WO2018018640A1 - Information interaction method, device and system - Google Patents

Abstract

Provided are an information interaction method, device and system, relating to the technical field of communications. The method comprises: a source server receiving a session password acquisition request sent by a proxy server; the source server determining whether to allow the proxy of the proxy server; and when it is determined that the proxy of the proxy server is allowed, the source server sending a session password to the proxy server, wherein the session password is a session password appointed by the source server and a client during the process of establishing a hyper text transfer protocol over secure socket layer (HTTPS) connection, and the session password is used for triggering the proxy server to provide an HTTPS service for the client. The problem in the relevant art that when a source server needs to firstly pre-send a session password to a proxy server, session password leakage is easily caused where there are more proxy servers is solved, and the effect of improving the security of a session password is achieved.

Description

Information interaction method, device and system Technical field

The present invention relates to the field of communications technologies, and in particular, to an information interaction method, apparatus, and system.

Background technique

In order to ensure the security of data transmission on the Internet, more websites use the hypertext transfer protocol over secure socket layer (HTTPS). During the process of establishing a connection between the client and the source server, the client and the source server use a secure sockets layer (SSL) handshake protocol to agree on the session password, and the source server and the client respectively transmit using the agreed session password pair. The content is encrypted to ensure the security of data transmission between the source server and the client.

In the related art, in order to implement a proxy server instead of a source server to provide an HTTPS service for a client, a secure channel is established between the source server and the proxy server. In the case where the source server trusts the proxy server, the source server sends the session password to the proxy server over a secure channel. After receiving the session password, the proxy server uses the session password to parse the HTTPS packet sent by the client to obtain the HTTPS packet content, and determines the HTTPS service data corresponding to the HTTPS packet content. Then, the proxy server encrypts the HTTPS service data by using the session password, and sends the encrypted HTTPS service data to the client to provide an HTTPS service for the client.

In the process of implementing the present invention, the inventors have found that the related art has at least the following problem: the source server needs to send the session password to the proxy server in advance, and in the case where there are many proxy servers, the session password is easily leaked.

Summary of the invention

In order to solve the problem that the source server needs to send the session password to the proxy server in advance in the related art, in the case that there are many proxy servers, the session password is easily leaked. The embodiment of the present invention provides an information interaction method, device and system. The technical solution is as follows:

In a first aspect, an information interaction method is provided, which is applied to a source server, the method comprising: receiving a session password acquisition request sent by a proxy server; determining whether the proxy server proxy is allowed; and determining that the proxy server proxy is allowed Sending a session password to the proxy server. The session password is a session password agreed by the source server and the client in establishing an HTTPS connection, and the session password is used to trigger the proxy server to provide an HTTPS service for the client. The source server determines whether to allow the proxy server proxy when receiving the session password acquisition request sent by the proxy server. When determining that the proxy proxy is allowed, the source server sends the session password to the proxy server, which solves the related art. The source server needs to send the session password to the proxy server in advance. In the case of a large number of proxy servers, the problem of session password leakage is easily caused, and the security of the session password is improved.

In conjunction with the first aspect, in a first possible implementation of the first aspect, the determining whether to allow the proxy server proxy comprises: obtaining reference information from the session password acquisition request, the reference information including at least an agent At least one of information of the server, information of the client included in the session password acquisition request, and a local state of the source server; determining whether to allow the proxy server proxy according to the reference information and the local policy of the source server, A first determination result is obtained, wherein the first determination result is that the proxy server agent is allowed, or whether the proxy server proxy is allowed to be based on the content of the HTTPS message or the proxy proxy is prohibited.

With reference to the first aspect or the first possible implementation of the first aspect, in a second possible implementation, the determining, according to the reference information and the local policy of the source server, whether to allow the proxy server proxy to obtain the first The determining result includes: acquiring the number of HTTPS connections established by the source server, determining, when the quantity is greater than the first predetermined threshold, the first determination result to allow the proxy server proxy; or acquiring the The load rate of the source server, when the load rate is greater than a second predetermined threshold, determining the first determination result to allow the proxy server proxy.

With reference to the first aspect, the first possible implementation of the first aspect, or the second possible implementation of the first aspect, in a third possible implementation, the determining according to the reference information and the local policy of the source server Whether the proxy server agent is allowed to obtain the first determination result includes: obtaining a blacklist and/or a whitelist defined by the source server; and when the information included in the reference information is located in the whitelist, Determining, by the first determination result, that the proxy server agent is allowed; or, when the reference information includes information located in the blacklist, determining the first determination result as disabling the proxy server proxy; or, when When the information included in the reference information is not located in the white list and is not located in the blacklist, determining the first determination result that it is required to determine whether to allow the proxy server proxy based on the HTTPS message content, where The information contained in the reference information includes at least one of information of the proxy server and information of the client.

Combining the first aspect, the first possible implementation of the first aspect or the second possibility of the first aspect Or a third possible implementation of the first aspect, in a fourth possible implementation, the method further comprising: when the first determination result is to allow the proxy server proxy, to the proxy server Sending a session password agreed with the client; or, when the first determination result is that it is determined whether to allow the proxy server proxy based on the content of the HTTPS packet, waiting to receive the client transparently transmitted by the proxy server Sending an HTTPS message, after receiving the HTTPS message sent by the client transparently transmitted by the proxy server, determining whether to allow the proxy server according to the received HTTPS message, and determining that the proxy is allowed When the server proxyes, the session password agreed with the client is sent to the proxy server. Since the session password is sent to the proxy server when the first determination result is to allow the proxy server proxy or to determine whether to allow the proxy proxy based on the HTTPS message content, the proxy server can use the session password instead of the source server to provide the HTTPS service to the client. .

With reference to the first aspect, the first possible implementation of the first aspect or the second possible implementation of the first aspect or the third possible implementation of the first aspect or the fourth possible implementation of the first aspect, In a fifth possible implementation, after the determining, according to the received HTTPS message, whether the proxy server is allowed, the method further includes: when determining to prohibit the proxy server proxy, to the proxy server Sending a second determination result indicating that the proxy server agent is prohibited, and the second determination result is used to trigger the proxy server to delete the cached HTTPS message of the client. When the second determination result is that the proxy server agent is prohibited, the second determination result indicating that the proxy server proxy is prohibited is sent to the proxy server, and after receiving the second determination result, the proxy server becomes transparent between the source server and the client. The proxy transparently transmits data between the source server and the client so that the source server can provide the HTTPS service to the client.

The second aspect provides an information interaction method, which is applied to a proxy server, where the method includes: receiving a setup request sent by a client for requesting to establish an HTTPS connection; and sending a session password acquisition request to the source server, where the session password is Obtaining a request for triggering the source server to determine whether to permit the proxy server proxy; when the source server allows the proxy server proxy, obtaining the source server and the client from the source server are establishing the The session password agreed upon in the HTTPS connection process; the HTTPS service is provided to the client by using the session password. Because the session password acquisition request is sent to the source server, the session password acquisition request triggers the source server to determine whether to allow the proxy server proxy in real time. In the case that the source server allows the proxy server proxy, the proxy server can obtain the session password from the source server, and the related technology is solved. The medium source server needs to send the session password to the proxy server in advance. In the case of a large number of proxy servers, the session password is easily leaked. The effect of improving session password security is achieved.

With reference to the second aspect, in a first possible implementation of the second aspect, the obtaining, by the source server, the session password that is agreed between the source server and the client in establishing the HTTPS connection, includes: Receiving the session password sent by the source server, where the session password is sent after the source server determines to allow the proxy server proxy and the session password is agreed with the client; or, the received session The HTTPS packet sent by the client is transparently transmitted to the source server, and the session password is sent by the source server. The session password is obtained by the source server after receiving the HTTPS packet according to the HTTPS. The message content is determined to be sent when the proxy server is allowed to proxy.

With reference to the second aspect or the first possible implementation of the second aspect, in a second possible implementation, the method further includes: after the sending the session password acquisition request to the source server, the method further The method includes: receiving a first determination result sent by the source server, where the first determination result is a first determination that is obtained when the source server determines whether to allow the proxy server proxy after receiving the session password acquisition request As a result, when the first determination result is that the proxy server agent is allowed to determine whether to allow the proxy server proxy based on the HTTPS message content, the received HTTPS packet sent by the client is cached. By determining whether to allow the proxy server proxy based on the content of the HTTPS message in the first determination result, the HTTPS message sent by the received client is cached, so that the subsequent proxy server receives the source. When the session password is sent by the server, the HTTPS message is parsed by the session password to provide the HTTPS service for the client.

With reference to the second aspect, the first possible implementation of the second aspect, or the second possible implementation of the second aspect, in a third possible implementation, the HTTPS sent by the client to be received After the packet is transparently transmitted to the source server, the method further includes: receiving a second determination result sent by the source server, where the second determination result is that the source server receives the HTTPS packet, according to the The content of the HTTPS message is determined whether the proxy server is allowed to be obtained. When the second determination result is that the proxy proxy is disabled, the cached HTTPS packet sent by the client is deleted. When the second determination result is that the proxy server proxy is disabled, the cached HTTPS packet is deleted, which saves the storage space of the proxy server.

With reference to the second aspect, the first possible implementation of the second aspect, or the second possible implementation of the second aspect, or the third possible implementation of the second aspect, in a fourth possible implementation, the slave Obtaining, by the source server, the source server and the client during a process of establishing the HTTPS connection The session password includes: determining whether the agent negotiation process needs to be started according to the local policy, and acquiring, when the agent negotiation process needs to be started, acquiring, by the source server, the source server and the client in the process of establishing the HTTPS connection The session password; the method further comprising: updating the local policy with the cause information when the first determination result is that the proxy server agent is prohibited and the reason information of the proxy server agent is prohibited.

The third aspect provides an information interaction apparatus, which is applied to a source server, where the apparatus includes: a receiving unit, configured to receive a session password acquisition request sent by the proxy server; and an execution unit, configured to determine whether the proxy server proxy is allowed a sending unit, configured to send a session password to the proxy server when determining that the proxy server agent is allowed, the session password being a session password agreed by the source server and the client in establishing an HTTPS connection, The session password is used to trigger the proxy server to provide an HTTPS service for the client.

