Back to results
US 11,706,254 B2Granted
Method and apparatus for identifying encrypted data stream
AssigneeHuawei Technologies Co., Ltd.
InventorYong Zhao
Life of this patent
Estimating the term…
Abstract
A method includes parsing a handshake message of an encrypted data stream according to a secure encrypted transmission protocol corresponding to the encrypted data stream, to obtain a plurality of fields included in the handshake message, determining, from a plurality of rule sets and based on the plurality of fields, a rule set that matches the handshake message, and determining, based on a mapping relationship between the matched rule set and an application, an application corresponding to the encrypted data stream.
Claims20
An encrypted data stream identification method, comprising:
- parsing a handshake message of an encrypted data stream to obtain a plurality of fields comprised in the handshake message, wherein the parsing is performed according to a secure encrypted transmission protocol corresponding to the encrypted data stream;
- determining a rule set of a plurality of rule sets comprising a plurality of field rules and a plurality of order rules, wherein the rule set is associated with an application corresponding to the encrypted data stream and matches the handshake message, and wherein determining the rule set comprises:
- determining whether the plurality of fields matches one or more field rules associated with a first subset of applications, wherein each of the field rules indicates a feature of a field and comprises at least one of a length of the field, a type of the field, or a value of the field;
- and
- determining whether an order of the plurality of fields comprised in the handshake message matches one or more order rules associated with a second subset of applications, wherein each of the order rules indicates the order of the plurality of fields in the handshake message;
- obtaining an intersection set of the first subset of applications and the second subset of applications;
- and
- determining the application corresponding to the encrypted data stream based on the intersection set of the first subset of applications and the second subset of applications and whether the plurality of fields matches the one or more field rules associated with the application and whether the order of the plurality of fields comprised in the handshake message matches the one or more order rules associated with the application.
5 more elements
An encrypted data stream identification device, comprising:
- a processor;
- and
- a memory coupled to the processor and storing instructions that, when executed by the processor, cause the encrypted data stream identification device to be configured to:
- parse a handshake message of an encrypted data stream according to a secure encrypted transmission protocol to obtain a plurality of fields comprised in the handshake message;
- determine a rule set of a plurality of rule sets comprising a plurality of field rules and a plurality of order rules, in which the rule set is associated with an application corresponding to the encrypted data stream and matches the handshake message, wherein, to determine the rule set, the instructions further cause the encrypted data stream identification device to be configured to:
- determine whether the plurality of fields matches one or more field rules associated with a first subset of applications, wherein each of the field rules indicates a feature of a field and comprises at least one of a length of the field, a type of the field, or a value of the field;
- and
- determine whether an order of the plurality of fields comprised in the handshake message matches one or more order rules associated with a second subset of applications, wherein each of the order rules indicates the order of the plurality of fields in the handshake message;
- obtain an intersection set of the first subset of applications and the second subset of applications;
- and
- determine the application corresponding to the encrypted data stream based on the intersection set of the first subset of applications and the second subset of applications and whether the plurality of fields matches the one or more field rules associated with the application and whether the order of the plurality of fields comprised in the handshake message matches the one or more order rules associated with the application.
8 more elements
A computer program product comprising computer-executable instructions for storage on a non-transitory computer-readable medium that, when executed by a processor, cause an encrypted data stream identification device to:
- parse a handshake message of an encrypted data stream according to a secure encrypted transmission protocol to obtain a plurality of fields comprised in the handshake message;
- determine a rule set of a plurality of rule sets comprising a plurality of field rules and a plurality of order rules, in which the rule set is associated with an application and matches the handshake message, wherein, to determine the rule set, the computer-executable instructions further cause the encrypted data stream identification device to:
- determine whether the plurality of fields matches one or more field rules associated with a first subset of applications, wherein each of the field rules indicates a feature of a field and comprises at least one of a length of the field, a type of the field, or a value of the field;
- and
- determine whether an order of the plurality of fields comprised in the handshake message matches one or more order rules associated with a second subset of applications, wherein each of the order rules indicates the order of the plurality of fields in the handshake message;
- obtain an intersection set of the first subset of applications and the second subset of applications;
- and
- determine the application corresponding to the encrypted data stream based on the intersection set of the first subset of applications and the second subset of applications and whether the plurality of fields matches the one or more field rules associated with the application and whether the order of the plurality of fields comprised in the handshake message matches the one or more order rules associated with the application.
5 more elements
Dependencies are inferred from the claim text.