| CPC H04L 9/0825 (2013.01) [H04L 9/0841 (2013.01); H04L 9/0869 (2013.01)] | 19 Claims |
|
1. An encrypted packet inspection method, wherein the method comprises:
separately sending, by a protection device, a man-in-the-middle Diffie-Hellman (DH) parameter to a client device and to a server, wherein the protection device is deployed between the client device and the server, and the man-in-the-middle DH parameter is a DH parameter generated by the protection device;
generating, by the protection device, a first session key based on the man-in-the-middle DH parameter and a client DH parameter, wherein the client DH parameter is a DH parameter generated by the client device;
generating, by the protection device, a second session key based on the man-in-the-middle DH parameter and a server DH parameter, wherein the server DH parameter is a DH parameter generated by the server;
receiving, by the protection device, an original encrypted packet; and
when the original encrypted packet originates from the client device, decrypting, by the protection device, the original encrypted packet with the first session key, inspecting plaintext data obtained through decryption, encrypting the inspected plaintext data with the second session key to obtain a target encrypted packet, and sending the target encrypted packet to the server; or
when the original encrypted packet originates from the server, decrypting, by the protection device, the original encrypted packet with the second session key, inspecting plaintext data obtained through decryption, encrypting the inspected plaintext data with the first session key to obtain a target encrypted packet, and sending the target encrypted packet to the client device.
|