With reference to the third aspect, in a first possible implementation of the third aspect, the performing unit is further configured to obtain reference information from the session password obtaining request, where the reference information includes at least information of a proxy server, Determining at least one of information of a client included in the session password acquisition request and a local state of the source server; the execution unit determining whether to allow the proxy server proxy according to the reference information and a local policy of the source server, A first determination result is obtained, wherein the first determination result is that the proxy server agent is allowed, or whether the proxy server proxy is allowed to be based on the content of the HTTPS message or the proxy proxy is prohibited.

With reference to the third aspect, in a first possible implementation of the third aspect, in a second possible implementation, the executing unit is further configured to: acquire the number of HTTPS connections established by the source server, when When the quantity is greater than the first predetermined threshold, determining the first determination result to allow the proxy server agent; or acquiring the load rate of the source server, when the load rate is greater than a second predetermined threshold, The first determination result is determined to allow the proxy server proxy.

With reference to the third aspect, the first possible implementation of the third aspect, or the second possible implementation of the third aspect, in a third possible implementation, the execution unit is further configured to: acquire the source server a defined blacklist and/or whitelist; when the information contained in the reference information is located in the whitelist, determining the first determination result to allow the proxy server proxy; or, when the reference information includes When the information of the blacklist is located, the first determination result is determined to prohibit the proxy server proxy; or when the information included in the reference information is not located in the whitelist and is not located in the blacklist Determining, by the first determination result, that it is required to determine whether to allow the proxy server proxy based on the content of the HTTPS message, wherein the information included in the reference information includes the proxy service At least one of information of the device and information of the client.

With reference to the third aspect, the first possible implementation of the third aspect, or the second possible implementation of the third aspect, or the third possible implementation of the third aspect, in a fourth possible implementation, the transmitting And a unit, configured to: when the first determination result is that the proxy server agent is allowed, send a session password agreed with the client to the proxy server; or, when the first determination result is required to be based on When the HTTPS message content determines whether the proxy server proxy is allowed, waiting to receive the HTTPS packet sent by the client transparently transmitted by the proxy server, and receiving the HTTPS sent by the client transparently transmitted by the proxy server After the message, it is determined whether the proxy server is allowed according to the received HTTPS message, and when it is determined that the proxy server agent is allowed, the session password agreed with the client is sent to the proxy server.

With reference to the third aspect, the first possible implementation of the third aspect or the second possible implementation of the third aspect or the third possible implementation of the third aspect or the fourth possible implementation of the third aspect, In a fifth possible implementation, the sending unit is further configured to: when determining that the proxy server proxy is disabled, send a second determination result to the proxy server for indicating that the proxy proxy is prohibited, The second determination result is used to trigger the proxy server to delete the cached HTTPS message of the client.

The fourth aspect provides an information interaction apparatus, which is applied to a proxy server, where the apparatus includes: a receiving unit, configured to receive a setup request sent by a client for requesting to establish an HTTPS connection; and a sending unit, configured to send to the source The server sends a session password acquisition request, the session password acquisition request is used to trigger the source server to determine whether to permit the proxy server proxy, and an execution unit is configured to: when the source server allows the proxy server proxy, The source server obtains the session password agreed by the source server and the client in establishing the HTTPS connection; the execution unit is further configured to provide the client with an HTTPS service by using the session password.

With reference to the fourth aspect, in a first possible implementation of the fourth aspect, the device further includes: the receiving unit, configured to send a session password acquisition request to the source server; the receiving unit is further configured to: Receiving the session password sent by the source server, where the session password is sent after the source server determines to allow the proxy server proxy and the session password is agreed with the client; or, the receiving unit, And the method further comprises: transmitting, by the source server, the HTTPS message sent by the client to the source server, and receiving the session password sent by the source server, where the session password is that the source server receives the HTTPS After the message is received, it is determined according to the content of the HTTPS message that the proxy server is allowed to be sent.

With reference to the fourth aspect, or the first possible implementation of the fourth aspect, in a second possible implementation, the receiving unit is further configured to receive a first determination result sent by the source server, where the first determination is The result is that the source server determines, after receiving the session password acquisition request, whether to allow the proxy server to obtain the first determination result; the execution unit is further configured to: when the first determination result is allowed The proxy server proxy or caches the received HTTPS packet sent by the client when it is determined whether to allow the proxy server proxy based on the HTTPS message content.

With reference to the fourth aspect, the first possible implementation of the fourth aspect, or the second possible implementation of the fourth aspect, in a third possible implementation, the receiving unit is further configured to receive the source server to send a second determination result, the second determination result is obtained when the source server receives the HTTPS message, and determines whether to allow the proxy server proxy according to the content of the HTTPS message; And when the second determination result is that the proxy server proxy is disabled, deleting the cached HTTPS packet sent by the client.

With reference to the fourth aspect, the first possible implementation of the fourth aspect, or the second possible implementation of the fourth aspect, or the third possible implementation of the fourth aspect, in a fourth possible implementation, the performing And the unit is further configured to determine, according to the local policy, whether to start the proxy negotiation process, and when the proxy negotiation process needs to be started, obtain, from the source server, the session agreed by the source server and the client during the HTTPS connection establishment process. The execution unit is further configured to update the local policy by using the reason information when the first determination result is that the proxy server proxy is prohibited and the cause information of the proxy proxy is prohibited.

In a fifth aspect, a proxy server is provided, the proxy server comprising: a processor, a memory coupled to the processor, a transmitter and a receiver, the memory for storing one or more instructions configured to be processed Executing, the processor is configured to implement the information interaction method provided in the above first aspect by executing instructions in the memory.

In a sixth aspect, a source server is provided, the source server comprising: a processor, a memory coupled to the processor, a transmitter, and a receiver, the memory for storing one or more instructions configured to be processed Executing, the processor is configured to implement the information interaction method provided in the second aspect above by executing instructions in the memory.

In a seventh aspect, an information interaction system is provided, the information interaction system comprising: a proxy server and a source server, the proxy server comprising an information interaction device applied to the source server as provided by the third aspect, and the fourth aspect is provided An information interaction device applied to a proxy server.

DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly described below. It is obvious that the drawings in the following description are only some embodiments of the present invention. Other drawings may also be obtained from those of ordinary skill in the art in light of the inventive work.

1 is a schematic structural diagram of an information interaction system according to an exemplary embodiment of the present invention;

2 is a schematic structural diagram of a proxy server according to an exemplary embodiment of the present invention;

FIG. 3 is a schematic structural diagram of a source server according to an exemplary embodiment of the present invention; FIG.

FIG. 4 is a flowchart of an information interaction method according to an exemplary embodiment of the present invention;

FIG. 5 is a flowchart of an information interaction method according to another exemplary embodiment of the present invention; FIG.

FIG. 6A is a flowchart of an information interaction method according to still another exemplary embodiment of the present invention; FIG.

6B is a flowchart of a method for a source server to allow a proxy server to proxy an HTTPS service according to still another exemplary embodiment of the present invention;

FIG. 7A is a flowchart of an information interaction method according to still another exemplary embodiment of the present invention; FIG.

FIG. 7B is a flowchart of a method for determining a proxy proxy proxy based on HTTPS message content provided by a source server according to still another exemplary embodiment of the present invention; FIG.

FIG. 8A is a flowchart of an information interaction method according to still another exemplary embodiment of the present invention; FIG.

FIG. 8B is a flowchart of a method for determining a proxy proxy prohibition proxy based on HTTPS packet content according to another exemplary embodiment of the present invention; FIG.

FIG. 9A is a flowchart of an information interaction method according to still another exemplary embodiment of the present invention; FIG.

9B is a flowchart of a method for a source server to prohibit a proxy server to proxy an HTTPS service according to still another exemplary embodiment of the present invention;

FIG. 9C is a flowchart of determining, by a source server, whether to allow a proxy server proxy according to still another exemplary embodiment of the present invention; FIG.

FIG. 10 is a schematic structural diagram of an information interaction apparatus according to an exemplary embodiment of the present invention; FIG.

FIG. 11 is a schematic structural diagram of an information interaction apparatus according to another exemplary embodiment of the present invention.

detailed description

The embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

Please refer to FIG. 1 , which is a schematic structural diagram of an information interaction system according to an exemplary embodiment of the present invention. The information interaction system includes a proxy server 120 and a source server 140.

The proxy server 120 is a device having a data caching function. The proxy server 120 may be a cache server, a gateway with a data cache function, a router with a data cache function, and other devices with a data cache function.

The proxy server 120 establishes a communication connection with the source server 140.

The source server 140 is a server computer system that provides network data, typically a cluster of multiple servers, each of which is used to implement one or more functional modules.

Optionally, the information interaction system may further include a client 160, a routing device 180,

Client 160 establishes a communication connection with routing device 180. The routing device 180 can be a router, and can also be a gateway, such as a public data network gate (PGW) gateway, a gateway GPRS support bode (GGSN) gateway, and the like.

Routing device 180 configures policy routing between client 160 and proxy server 120 for client 160 so that client 160 can route to proxy server 120 via the above-described policies.

Routing device 180 typically determines a proxy server that is closer to routing device 180 as proxy server 120, which establishes a communication connection with routing device 180.

Referring to FIG. 2, a schematic structural diagram of a proxy server 120 according to an exemplary embodiment of the present invention is shown. The proxy server 120 includes a processor 21, a network interface 22, and a memory 23.

The processor 21 includes one or more processing cores, and the processor 21 executes various functional applications and data processing by running software programs and modules.

There may be multiple network interfaces 22, some of which are used to communicate with the source server 140.

The memory 23 is coupled to the processor 21, for example, the memory 23 can be coupled to the processor 21 via a bus; the memory 23 can be used to store software programs and modules.

The memory 23 can store an application module 24 required for at least one function, and the application module 24 can include a transmitting module 241, an executing module 242, a receiving module 243, and the like.

Here, the sending module 241, the executing module 242, and the receiving module 243 can perform the corresponding steps in FIG. 4, FIG. 6A, FIG. 6B, FIG. 7A, FIG. 7B, FIG. 8A, FIG. 8B, FIG. 9A, and FIG. 4. Fig. 6A, Fig. 6B, Fig. 7A, Fig. 7B, Fig. 8A, Fig. 8B, Fig. 9A and Fig. 9B description of.

The memory 23 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read only memory ( English: electrically erasable programmable read-only memory (EEPROM), erasable programmable read only memory (EPROM), programmable read only memory (English: programmable read only memory, PROM), only Read memory (English: read only memory image, ROM), magnetic memory, flash memory, disk or optical disk.

