, the connection setup module 810 is specifically configured to:
In a second possible implementation, the connection setup module 810 is specifically configured to:
In a third possible implementation, the connection setup module 810 is specifically configured to:
In a fourth possible implementation, the key providing module 820 is specifically configured to:
In summary, the service processing apparatus provided in this embodiment of the disclosure sets up a first encrypted connection to a proxy node that is in place of a network server, and provides the proxy node with an encryption context that is generated in the process of setting up the first encrypted connection, where the encryption context is used to instruct the proxy node to generate a first key according to the encryption context. The service processing apparatus encrypts service information by using a second key, and sends an obtained ciphertext to the proxy node, where the ciphertext is used to instruct the proxy node to decrypt the ciphertext by using the first key, and process the obtained service information, Therefore, a problem that a proxy node cannot provide service optimization for UE because the proxy node cannot decrypt a ciphertext is resolved, and an effect of expanding a usage scope of service optimization is achieved.
Referring to
When the service processing apparatus is applied to a proxy node:
In a first possible implementation, the receiver 905 is further configured to intercept a TCP setup request sent by the UE to the network server, where the TCP setup request includes an IP address of the UE and an IP address of the network server;
In a second possible implementation, the receiver 905 is further configured to intercept a TCP setup request sent by the UE to a tunnel gateway, where the TCP setup request includes an IP address of the UE and an IP address of the tunnel gateway, and the tunnel gateway is located between the proxy node and the network server;
In a third possible implementation, the receiver 905 is further configured to intercept a TCP setup request sent by a tunnel gateway to the network server, where the TCP setup request is sent after the tunnel gateway sets up a TCP connection to the UE, the TCP setup request includes an IP address of the tunnel gateway and an IP address of the network server, and the tunnel gateway is located between the UE and the proxy node;
In a fourth possible implementation, the transmitter 904 is further configured to send, to a key server, an obtaining request that carries a connection identifier of the TCP connection, where the obtaining request is used to instruct the key server to determine the UE according to the connection identifier, forward the obtaining request to the UE, receive the encryption context sent by the UE according to the connection identifier, and forward the encryption context to the proxy node; and the receiver 905 is further configured to receive the encryption context forwarded by the key server; or
When the service processing apparatus is applied to UE:
In a first possible implementation, the transmitter 904 is further configured to send a TCP setup request to the network server, where the TCP setup request includes an IP address of the UE and an IP address of the network server;
In a second possible implementation, the transmitter 904 is further configured to send a TCP setup request to a tunnel gateway, where the TCP setup request includes an IP address of the UE and an IP address of the tunnel gateway, and the tunnel gateway is located between the proxy node and the network server;
In a third possible implementation, the processor 902 is further configured to set up a TCP connection to a tunnel gateway, where the tunnel gateway is configured to send a TCP setup request to the network server, the TCP setup request includes an IP address of the tunnel gateway and an IP address of the network server, the tunnel gateway is configured to set up, according to the IP address of the network server that is obtained by the proxy node after the proxy node intercepts the TCP setup request, a TCP connection to the proxy node that is in place of the network server, the proxy node is configured to set up, in place of the tunnel gateway, a TCP connection to the network server according to the IP address of the tunnel gateway, and the tunnel gateway is located between the UE and the proxy node;
In a fourth possible implementation, the receiver 905 is configured to receive an obtaining request that carries a connection identifier of the TCP connection and is forwarded by a key server, and the transmitter 904 is further configured to send the encryption context to the key server according to the connection identifier, where the encryption context is used to instruct the key server to forward the encryption context to the proxy node, and the obtaining request is sent by the proxy node to the key server and is sent by the key server after the key server determines the UE according to the connection identifier; or
In summary, the service processing apparatus provided in this embodiment of the disclosure sets up, in place of a network server, a first encrypted connection to UE, obtains, from the UE, an encryption context generated in the process of setting up the first encrypted connection, and generates a first key according to the encryption context. The service processing apparatus receives a ciphertext sent by the UE, decrypts the ciphertext by using the first key, and processes obtained service information. In this way, the service processing apparatus may obtain the first key that the UE and the network server agree upon, decrypt, by using the first key, the ciphertext sent by the UE to the network server, and process the service information. Therefore, a problem that a proxy node cannot provide service optimization for UE because the proxy node cannot decrypt a ciphertext is resolved, and an effect of expanding a usage scope of service optimization is achieved.
It should be noted that, when the service processing apparatus provided by the foregoing embodiments performs service processing, division of the foregoing functional modules is used only as an example for description. In an actual application, the foregoing functions may be allocated to different functional modules and implemented according to a requirement, that is, an internal structure of the service processing apparatus is divided into different functional modules for implementing all or some of the functions described above. In addition, the embodiments of the service processing apparatus and the service processing method provided in the foregoing embodiments belong to a same concept. For a specific implementation process thereof, refer to the method embodiment. Details are not described herein.
The sequence numbers of the foregoing embodiments of the disclosure are merely for illustrative purposes, and are not intended to indicate priorities of the embodiments.
A person of ordinary skill in the art may be aware that, in combination with the examples described in the embodiments disclosed in this specification, units and algorithm steps may be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are performed by hardware or software depends on particular applications and design constraint conditions of the technical solutions. A person skilled in the art may use different methods to implement the described functions for each particular application, but it should not be considered that the implementation goes beyond the scope of the disclosure.
It may be clearly understood by a person skilled in the art that, for the purpose of convenient and brief description. For a specific working process of the foregoing system, apparatus, and unit, refer to a corresponding process in the foregoing method embodiments. Details are not described herein again.
In the several embodiments provided in this application, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the described apparatus embodiment is merely an example. For example, the unit division may merely be logical function division and may be other division in actual implementation. For example, a plurality of units or components may be combined or integrated into another system, or some features may be ignored or not performed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections may be implemented by using some interfaces. The indirect couplings or communication connections between the apparatuses or units may be implemented in electronic, mechanical, or other forms.
The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one position, or may be distributed on a plurality of network units. Some or all of the units may be selected according to actual requirements to achieve the objectives of the solutions of the embodiments.
In addition, functional units in the embodiments of the disclosure may be integrated into one processing unit, or each of the units may exist alone physically, or two or more units are integrated into one unit.
When the functions are implemented in the form of a software functional unit and sold or used as an independent product, the functions may be stored in a computer-readable storage medium. Based on such an understanding, the technical solutions of the disclosure essentially, or the part contributing to the prior art, or some of the technical solutions may be implemented in a form of a software product. The software product is stored in a storage medium, and includes several instructions for instructing a computer device (which may be a personal computer, a server, or a network device) to perform all or some of the steps of the methods described in the embodiments of the disclosure. The foregoing storage medium includes: any medium that can store program code, such as a USB flash drive, a removable hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disc.
The foregoing descriptions are merely specific implementations of the disclosure, but are not intended to limit the protection scope of the disclosure. Any variation or replacement readily figured out by a person skilled in the art within the technical scope disclosed in the disclosure shall fall within the protection scope of the disclosure. Therefore, the protection scope of the disclosure shall be subject to the protection scope of the claims.
This application is a continuation of International Patent Application No. PCT/CN2015/088032, filed on Aug. 25, 2015, the disclosure of which is hereby incorporated by reference in its entirety.
| Number | Date | Country | |
|---|---|---|---|
| Parent | PCT/CN2015/088032 | Aug 2015 | US |
| Child | 15897661 | US |