It will be understood by those skilled in the art that the structure of the proxy server 120 shown in FIG. 1 does not constitute a limitation to the proxy server 120, and may include more or less components than those illustrated, or combine some components, or different. Parts layout.

Please refer to FIG. 3, which is a schematic structural diagram of a source server 140 according to an exemplary embodiment of the present invention. The source server 140 includes a processor 31, a network interface 32, and a memory 33.

The processor 31 includes one or more processing cores, and the processor 31 executes various functional applications and data processing by running software programs and modules.

There may be multiple network interfaces 32, some of which are used to communicate with the proxy server 120.

The memory 33 is coupled to the processor 31. For example, the memory 33 can be coupled to the processor 31 via a bus; the memory 33 can be used to store software programs and modules.

The memory 33 can store an application module 34 required for at least one function, and the application module 34 can include a transmitting module 341, an executing module 342, a receiving module 343, and the like.

Here, the sending module 341, the executing module 342, and the receiving module 343 can perform the corresponding steps in FIG. 5, FIG. 6A, FIG. 6B, FIG. 7A, FIG. 7B, FIG. 8A, FIG. 8B, FIG. 9A and FIG. 5. Description of FIGS. 6A, 6B, 7A, 7B, 8A, 8B, 9A, and 9B.

Memory 33 can be implemented by any type of volatile or non-volatile storage device, or a combination thereof, such as SRAM, EEPROM, EPROM, PROM, ROM, magnetic memory, flash memory, magnetic disk, or optical disk.

It will be understood by those skilled in the art that the structure of the source server 140 shown in FIG. 1 does not constitute a limitation of the source server 140, and may include more or less components than those illustrated, or may combine some parts. Pieces, or different parts arrangement.

Embodiment 1, please refer to FIG. 4, which shows a flowchart of an information interaction method provided by an exemplary embodiment of the present invention. This embodiment is exemplified by the information interaction method used in the proxy server 120 shown in FIG. 1. The processor 21 of the proxy server 120 shown in FIG. 1 performs the following steps, and the method includes the following steps. :

Step 401: Receive an establishment request sent by the client to request to establish an HTTPS connection.

Step 402: Send a session password acquisition request to the source server, where the session password acquisition request is used to trigger the source server to determine whether to allow the proxy server proxy.

Step 403: When the source server allows the proxy server proxy, obtain the session password agreed by the source server and the client during the establishment of the HTTPS connection from the source server.

Step 404, using the session password to provide an HTTPS service for the client.

In summary, the method for information interaction provided in this embodiment sends a session password acquisition request to the source server, and the session password acquisition request triggers the source server to determine whether to allow the proxy server proxy in real time, in the case that the source server allows the proxy server proxy. The proxy server can obtain the session password from the source server, and solves the problem that the source server needs to send the session password to the proxy server in advance in the related art. In the case that there are many proxy servers, the session password is easily leaked, and the session password is improved. The effect of security.

Embodiment 2 Please refer to FIG. 5, which shows a flowchart of an information interaction method provided by another exemplary embodiment of the present invention. This embodiment uses the information interaction method for the source server 140 shown in FIG. 1 as an example. The processor 31 of the source server 140 shown in FIG. 1 performs the following steps, and the method includes the following steps. :

Step 501: Receive a session password acquisition request sent by the proxy server.

Step 502: Determine whether the proxy server agent is allowed.

Step 503, when it is determined that the proxy server agent is allowed, sending a session password to the proxy server, where the session password is a session password agreed by the source server and the client in establishing an HTTPS connection, and the session password is used to trigger the proxy server as The client provides an HTTPS service.

In summary, the method for information interaction provided by this embodiment is: when receiving the session password acquisition request sent by the proxy server, the source server dynamically determines whether the proxy server proxy is allowed, and when determining that the proxy proxy is allowed, the source The server sends a session password to the proxy server to resolve In the related art, the source server needs to send the session password to the proxy server in advance, and in the case where there are many proxy servers, the problem of the session password is easily leaked, and the effect of improving the security of the session password is achieved.

In the third embodiment, when the source server allows the proxy server to proxy the HTTPS service, the source server sends the session password to the proxy server through the secure channel. After receiving the session password, the proxy server uses the session password to provide the client with an HTTPS service. The information interaction method provided by the present invention will be described below with reference to FIG. 6A.

Please refer to FIG. 6A, which shows a flowchart of an information interaction method provided by still another exemplary embodiment of the present invention. This embodiment is exemplified by the information interaction method used in the information interaction system shown in FIG. 1, and the method includes the following steps:

Step 601: The proxy server receives a setup request sent by the client for requesting to establish an HTTPS connection, and determines, according to the local policy, whether the proxy negotiation process needs to be started.

When the client needs to access network data through the HTTPS protocol, the client needs to establish an HTTPS connection with the source server. Optionally, the client sends a client hello message Client Hello to the proxy server, and the client Hello can be used as an establishment request for establishing an HTTPS connection. When the proxy server receives the Client Hello sent by the client, the proxy server determines whether it needs to start the proxy negotiation process according to the local policy.

In the process of establishing an HTTPS connection between the client and the source server, the client and the source server use the SSL handshake protocol to agree on the session password.

Specifically, the routing device that establishes a communication connection with the client configures a routing policy for the client, so that the SSL handshake message sent by the client is sent to the proxy server of the source server according to the policy route. The SSL handshake message is transparently transmitted between the client and the source server by the proxy server, so that the client completes the session password agreement with the source server and establishes an HTTPS connection.

Specifically, the routing device configures the policy routing according to the port number 443 of the web browsing port and the white/black list of the destination address. The destination address whitelist is a list of routers that can be used as policy routes. The destination address blacklist is a list of routers that are prohibited as policy routes.

It should be noted that the method for the client to use the SSL handshake protocol to stipulate the session password with the source server is implemented by a person skilled in the art. In this embodiment, the SSL handshake process between the client and the source server is not performed. Narration.

The proxy negotiation process is initiated by the proxy server, and the proxy server asks the source server whether The process that allows the proxy server proxy (whether or not the proxy server is allowed to replace the source server to provide HTTPS services to the client). Specifically, the proxy server determines whether it is necessary to start the proxy negotiation process according to the local policy. The local policy includes at least one of a negotiation whitelist, a negotiation blacklist, and a local state of the proxy server.

The negotiated whitelist is a list of source servers that allow the proxy server to proxy the HTTPS service, and the negotiated whitelist is a list of source servers that prohibit the proxy server from proxying the HTTPS service.

For example, when the source server is in the negotiated whitelist, it indicates that the source server may allow the proxy server to proxy its own HTTPS service. Therefore, when the source server is in the negotiated whitelist, the proxy server can initiate a proxy negotiation process to ask the server whether to allow the proxy proxy.

For another example, when the source server is in the negotiation blacklist, it indicates that the source server prohibits the proxy server from proxying its own HTTPS service. Therefore, when the source server is in the negotiation whitelist, the proxy server may not initiate the proxy negotiation process, and directly becomes a transparent proxy between the client and the source server, and transparently transmit data between the client and the source server. The HTTPS service is provided by the source server to the client. Specifically, the proxy server obtains the HTTPS service data from the source server, and transparently transmits the HTTPS service data to the client.

For another example, the local state can be the running state of the proxy server. For example, when the proxy server is processing more services, in order to avoid overloading the proxy server, the negotiation process may not be started. The proxy server can directly become a transparent proxy between the client and the source server, and transparently transmit data between the client and the source server. The HTTPS service is provided by the source server to the client. Specifically, the proxy server obtains the HTTPS service data from the source server, and transparently transmits the HTTPS service data to the client.

In the actual implementation, a local policy of multiple proxy servers may be established to determine whether the proxy negotiation process needs to be started. The policies included in the local policies may be different in different implementation scenarios, and the proxy negotiation process needs to be started according to different local policies. The method may be different, and will not be repeated here, depending on the actual situation.

Step 602: When the agent negotiation process needs to be started, the proxy server sends a session password acquisition request to the source server.

Specifically, after the proxy server determines that the proxy negotiation process needs to be started according to the local policy, it is detected whether a secure channel has been established between the proxy server and the source server.

When a secure channel has been established between the proxy server and the source server, the proxy server passes security. The channel sends a session password acquisition request to the source server.

When a secure channel is not established between the proxy server and the source server, a secure channel is established between the proxy server and the source server, and the proxy server sends a session password acquisition request to the source server through the secure channel. It should be noted that the method for establishing a secure channel can be implemented by those skilled in the art, and details are not described herein.

Step 603: The source server receives a session password acquisition request sent by the proxy server, and determines whether the proxy server proxy is allowed.

Specifically, the reference information is obtained from the session password acquisition request, and the source server determines whether to allow the proxy server proxy according to the reference information and the local policy of the source server, to obtain the first determination result. The first decision result is to allow the proxy server proxy, or to determine whether to allow the proxy proxy based on the HTTPS message content, or to disable the proxy proxy.

The HTTPS message is an HTTPS service request sent by the client. The reference information mentioned herein includes at least one of the information of the proxy server, the information of the client, the local state of the source server, and the local policy of the source server. In actual implementation, the source server may also use other reference information to determine whether to allow proxy proxy.

For example, when the security trust of the source server to the proxy server is relatively high, the source server may directly allow the proxy server proxy without considering other reference information, and the first determination result is that the proxy server proxy is allowed.

For another example, when the security trust of the source server to the proxy server is low, the source server needs to further determine whether to allow the proxy server proxy according to the content of the proxy requested by the proxy server (the content of the HTTPS packet sent by the client). The first determination result is that it is necessary to determine whether to allow the proxy server proxy based on the HTTPS message content.

For another example, when the source server does not trust the proxy server, the source server may disable the proxy server proxy, and the first determination result is to disable the proxy server proxy.

In actual implementation, the source server may determine the first determination result according to multiple reference information, and the reference information adopted by different implementation scenarios may be different, and the method for determining the first determination result according to different reference information may also be different. Here, we will not repeat them one by one, and the specific ones can be determined according to actual conditions.

After determining the first determination result, the source server sends the first determination result to the proxy server through the secure channel. Correspondingly, the proxy server receives the first determination result sent by the source server. When the first judgment result received by the proxy server is to allow the proxy server proxy, the proxy server cache receives The HTTPS packet sent by the client is waiting to receive the session password sent by the source server. Optionally, the HTTPS packet sent by the client is transparently transmitted to the source server.

One point to note is that after the client establishes an HTTPS connection with the source server, the client uses the session password to send an HTTPS message to the proxy server. Correspondingly, after the client establishes an HTTPS connection with the source server, the proxy server receives the HTTPS message from the client.

Step 604: The source server sends a session password to the proxy server when determining that the proxy server proxy is allowed.

Specifically, the source server sends the session password to the proxy server through a secure channel.

Step 605: The proxy server receives the session password sent by the source server, and provides the HTTPS service to the client by using the session password.

Specifically, after receiving the session password sent by the source server, the proxy server uses the session password to parse the HTTPS packet to obtain the HTTPS packet content. The proxy server queries the HTTPS service data corresponding to the HTTPS message content in the local cache. That is, the proxy server queries whether the HTTPS service data requested by the client is stored in the local cache.

If there is HTTPS service data requested by the client in the local cache of the proxy server, the proxy server encrypts the HTTPS service data by using the session password, and sends the encrypted HTTPS service data to the client. This enables the proxy server to provide HTTPS services to the client.

If the HTTPS service data requested by the client is not stored in the local cache of the proxy server, the HTTPS packet obtained from the client is transparently transmitted to the source server. The source server uses the session password to parse HTTPS packets to provide HTTPS service data to the client. Specifically, the source server encrypts the HTTPS service data by using the session password, and sends the encrypted HTTPS service data to the proxy server. After receiving the encrypted HTTPS service data sent by the source server, the proxy server transparently transmits the encrypted HTTPS service data to the client. At the same time, the proxy server determines whether to store the HTTPS service data in the local cache according to the caching policy.

In actual implementation, the HTTPS service data may be stored according to a plurality of cache policies. For example, when the number of times the HTTPS service data is acquired by the client reaches a third predetermined threshold, the proxy server stores the HTTPS service data in the local cache. Store. The policies included in the caching policy may be different in different implementation scenarios. The method for judging whether to store HTTPS service data in the local cache may be different according to different caching policies. According to the actual situation.

In summary, the method for information interaction provided by this embodiment is provided by each client and source service. During the process of establishing an HTTPS connection, the source server dynamically determines whether the proxy server proxy is allowed. In the case that the source server allows the proxy server proxy, the proxy server obtains the session password from the source server, and solves the related problem that the source server needs the session password. It is sent to the proxy server in advance. When there are many proxy servers, it is easy to cause the session password to leak, and the effect of improving the security of the session password is achieved.

By sending the session password to the proxy server when the first decision results in the proxy server permission, the proxy server can use the session password instead of the source server to provide the HTTPS service to the client.

The proxy server caches the HTTPS message sent by the received client when the first determination result is that the proxy server is allowed to proxy. In order for the subsequent proxy server to receive the session password sent by the source server, the session password is used to resolve the HTTPS message, and the client is provided with the HTTPS service.

Embodiment 4 In a possible implementation, the process of establishing an HTTPS connection between the client and the source server is combined with the process of obtaining the session password from the source server when the source server allows the proxy server to proxy.

Please refer to FIG. 6B, which illustrates a flow chart of a method for a source server to allow a proxy server to proxy an HTTPS service according to still another exemplary embodiment of the present invention. In this embodiment, the method in which the source server allows the proxy server to proxy the HTTPS service is used in the information interaction system shown in FIG. 1 , and the method includes the following steps:

The client establishes an HTTPS connection with the source server, which can be implemented through the following sub-steps.

In step 606a1, the client sends a client hello message Client Hello to the proxy server.

In step 606a2, the proxy server transparently transmits the client hello message Client Hello to the source server.

In step 606b1, the source server sends a server hello message Server Hello to the proxy server.

In step 606b2, the proxy server transparently transmits the server hello message Server Hello to the client.

In step 606c1, the source server sends a certificate certificate to the proxy server.

In step 606c2, the proxy server transparently transmits the certificate certificate to the client.

In step 606d1, the source server sends a server hello to the proxy server to end the Server Hello Done message.

In step 606d2, the proxy server transparently transmits the server hello end Server Hello Done message to the client.

In step 606e1, the client sends a client key exchange Client Key Exchange to the proxy server.

In step 606e2, the proxy server transparently transmits the client key exchange Client Key Exchange to the source server.

In step 606fl, the client sends a password change statement Change Cipher Spec to the proxy server.

In step 606f2, the proxy server transparently transmits the password change statement Change Cipher Spec to the source server.

In step 606g1, the client sends an end Finished message to the server.

In step 606g2, the proxy server will end the Passed message to the source server.

In step 606hl, the source server sends a password change statement Change Cipher Spec to the proxy server.

In step 606h2, the proxy server transparently transmits the password change statement Change Cipher Spec to the client.

In step 606i1, the source server sends an end Finished message to the proxy server.

In step 606i2, the proxy server will end the Passed message to the client.

The foregoing sub-steps are the processes required for the client to establish an HTTPS connection with the source server. The process of establishing the HTTPS connection between the client and the source server can be implemented by a person skilled in the art. In this embodiment, the HTTPS is established between the client and the source server. The various sub-steps involved in the connection process are not described again.

Step 607: The proxy server determines, according to the local policy, whether the agent negotiation process needs to be started.

For the description of step 607, refer to the explanation of step 601, and details are not described herein again.

Optionally, when the proxy server receives the Client Hello sent by the client, the proxy server determines, according to the local policy, whether the proxy negotiation process needs to be started.

Step 608: When the agent negotiation process needs to be started, the proxy server sends a session password acquisition request to the source server through the secure channel.

For the description of step 608, refer to the explanation of step 602, and details are not described herein again.

Step 609: The source server receives the session password acquisition request sent by the proxy server, determines whether the proxy server proxy is allowed, and obtains the first determination result.

For the description of step 608, refer to the explanation of step 603, and details are not described herein again.

In step 610, the source server sends the first determination result to the proxy server through the secure channel.

Step 611, when the first determination result received by the proxy server is to allow the proxy server proxy, The proxy server waits to receive the session password sent by the source server.

Optionally, when the first determination result received by the proxy server is to allow the proxy server proxy, the secure channel is used to send a message to the source server confirming that the first determination result has been received.

It should be noted that the execution of steps 607 to 611 and the execution of each sub-step in step 606 (except step 606a1) are in no particular order. However, the execution of steps 607 to 611 needs to be performed in sequential order, and the execution of each sub-step in step 606 is generally performed in the order of the above-mentioned processes.

In step 612, the client sends an HTTPS message to the proxy server.

After the client establishes an HTTPS connection with the source server, the client sends an HTTPS packet to the proxy server. Specifically, after the client receives the Finished message sent by the proxy server, the client sends an HTTPS packet to the proxy server.

Optionally, when the proxy server receives the HTTPS packet and does not receive the session password sent by the source server, the proxy sends the HTTPS packet to the source server.

In step 613, the source server sends the session password to the proxy server through the secure channel.

It should be noted that the execution order of step 612 and step 613 is in no particular order, and the specific execution order is determined according to actual conditions.

Step 614: The proxy server receives the session password sent by the source server, and provides the HTTPS service to the client by using the session password.

Specifically, the proxy server parses the HTTPS packet by using the session password, and determines whether the corresponding HTTPS service data exists in the local cache. When the local cache does not have the corresponding HTTPS service data, the proxy server transparently transmits the HTTPS message sent by the client to the source server, and the source server uses the session password to parse the HTTPS message to provide the HTTPS service to the client.

When the local cache has the corresponding HTTPS service data, the proxy server uses the session password to parse the HTTPS message to provide the HTTPS service to the client. Specifically, the HTTPS packet is parsed by the session password to provide the HTTPS service for the client. For details, refer to the description of step 605, and details are not described herein.

It should be noted that when the proxy server does not need to initiate the negotiation process, the proxy server becomes a transparent proxy between the client and the source server, and data is transparently transmitted between the client and the source server, and the source server provides the client with the transparent transmission. HTTPS service.

In summary, the method for information interaction provided by the embodiment, the proxy server obtains the session password from the source server through dynamic negotiation, and solves the related problem that the source server needs to send the session password to the proxy server in advance, and the proxy server has more In the case of a problem, it is easy to cause a session password to be leaked. The effect of improving session password security is achieved.

In the fifth embodiment, when the source server needs to determine whether to allow the proxy server proxy based on the content of the HTTPS packet, the source server obtains the HTTPS packet from the proxy server. In the case where the source server determines that the proxy server is allowed to proxy the HTTPS service based on the HTTPS message content, the source server sends the session password to the proxy server, so that the proxy server provides the HTTPS service to the client by using the session password. The information interaction method provided by the present invention will be described below with reference to FIG. 7A.

Please refer to FIG. 7A, which shows a flowchart of an information interaction method provided by still another exemplary embodiment of the present invention. This embodiment is exemplified by the information interaction method used in the information interaction system shown in FIG. 1, and the method includes the following steps:

Step 701: The proxy server receives a setup request sent by the client for requesting to establish an HTTPS connection, and determines, according to the local policy, whether the proxy negotiation process needs to be started.

Step 702: When the agent negotiation process needs to be started, the proxy server sends a session password acquisition request to the source server.

Step 703: The source server receives the session password acquisition request sent by the proxy server, determines whether the proxy server proxy is allowed according to the reference information, and obtains a first determination result.

For the description of the steps 701 to 703, refer to the explanation of the steps 601 to 603, and details are not described herein again.

Step 704: When the first determination result is that it is determined whether the proxy server proxy is allowed based on the content of the HTTPS packet, the source server sends the first determination result to the proxy server, and waits for the HTTPS packet sent by the client transparently received by the proxy server.

Specifically, the source server sends the first determination result to the proxy server by using a secure channel.

Step 705: When the first determination result received by the proxy server is that it is determined whether to allow the proxy server proxy based on the HTTPS packet content, the proxy server caches the received HTTPS packet sent by the client, and sends the HTTPS packet sent by the client. The text is transmitted to the source server.

After the client establishes an HTTPS connection with the source server, the client sends an HTTPS packet to the proxy server. That is, after the client establishes an HTTPS connection with the source server, the proxy server can receive the HTTPS packet sent by the client.

When the first determination result received by the proxy server is that it is determined whether to allow the proxy server proxy based on the content of the HTTPS packet, the received HTTPS packet sent by the client is cached. So that the source server determines that the proxy server proxy is allowed based on the HTTPS message content. After receiving the session password sent by the source server, the server uses the session password to provide the client with an HTTPS service. At the same time, the proxy server transparently transmits the HTTPS packet to the source server, so that the source server parses the HTTPS packet to determine the content of the HTTPS packet, and determines whether to allow the proxy server proxy based on the content of the HTTPS packet.

Step 706: After receiving the HTTPS packet sent by the client transparently transmitted by the proxy server, the source server determines whether the proxy server is allowed according to the received HTTPS packet.

Specifically, the source server receives the HTTPS packet transparently transmitted by the proxy server through the secure channel, and uses the session password to parse the HTTPS packet to determine the content of the HTTPS packet. After the source server learns the content of the HTTPS packet, it determines whether the proxy server is allowed according to the content of the HTTPS packet, and obtains the second determination result.

For example, if the source server knows that the content of the HTTPS message is the bank account of the user account A, and the banking service is prohibited by the proxy server, the source server determines that the proxy server proxy is prohibited based on the content of the HTTPS message.

For another example, the source server learns that the content of the HTTPS message is a novel resource download, and the novel service may be proxyed by the proxy server, and the source server determines that the proxy server proxy is allowed based on the content of the HTTPS message.

In the actual implementation, the method for determining whether to allow the proxy server according to the content of the HTTPS packet is not described in detail in this embodiment, and the specific method may be determined according to actual conditions.

Step 707: The source server sends a session password agreed with the client to the proxy server when determining that the proxy server proxy is allowed.

Specifically, the source server sends a session password agreed with the client to the proxy server by using a secure channel.

Step 708: The proxy server receives the session password sent by the source server, and provides the HTTPS service to the client by using the session password.

For the description of step 708, refer to the description of step 605, and details are not described herein again.

It should be noted that when the proxy server does not need to initiate the negotiation process, the proxy server becomes a transparent proxy between the client and the source server, and data is transparently transmitted between the client and the source server, and the source server provides the client with the transparent transmission. HTTPS service.

In summary, the method for information interaction provided by this embodiment is that, in each process of establishing an HTTPS connection between the client and the source server, the source server dynamically determines whether the proxy server proxy is allowed, and the proxy server proxy is allowed on the source server. Next, the proxy server obtains the session secret from the source server. The code solves the problem that the source server needs to send the session password to the proxy server in advance in the related art, and in the case that there are many proxy servers, the problem of the session password is easily leaked, and the effect of improving the security of the session password is achieved.

The source server sends the session password to the proxy server by determining whether the proxy server proxy is allowed based on the HTTPS message content in the first determination result, so that the proxy server can use the session password instead of the source server to provide the HTTPS service to the client.

The proxy server caches the HTTPS message sent by the received client by determining whether the proxy server proxy is allowed based on the content of the HTTPS message. In order for the subsequent proxy server to receive the session password sent by the source server, the session password is used to resolve the HTTPS message, and the client is provided with the HTTPS service.

When the source server needs to determine whether to allow the proxy server proxy according to the HTTPS message content, the HTTPS packet is sent to the source server, so that the source server determines whether to allow the proxy server proxy according to the content of the HTTPS packet.

Embodiment 6 In a possible implementation, the process of establishing an HTTPS connection between the client and the source server is combined with the process of obtaining the session password from the source server when the source server allows the proxy server to proxy based on the content of the HTPPS message. for example.

Please refer to FIG. 7B, which is a flowchart of a method for determining a proxy proxy proxy based on HTTPS message content provided by a source server according to still another exemplary embodiment of the present invention. In this embodiment, the source server needs to determine that the proxy server proxy method is used in the information interaction system shown in FIG. 1 based on the HTTPS packet content, and the method includes the following steps:

The client establishes an HTTPS connection with the source server, which can be implemented through the following sub-steps.

In step 709a1, the client sends a client hello message Client Hello to the proxy server.

In step 709a2, the proxy server transparently transmits the client hello message Client Hello to the source server.

In step 709b1, the source server sends a server hello message Server Hello to the proxy server.

In step 709b2, the proxy server transparently transmits the server hello message Server Hello to the client.

In step 709c1, the source server sends a certificate certificate to the proxy server.

In step 709c2, the proxy server transparently transmits the certificate certificate to the client.

In step 709d1, the source server sends a server hello to the proxy server to end the Server Hello Done message.

Step 709d2, the proxy server transparently transmits the server hello end Server Hello Done message to Client.

In step 709e1, the client sends a client key exchange Client Key Exchange to the proxy server.

In step 709e2, the proxy server transparently transmits the client key exchange Client Key Exchange to the source server.

In step 709f1, the client sends a password change statement Change Cipher Spec to the proxy server.

In step 709f2, the proxy server transparently transmits the password change statement Change Cipher Spec to the source server.

In step 709g1, the client sends an end Finished message to the server.

In step 709g2, the proxy server will end the Passed message to the source server.

In step 709h1, the source server sends a password change statement Change Cipher Spec to the proxy server.

In step 709h2, the proxy server transparently transmits the password change statement Change Cipher Spec to the client.

In step 709i1, the source server sends an end Finished message to the proxy server.

In step 709i2, the proxy server will end the Passed message to the client.

The foregoing sub-steps describe that the client establishes an HTTPS connection with the source server, and the client establishes an HTTPS connection with the source server, which is implemented by a person skilled in the art. In this embodiment, the HTTPS connection process between the client and the source server is involved. Each substep will not be described again.

In step 710, the proxy server determines whether it is necessary to start the proxy negotiation process according to the local policy.

For the description of step 710, refer to the explanation of step 601, and details are not described herein again.

Optionally, when the proxy server receives the Client Hello sent by the client, the proxy server determines, according to the local policy, whether the proxy negotiation process needs to be started.

For the description of step 710, refer to the explanation of step 602, and details are not described herein again.

Step 711: When the agent negotiation process needs to be started, the proxy server sends a session password acquisition request to the source server through the secure channel.

Step 712: The source server receives the session password acquisition request sent by the proxy server, determines whether the proxy server proxy is allowed according to the reference information, and obtains the first determination result.

For the description of step 712, refer to the explanation of step 603, and details are not described herein again.

Step 713, the first determination result is sent to the proxy server through the secure channel.

Step 714, when the first determination result received by the proxy server is required to be based on the HTTPS message When the content of the proxy server is allowed to be determined, the received HTTPS packet sent by the client is cached.

Step 715: The HTTPS packet sent by the client is transparently transmitted to the source server.

For the description of step 714 and step 715, refer to the explanation of step 705, and details are not described herein again.

Step 716: After receiving the HTTPS packet sent by the client transparently transmitted by the proxy server, the source server determines whether to allow the proxy server according to the received HTTPS packet, obtains a second determination result, and sends the second determination result to the proxy server. .

The second determination result is that the proxy server proxy is allowed, or the proxy proxy is prohibited.

For the description of step 716, refer to the explanation of step 706, and details are not described herein again.

Step 717: When the second determination result is that the proxy server agent is allowed, the source service sends the session password agreed with the client to the proxy server.

Optionally, when the second determination result is that the proxy server proxy is allowed, the source server sends the second determination result to the proxy server by using the secure channel. When the second determination result received by the proxy server is to allow the proxy server proxy, a message is sent to the source server confirming that the second determination result has been received.

Step 718: The proxy server receives the session password sent by the source server, and provides the HTTPS service to the client by using the session password.

For the HTTPS service to be used to resolve the HTTPS packet by using the session password, refer to the description of step 614, and details are not described herein.

It should be noted that when the proxy server does not need to initiate the negotiation process, the proxy server becomes a transparent proxy between the client and the source server, and data is transparently transmitted between the client and the source server, and the source server provides the client with the transparent transmission. HTTPS service.

In summary, in the method for information interaction provided by the embodiment, the proxy server obtains the session password from the source server through dynamic negotiation, and the source server determines whether to allow the proxy server proxy based on the content of the HTTPS message, and solves the problem that the source server needs to be related in the related art. The session password is sent to the proxy server in advance. In the case of a large number of proxy servers, the problem of session password leakage is easily caused, and the security of the session password is improved.

In the seventh embodiment, when the source server needs to determine whether to allow the proxy server proxy based on the content of the HTTPS packet, the HTTPS packet is obtained from the proxy server. The source server determines whether to allow the proxy server proxy based on the HTTPS message content. When the source server determines to prohibit the proxy server proxy HTTPS service based on the HTTPS message content, the source server session password provides the client with an HTTPS service. The information interaction method provided by the present invention will be described below with reference to FIG. 8A.

Please refer to FIG. 8A, which shows a flowchart of an information interaction method provided by still another exemplary embodiment of the present invention. This embodiment is exemplified by the information interaction method used in the information interaction system shown in FIG. 1, and the method includes the following steps:

Step 801: The proxy server receives a setup request sent by the client for requesting to establish an HTTPS connection, and determines, according to the local policy, whether the proxy negotiation process needs to be started.

Step 802: When the agent negotiation process needs to be started, the proxy server sends a session password acquisition request to the source server.

Step 803: The source server receives the session password acquisition request sent by the proxy server, determines whether the proxy server proxy is allowed according to the reference information, and obtains the first determination result.

For the description of the steps 801 to 803, refer to the explanation of the steps 601 to 603, and details are not described herein again.

Step 804: When the first determination result is that it is determined whether the proxy server proxy is allowed to be based on the content of the HTTPS packet, the source server sends the first determination result to the proxy server, and waits for the HTTPS packet sent by the client transparently received by the proxy server.

Specifically, the source server sends the first determination result to the proxy server by using a secure channel.

Step 805: When the first determination result received by the proxy server is that it is required to determine whether to allow the proxy server proxy based on the HTTPS packet content, the proxy server caches the received HTTPS packet sent by the client, and sends the HTTPS packet sent by the client. The text is transmitted to the source server.

For the description of step 805, refer to the explanation of step 705, and details are not described herein again.

Step 806: After receiving the HTTPS message sent by the client transparently transmitted by the proxy server, the source server determines whether to allow the proxy server proxy according to the received HTTPS packet.

For the description of step 805, refer to the explanation of step 706, and details are not described herein again.

Step 807: When the source server determines that the proxy server proxy is disabled, the source server sends a second determination result indicating that the proxy proxy is prohibited to the proxy server, and provides the HTTPS service to the client.

The second determination result is that the proxy server proxy is allowed, or the proxy proxy is prohibited. The source server determines whether the proxy proxy is allowed according to the received HTTPS packet.

Step 808: When the proxy server receives the second determination result that the proxy server proxy is disabled, the HTTPS packet of the client is sent to the source server, and the HTTPS packet of the cached client is deleted.

When the proxy server receives the second determination result as disabling the proxy server proxy, it sends a message to the source server confirming that the second determination result has been received. The source server is sending a proxy server The confirmation has received the message of the second determination result, and the source server is informed that the agent negotiation process has ended. Thereafter, when the source server receives the HTTPS message sent by the proxy server again, the source server uses the session password to provide the HTTPS service to the client. Among them, the proxy server becomes a transparent proxy between the client and the source server, and data is transparently transmitted between the client and the source server.

It should be noted that when the proxy server does not need to initiate the negotiation process, the proxy server becomes a transparent proxy between the client and the source server, and data is transparently transmitted between the client and the source server, and the source server provides the client with the transparent transmission. HTTPS service.

In summary, the method for information interaction provided in this embodiment obtains a session password from a source server through dynamic negotiation, and the source server determines whether to allow a proxy server proxy based on the content of the HTTPS packet, and solves the problem that the source server needs to use the session password in the related art. It is sent to the proxy server in advance. When there are many proxy servers, it is easy to cause the session password to leak, and the effect of improving the security of the session password is achieved.

When the second determination result is that the proxy server proxy is disabled, the second determination result indicating that the proxy server proxy is prohibited is sent to the proxy server, and after receiving the second determination result, the proxy server becomes between the source server and the client. A transparent proxy that transparently passes data between the source server and the client so that the source server can provide HTTPS services to the client.

When the second determination result is that the proxy server proxy is disabled, the proxy server deletes the cached HTTPS packet, which saves the storage space of the proxy server.

In a possible implementation, in a possible implementation, the process of establishing an HTTPS connection between the client and the source server, and the process of providing the HTTPS service by the source server to the client when the source server prohibits the proxy server based on the HTPPS packet content Give an example.

8B is a flowchart showing a method for determining a proxy proxy proxy proxy based on HTTPS message content provided by a source server according to still another exemplary embodiment of the present invention. In this embodiment, the source server determines that the proxy proxy proxy proxy method is used in the information interaction system shown in FIG. 1 based on the HTTPS packet content. The method includes the following steps:

The client establishes an HTTPS connection with the source server, which can be implemented through the following sub-steps.

In step 809a1, the client sends a client hello message Client Hello to the proxy server.

In step 809a2, the proxy server transparently transmits the client hello message Client Hello to the source server.

In step 809b1, the source server sends a server hello message Server Hello to the proxy server.

In step 809b2, the proxy server transparently transmits the server hello message Server Hello to the client.

In step 809c1, the source server sends a certificate certificate to the proxy server.

In step 809c2, the proxy server transparently transmits the certificate certificate to the client.

In step 809d1, the source server sends a server hello to the proxy server to end the Server Hello Done message.

In step 809d2, the proxy server transparently transmits the server hello end Server Hello Done message to the client.

In step 809e1, the client sends a client key exchange Client Key Exchange to the proxy server.

In step 809e2, the proxy server transparently transmits the client key exchange Client Key Exchange to the source server.

In step 809f1, the client sends a password change statement Change Cipher Spec to the proxy server.

In step 809f2, the proxy server transparently transmits the password change statement Change Cipher Spec to the source server.

In step 809g1, the client sends an end Finished message to the server.

In step 809g2, the proxy server will end the Passed message to the source server.

In step 809h1, the source server sends a password change statement Change Cipher Spec to the proxy server.

In step 809h2, the proxy server transparently transmits the password change statement Change Cipher Spec to the client.

In step 809i1, the source server sends an end Finished message to the proxy server.

In step 809i2, the proxy server will end the Passed message to the client.

The foregoing sub-steps describe that the client establishes an HTTPS connection with the source server, and the client establishes an HTTPS connection with the source server, which is implemented by a person skilled in the art. In this embodiment, the HTTPS connection process between the client and the source server is involved. Each substep will not be described again.

In step 810, the proxy server determines whether it is necessary to start the proxy negotiation process according to the local policy.

For the description of step 810, refer to the explanation of step 601, and details are not described herein again.

Optionally, when the proxy server receives the Client Hello sent by the client, the proxy server determines, according to the local policy, whether the proxy negotiation process needs to be started.

For the description of step 810, refer to the explanation of step 602, and details are not described herein again.

Step 811: When the agent negotiation process needs to be started, the proxy server sends a session password acquisition request to the source server through the secure channel.

Step 812: The source server receives the session password acquisition request sent by the proxy server, determines whether the proxy server proxy is allowed, and obtains the first determination result.

For the description of step 812, refer to the explanation of step 603, and details are not described herein again.

In step 813, the first determination result is sent to the proxy server through the secure channel.

Step 814: When the first determination result received by the proxy server is that it is required to determine whether to allow the proxy server proxy based on the content of the HTTPS packet, the HTTPS packet sent by the received client is cached.

Step 815: The HTTPS packet sent by the client is transparently transmitted to the source server.

For the description of step 814 and step 815, refer to the explanation of step 705, and details are not described herein again.

Step 816: After receiving the HTTPS packet sent by the client transparently transmitted by the proxy server, the source server determines whether the proxy server is allowed according to the received HTTPS packet, and obtains a second determination result.

The second determination result is that the proxy server proxy is allowed, or the proxy proxy is prohibited.

For the description of step 816, refer to the explanation of step 706, and details are not described herein again.

Step 817: When the proxy server receives the second determination result that the proxy server proxy is disabled, the HTTPS packet of the cached client is transparently transmitted to the source server, and the HTTPS packet of the cached client is deleted.

Optionally, when the second determination result is that the proxy server proxy is disabled, the source server sends the second determination result to the proxy server by using the secure channel. When the second determination result received by the proxy server is to disable the proxy server proxy, a message is sent to the source server confirming that the second determination result has been received.

In step 818, the source server receives the HTTPS packet sent by the proxy server, and uses the session password to parse the HTTPS packet to provide the HTTPS service for the client.

It should be noted that when the proxy server does not need to initiate the negotiation process, the proxy server becomes a transparent proxy between the client and the source server, and data is transparently transmitted between the client and the source server, and the source server provides the client with the transparent transmission. HTTPS service.

In summary, the method for information interaction provided in this embodiment obtains a session password from a source server through dynamic negotiation. When the source server determines to prohibit the proxy server proxy based on the content of the HTTPS packet, the source server still provides the HTTPS service for the client. The proxy server becomes a transparent proxy between the client and the source server.

In the ninth embodiment, when the source server prohibits the proxy server from proxying the HTTPS service, the proxy server provides the HTTPS service to the client by using the session password. The information interaction method provided by the present invention will be described below with reference to FIG. 9A.

Please refer to FIG. 9A, which shows a flowchart of an information interaction method provided by still another exemplary embodiment of the present invention. This embodiment is exemplified by the information interaction method used in the information interaction system shown in FIG. 1, and the method includes the following steps:

Step 901: The proxy server receives a setup request sent by the client for requesting to establish an HTTPS connection, and determines, according to the local policy, whether the proxy negotiation process needs to be started.

Step 902: When the agent negotiation process needs to be started, the proxy server sends a session password acquisition request to the source server.

Step 903: The source server receives the session password acquisition request sent by the proxy server, determines whether the proxy server proxy is allowed, and obtains the first determination result.

For the description of the steps 901 to 903, refer to the explanation of the steps 601 to 603, and details are not described herein again.

In step 904, the source server sends the first determination result to the proxy server.

Optionally, when determining that the proxy server proxy is disabled, the source server sends the first determination result to the proxy server and the reason information of the proxy server proxy.

Correspondingly, when the first determination result received by the proxy server is the reason information for disabling the proxy server proxy and prohibiting the proxy server proxy, the local information of the proxy server is updated by using the cause information. For example, the proxy server will block the source server of the proxy from being determined to be a blacklist.

Step 905: When the first determination result received by the proxy server is prohibiting the proxy server proxy, the proxy server becomes a transparent proxy between the client and the source server, and data is transparently transmitted between the client and the source server.

Specifically, after receiving the first determination result of prohibiting the proxy server proxy, the proxy server becomes a transparent proxy between the client and the source server. Specifically, the proxy server sends the HTTPS packet sent by the client to the source server, and the source server sends the HTTPS service data to the proxy server, and the proxy server transparently transmits the HTTPS service data to the client.

Optionally, after determining that the proxy server proxy is disabled, the source server prohibits the first determination result of the proxy server proxy and the reason for prohibiting the proxy server proxy. When the proxy server receives the first determination result as disabling the proxy server proxy and including the reason information for disabling the proxy server proxy, the local policy is updated with the cause information.

For example, if the source server prohibits the proxy server proxy because the source server does not trust the proxy server, the proxy server can save the source server as a negotiated blacklist to the proxy server's local policy.

It should be noted that when the proxy server does not need to initiate the negotiation process, the proxy server becomes a transparent proxy between the client and the source server, and data is transparently transmitted between the client and the source server, and the source server provides the client with the transparent transmission. HTTPS service.

In summary, the method for information interaction provided in this embodiment obtains a session password from a source server through dynamic negotiation, and the source server determines whether to allow a proxy server proxy based on the content of the HTTPS packet, and solves the problem that the source server needs to use the session password in the related art. It is sent to the proxy server in advance. When there are many proxy servers, it is easy to cause the session password to leak, and the effect of improving the security of the session password is achieved.

In a possible implementation, in a possible implementation, the process of establishing an HTTPS connection between the client and the source server is combined with the process of the source server providing the HTTPS service to the client when the source server prohibits the proxy server from being proxyed.

9B, a flowchart of a method for a source server to prohibit a proxy server to proxy an HTTPS service according to still another exemplary embodiment of the present invention is shown. This embodiment is exemplified by the information interaction method used in the information interaction system shown in FIG. 1, and the method includes the following steps:

The client establishes an HTTPS connection with the source server, which can be implemented through the following sub-steps.

In step 909a1, the client sends a client hello message Client Hello to the proxy server.

In step 909a2, the proxy server transparently transmits the client hello message Client Hello to the source server.

In step 909b1, the source server sends a server hello message Server Hello to the proxy server.

In step 909b2, the proxy server transparently transmits the server hello message Server Hello to the client.

In step 909c1, the source server sends a certificate certificate to the proxy server.

In step 909c2, the proxy server transparently transmits the certificate certificate to the client.

In step 909d1, the source server sends a server hello to the proxy server to end the Server Hello Done message.

In step 909d2, the proxy server transparently transmits the server hello end Server Hello Done message to the client.

In step 909e1, the client sends a client key exchange Client Key Exchange to the proxy server.

In step 909e2, the proxy server transparently transmits the client key exchange Client Key Exchange to the source server.

In step 909f1, the client sends a password change statement Change Cipher Spec to the proxy server.

In step 909f2, the proxy server transparently transmits the password change statement Change Cipher Spec to the source server.

In step 909g1, the client sends an end Finished message to the server.

In step 909g2, the proxy server will end the Passed message to the source server.

In step 909h1, the source server sends a password change statement Change Cipher Spec to the proxy server.

In step 909h2, the proxy server transparently transmits the password change statement Change Cipher Spec to the client.

In step 909i1, the source server sends an end Finished message to the proxy server.

In step 909i2, the proxy server will end the Passed message to the client.

The foregoing sub-steps describe that the client establishes an HTTPS connection with the source server, and the client establishes an HTTPS connection with the source server, which is implemented by a person skilled in the art. In this embodiment, the HTTPS connection process between the client and the source server is involved. Each substep will not be described again.

In step 910, the proxy server determines whether it is necessary to start the proxy negotiation process according to the local policy.

For the description of the step 910, refer to the explanation of the step 601, and details are not described herein again.

Step 911: When the agent negotiation process needs to be started, the proxy server sends a session password acquisition request to the source server through the secure channel.

Step 912: The source server receives the session password acquisition request sent by the proxy server, determines whether the proxy server proxy is allowed, and obtains the first determination result.

For the description of step 912, refer to the explanation of step 603, and details are not described herein again.

In step 913, the first determination result is sent to the proxy server through the secure channel.

Step 914: When the first determination result received by the proxy server is to disable the proxy server proxy, it becomes a transparent proxy between the client and the source server.

For the description of this step, refer to step 905, and details are not described herein again.

Optionally, after the proxy server receives the first determination result of disabling the proxy server proxy, the proxy server sends a message to the source server confirming that the first determination result has been received.

It should be noted that when the proxy server does not need to initiate the negotiation process, the proxy server becomes a transparent proxy between the client and the source server, and data is transparently transmitted between the client and the source server, and the source server provides the client with the transparent transmission. HTTPS service.

In summary, the method for information interaction provided in this embodiment updates the local policy of the proxy server by prohibiting the cause information of the proxy server proxy, so that the proxy association is not directly started in the subsequent process. Business process to improve the efficiency of agent negotiation.

In addition, the source server determines whether to allow the proxy server proxy, which can be implemented by several steps as shown in FIG. 9C.

Step 915: Obtain reference information from the session password acquisition request, where the reference information includes at least one of information of the proxy server, information of the client included in the session password acquisition request, and a local state of the source server.

The proxy server information mentioned here is information that uniquely identifies the proxy server. For example, the information of the proxy server may be the identifier of the proxy server; for example, the information of the proxy server may be the internet protocol of the proxy server (English: internet protocol, IP) address.

The client information mentioned here is information that uniquely identifies the client. For example, the information of the client may be the identifier of the client; for example, the information of the client may be the IP address of the client.

Step 916, determining whether to allow the proxy server proxy according to the reference information and the local policy of the source server, to obtain a first determination result.

This step can be implemented by the following possible implementations.

In a first possible implementation manner, the number of HTTPS connections established by the source server is obtained, and when the number is greater than the first predetermined threshold, the first determination result is determined to be a proxy server proxy.

Generally, the first predetermined threshold is set by the system developer and is used to determine the local state of the source server. When the number of HTTPS connections established by the source server is greater than the first predetermined threshold, it is considered that the source server carries more HTTPS services, and the proxy server may provide the HTTPS service for the client instead of the source server to reduce the load of the source server, and the first determination is performed. The result is determined to allow the proxy server proxy.

In a second possible implementation manner, a load rate of the source server is obtained, and when the load rate is greater than a second predetermined threshold, the first determination result is determined to be a proxy server proxy.

In general, the second predetermined threshold is set by the system developer and is used to determine the local state of the source server. When the load rate of the server is greater than the second predetermined threshold, the source server is considered to be heavily loaded, and the proxy server may provide the HTTPS service to the client instead of the source server to reduce the load of the source server, and determine the first determination result as the proxy server proxy.

In a third possible implementation manner, the blacklist and/or whitelist defined by the source server is obtained, and when the information included in the reference information is in the whitelist, the first determination result is determined to be the proxy server proxy.

The blacklist includes at least one of a proxy server blacklist and a client blacklist, and the whitelist includes at least one of a proxy server whitelist and a client whitelist.

In a fourth possible implementation manner, the source server defines a blacklist and/or a whitelist. When the reference information includes the information in the blacklist, the first determination result is determined to be a proxy proxy proxy.

In a fifth possible implementation manner, when the information included in the reference information is not in the white list and is not in the blacklist, the first determination result is determined to be determined whether the proxy server proxy is allowed to be based on the HTTPS message content.

Optionally, the steps performed by the proxy server in the third, fourth, fifth, and sixth embodiments may be implemented in a programming language, and the programming language is packaged into a software development toolkit, and the proxy server directly invokes the software development toolkit. Implement the above information interaction method. The steps performed by the source servers in the third, fourth, fifth and sixth embodiments are implemented in a programming language, and the programming language is packaged into a software development toolkit, and the source server directly invokes the software development toolkit to implement the above information interaction method. .

Please refer to FIG. 10, which is a block diagram of an information interaction apparatus according to an embodiment of the present invention. The information interaction device can be implemented as all or part of the proxy server by software, hardware or a combination of both. This embodiment is exemplified by the apparatus used in the proxy server 120 shown in FIG. 1. The information interaction apparatus may include: a sending unit 1010 and an executing unit 1020.

The sending unit 1010 is configured to implement the foregoing step 401 function.

The executing unit 1020 is configured to implement the foregoing step 402 function.

Optionally, the information interaction device further includes: a receiving unit 1030.

In the third embodiment, the sending unit 1010 is configured to perform step 602, the executing unit 1020 is configured to perform step 601, and the receiving unit 1030 is configured to perform steps 604 and 605.

In the fourth embodiment, the sending unit 1010 is configured to perform step 608, the executing unit 1020 is configured to perform step 607, step 611, and step 614, and the receiving unit 1030 is configured to perform step 612 and step 614.

In the fifth embodiment, the sending unit 1010 is configured to perform step 702 and step 705, the executing unit 1020 is configured to perform step 701 and step 708, and the receiving unit 1030 is configured to perform step 705.

In the sixth embodiment, the sending unit 1010 is configured to perform step 711 and step 715, the executing unit 1020 is configured to perform step 710, step 714 and step 718, and the receiving unit 1030 is configured to perform step 714.

In the seventh embodiment, the sending unit 1010 is configured to perform step 802 and step 805, the executing unit 1020 is configured to perform step 801 and step 808, and the receiving unit 1030 is configured to perform step 808.

In the eighth embodiment, the sending unit 1010 is configured to perform step 811 and step 815, the executing unit 1020 is configured to perform step 810 and step 814, and the receiving unit 1030 is configured to perform step 814.

In the ninth embodiment, the sending unit 1010 is configured to perform step 902, the executing unit 1020 is configured to perform step 901 and step 904, and the receiving unit 1030 is configured to perform step 904.

In the tenth embodiment, the sending unit 1010 is configured to perform step 910, the executing unit 1020 is configured to perform step 911, and the receiving unit 1030 is configured to perform step 914.

The transmitting unit 1010 is executed by the transmitting module of the proxy server 120 shown in FIG. 2, the executing unit 1020 is executed by the executing module of the proxy server 120 shown in FIG. 2, and the receiving unit 1030 is executed by the receiving module of the proxy server 120 shown in FIG. 2.

Related details can be combined with reference to the above method embodiments.

Please refer to FIG. 11, which is a block diagram of an information interaction apparatus according to an embodiment of the present invention. The information interaction device can be implemented as all or part of the user equipment by software, hardware or a combination of both. This embodiment is illustrated by using the apparatus in the source server 140 shown in FIG. 1. The information interaction apparatus may include: a receiving unit 1110, an executing unit 1120, and a sending unit 1130.

The receiving unit 1110 is configured to implement the foregoing step 501 function.

The executing unit 1120 is configured to implement the foregoing step 502 function.

The sending unit 1130 is configured to implement the foregoing step 503 function.

Related details can be combined with reference to the above method embodiments.

Optionally, in the third embodiment, the receiving unit 1110 is configured to perform step 603, the executing unit 1120 is configured to perform step 603, and the sending unit 1130 is configured to perform step 604.

In the fourth embodiment, the receiving unit 1110 is configured to perform step 609, the executing unit 1120 is configured to perform step 609, and the sending unit 1130 is configured to perform step 613 and step 610.

In the fifth embodiment, the receiving unit 1110 is configured to perform step 706, the executing unit 1120 is configured to perform step 706, and the sending unit 1130 is configured to perform step 704 and step 707.

In the sixth embodiment, the receiving unit 1110 is configured to perform step 712, the executing unit 1120 is configured to perform step 712 and step 716, and the sending unit 1130 is configured to perform step 713 and step 717.

In the seventh embodiment, the receiving unit 1110 is configured to perform step 806, the executing unit 1120 is configured to perform step 806, and the sending unit 1130 is configured to perform step 804 and step 807.

In the eighth embodiment, the receiving unit 1110 is configured to perform step 815 and step 817, the executing unit 1120 is configured to perform step 812, step 816, and step 818, and the sending unit 1130 is configured to perform step 813.

In the ninth embodiment, the receiving unit 1110 is configured to perform step 903, the executing unit 1120 is configured to perform step 903, and the sending unit 1130 is configured to perform step 904.

In the tenth embodiment, the receiving unit 1110 is configured to perform step 912, the executing unit 1120 is configured to perform step 912, and the sending unit 1130 is configured to perform step 913.

The receiving unit 1110 is executed by the receiving module of the source server 140 shown in FIG. 3, the executing unit 1120 is executed by the executing module of the source server 140 shown in FIG. 3, and the transmitting unit 1130 is executed by the transmitting module of the source server 140 shown in FIG.

Related details can be combined with reference to the above method embodiments.

A person skilled in the art may understand that all or part of the steps of implementing the above embodiments may be completed by hardware, or may be instructed by a program to execute related hardware, and the program may be stored in a computer readable storage medium. The storage medium mentioned may be a read only memory, a magnetic disk or an optical disk or the like.

The above are only the preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalents, improvements, etc., which are within the spirit and scope of the present invention, should be included in the protection of the present invention. Within the scope.

Claims (23)

An information interaction method is characterized in that it is applied to a source server, and the method includes: Receiving a session password acquisition request sent by the proxy server; Determining whether the proxy server agent is allowed; When determining that the proxy server agent is allowed, sending a session password to the proxy server, the session password being a session password agreed by the source server and the client in establishing a secure hypertext transfer protocol HTTPS connection, The session password is used to trigger the proxy server to provide an HTTPS service for the client. The method according to claim 1, wherein said determining whether to permit said proxy server proxy comprises: Obtaining reference information from the session password acquisition request, where the reference information includes at least one of information of a proxy server, information of a client included in the session password acquisition request, and a local state of the source server; Determining whether to allow the proxy server proxy according to the reference information and the local policy of the source server, to obtain a first determination result, The first determination result is that the proxy server agent is allowed, or it is required to determine whether to allow the proxy server proxy based on the HTTPS message content, or to prohibit the proxy server proxy. The method according to claim 2, wherein the determining, according to the reference information and the local policy of the source server, whether to allow the proxy server proxy to obtain the first determination result comprises: Acquiring the number of HTTPS connections established by the source server, and determining, when the quantity is greater than a first predetermined threshold, the first determination result to allow the proxy server proxy; or, Obtaining a load rate of the source server, and determining, when the load rate is greater than a second predetermined threshold, the first determination result to allow the proxy server proxy. The method according to claim 2, wherein the determining, based on the reference information and the local policy of the source server, whether to allow the proxy server proxy to obtain a first determination result, include: Obtaining a blacklist and/or a whitelist defined by the source server; When the information included in the reference information is located in the white list, determining the first determination result to allow the proxy server agent; or When the reference information includes information located in the blacklist, determining the first determination result as disabling the proxy server proxy; or When the information included in the reference information is not located in the white list and is not located in the blacklist, determining the first determination result as determining whether to allow the proxy server proxy based on the HTTPS message content, The information included in the reference information includes at least one of information of the proxy server and information of the client. The method according to claim 2, wherein the sending the session password to the proxy server comprises: Sending, to the proxy server, a session password agreed with the client when the first determination result is that the proxy server agent is allowed; or When the first determination result is that it is required to determine whether to allow the proxy server proxy based on the HTTPS message content, waiting to receive the HTTPS packet sent by the client transparently transmitted by the proxy server, and receiving the proxy server After the HTTPS message sent by the client is transparently transmitted, determining whether to allow the proxy server according to the received HTTPS message, and sending the proxy server to the proxy server when determining that the proxy server proxy is allowed The session password agreed by the client. The method according to claim 5, wherein after the determining, according to the received HTTPS message, whether the proxy server is allowed, the method further comprises: And sending, to the proxy server, a second determination result indicating that the proxy server is prohibited from being activated, and the second determination result is used to trigger the proxy server to delete the cached HTTPS packet of the client. An information interaction method is characterized in that it is applied to a proxy server, and the method includes: Receiving an establishment request sent by the client for requesting establishment of a secure hypertext transfer protocol HTTPS connection; Sending a session password acquisition request to the source server, where the session password acquisition request is used to trigger the source server to determine whether to permit the proxy server proxy; Obtaining, from the source server, a session password agreed by the source server and the client in establishing the HTTPS connection process when the source server allows the proxy server proxy; The client is provided with an HTTPS service using the session password. The method according to claim 7, wherein the obtaining, by the source server, the session password agreed by the source server and the client during the establishment of the HTTPS connection comprises: Receiving the session password sent by the source server, where the session password is sent after the source server determines that the proxy server proxy is allowed and the session password is agreed with the client; or, Transmitting the received HTTPS packet sent by the client to the source server, and receiving the session password sent by the source server, where the session password is after the source server receives the HTTPS packet. And determining, according to the content of the HTTPS message, that the proxy server is allowed to be sent. The method according to claim 7, wherein after the sending a session password acquisition request to the source server, the method further comprises: Receiving a first determination result sent by the source server, where the first determination result is a first determination result obtained by the source server after determining whether to allow the proxy server proxy after receiving the session password acquisition request; When the first determination result is that the proxy server agent is allowed to determine whether to allow the proxy server proxy based on the HTTPS message content, the received HTTPS packet sent by the client is cached. The method according to claim 8 or 9, wherein after the transparently transmitting the received HTTPS message sent by the client to the source server, the method further comprises: Receiving a second determination result sent by the source server, where the second determination result is obtained after the source server receives the HTTPS message, and determines whether to allow the proxy server proxy according to the content of the HTTPS message. ; Deleting the cached guest when the second determination result is that the proxy server agent is disabled HTTPS packet sent by the client. The method according to claim 8, wherein the obtaining, by the source server, the session password agreed by the source server and the client during the establishment of the HTTPS connection comprises: Determining, according to the local policy, whether the proxy negotiation process needs to be started, and when the proxy negotiation process needs to be started, obtaining, by the source server, the session password agreed by the source server and the client in establishing the HTTPS connection process; The method further includes: And when the first determination result is that the proxy server proxy is prohibited and the reason information of the proxy proxy is prohibited, the local policy is updated by using the cause information. An information interaction device is characterized in that it is applied to a source server, and the device includes: a receiving unit, configured to receive a session password acquisition request sent by the proxy server; An execution unit, configured to determine whether the proxy server agent is allowed; a sending unit, configured to send a session password to the proxy server when determining that the proxy server agent is allowed, the session password being agreed by the source server and the client in establishing a secure hypertext transfer protocol HTTPS connection a session password, the session password being used to trigger the proxy server to provide an HTTPS service for the client. The device according to claim 12, characterized in that The execution unit is further configured to obtain reference information from the session password acquisition request, where the reference information includes at least information of a proxy server, information of a client included in the session password acquisition request, and locality of the source server. At least one of the states; The executing unit determines whether to allow the proxy server proxy according to the reference information and the local policy of the source server, to obtain a first determination result, The first determination result is that the proxy server agent is allowed, or it is required to determine whether to allow the proxy server proxy based on the HTTPS message content, or to prohibit the proxy server proxy. The apparatus according to claim 13, wherein the execution unit is further configured to: Obtaining the number of HTTPS connections established by the source server, when the quantity is greater than the first predetermined At the threshold, determining the first determination result to allow the proxy server proxy; or, Obtaining a load rate of the source server, and determining, when the load rate is greater than a second predetermined threshold, the first determination result to allow the proxy server proxy. The apparatus according to claim 13, wherein the execution unit is further configured to: Obtaining a blacklist and/or a whitelist defined by the source server; When the information included in the reference information is located in the white list, determining the first determination result to allow the proxy server agent; or When the reference information includes information located in the blacklist, determining the first determination result as disabling the proxy server proxy; or When the information included in the reference information is not located in the white list and is not located in the blacklist, determining the first determination result as determining whether to allow the proxy server proxy based on the HTTPS message content, The information included in the reference information includes at least one of information of the proxy server and information of the client. The device according to claim 13, wherein the sending unit is further configured to: Sending, to the proxy server, a session password agreed with the client when the first determination result is that the proxy server agent is allowed; or When the first determination result is that it is required to determine whether to allow the proxy server proxy based on the HTTPS message content, waiting to receive the HTTPS packet sent by the client transparently transmitted by the proxy server, and receiving the proxy server After the HTTPS message sent by the client is transparently transmitted, determining whether to allow the proxy server according to the received HTTPS message, and sending the proxy server to the proxy server when determining that the proxy server proxy is allowed The session password agreed by the client. The device of claim 16 wherein: The sending unit is further configured to: when determining that the proxy server agent is prohibited, send a second determination result indicating that the proxy server proxy is prohibited, and the second determination result is used to trigger the The proxy server deletes the cached HTTPS message of the client. An information interaction device is characterized in that it is applied to a proxy server, and the device includes: a receiving unit, configured to receive a setup request sent by the client for requesting establishment of a secure hypertext transfer protocol HTTPS connection; a sending unit, configured to send a session password obtaining request to the source server, where the session password obtaining request is used to trigger the source server to determine whether to permit the proxy server proxy; An execution unit, configured to acquire, from the source server, a session password agreed by the source server and the client in establishing the HTTPS connection process when the source server allows the proxy server proxy; The execution unit is further configured to provide the client with an HTTPS service by using the session password. The device of claim 18, wherein The receiving unit is further configured to receive the session password sent by the source server, where the session password is sent after the source server determines that the proxy server is allowed to be authorized and the session password is agreed with the client. ; or, The receiving unit is further configured to transparently transmit the received HTTPS packet sent by the client to the source server, and receive the session password sent by the source server, where the session password is the source server. After receiving the HTTPS message, it is determined according to the content of the HTTPS message that the proxy server is allowed to send. The device of claim 18, wherein The receiving unit is further configured to receive a first determination result sent by the source server, where the first determination result is that the source server determines whether to allow the proxy server proxy after receiving the session password acquisition request. The first judgment result obtained at the time; The execution unit is further configured to: when the first determination result is that the proxy server agent is allowed to be used, or if it is determined whether the proxy server proxy is allowed to be based on the content of the HTTPS packet, the cache is sent by the client. HTTPS message. Device according to claim 18 or 19, characterized in that The receiving unit is further configured to receive a second determination result sent by the source server, where the second The determination result is obtained when the source server receives the HTTPS message, and determines whether to allow the proxy server proxy according to the content of the HTTPS message; The execution unit is further configured to: when the second determination result is that the proxy server proxy is disabled, delete the cached HTTPS packet sent by the client. The device of claim 18, wherein The execution unit is further configured to determine, according to the local policy, whether to start the proxy negotiation process, and when the proxy negotiation process needs to be started, obtain, by the source server, the source server and the client in the process of establishing the HTTPS connection The agreed session password; The execution unit is further configured to update the local policy by using the reason information when the first determination result is that the proxy server proxy is prohibited and the cause information of the proxy proxy is prohibited. An information interaction system, characterized in that the information interaction system comprises: a proxy server and a source server, The source server includes the information interaction device according to any one of claims 12 to 17; The proxy server includes the information interaction device according to any one of claims 18 to 22.

Images