WO2016176858A1

WO2016176858A1 - Request transmission method and client

Info

Publication number: WO2016176858A1
Application number: PCT/CN2015/078467
Authority: WO
Inventors: 魏鑫鹏
Original assignee: 华为技术有限公司
Priority date: 2015-05-07
Filing date: 2015-05-07
Publication date: 2016-11-10
Also published as: CN106464603A; CN106464603B

Abstract

Provided in embodiments of the present invention are a request transmission method and client. The method comprises: determining, by a client, a preset instruction according to an attribute of a resource to be accessed or a first user instruction; and transmitting, by the client, a TLS connection establishment request carrying the preset instruction, wherein the preset instruction is configured to instruct a proxy entity receiving the TLS connection establishment request to process a target message, and the target message is a message transmitted via a TLS connection established based on the TLS connection establishment request. Since the client determines the preset instruction according to the attribute of the resource to be accessed or the first user instruction and does not determine the preset instruction according to whether the resource to be accessed utilizes a https URL identifier or a http URL identifier, the client accurately determines the preset instruction, such that the proxy entity accurately decrypts the target message, and processes the decrypted target message, thus improving service quality.

Description

Method and client for transmitting request

Technical field

The present invention relates to the field of communications technologies, and in particular, to a method and a client for transmitting a request.

Background technique

HTTP (Hypertext Transfer Protocol) is the most widely used stateless application layer protocol on the Internet, and communicates based on the transmission layer TCP (Transmission Control Protocol). A schematic diagram of working with the HTTP protocol is shown in Figure 1A.

The SSL (Security Socket Layer) protocol was originally designed to protect the security of network information transmission. The protocol is located below the application layer above the transport layer. The SSL protocol was first proposed by Netscape in November 1994 and was first implemented (SSLv2). After many modifications, it was finally adopted and formulated as a TLS (Transport Layer Security) protocol. The TLS protocol is The location in the TCP/IP (Internet Protocol) protocol stack and the basic building blocks of the TLS protocol are shown in FIG. 1B. As can be seen from FIG. 1B, the TLS protocol includes the TLS Record Protocol. , TLS Handshaking Protocol (TLS handshake protocol), TLS Change Cipher Spec Protocol (TLS Security Algorithm Change Protocol) and TLS Alter Protocol (TLS Warning Protocol). Further, it can be seen that the TLS protocol is in the HTTP protocol and the TCP protocol. between. The SSL protocol and its successor TLS protocol, as a security protocol that provides encryption, identity authentication, and data integrity assurance for network communications, have been widely used for secure communication between clients and servers. The communication process using the TLS protocol is divided into two phases:

The first stage is: handshake negotiation process, the client uses the handshake protocol to negotiate and exchange related protocol versions, compression methods, encryption algorithms and session keys with the server, and can also verify the identity of the server.

The second phase is: the data transfer process, the server and the client use the negotiated session secret The key and the algorithm process the data; after the data is transmitted, the server and the client disconnect the session in an identifiable manner. In the data transmission process, the transmitted data is encrypted by using an encryption method. Currently, the commonly used encryption methods are : A symmetric encryption algorithm, an asymmetric encryption algorithm, in which an asymmetric encryption algorithm includes a digital certificate.

The URL (Uniform Resource Locator) in the HTTP message can be divided into an http URL (for example: http://www.example.com) and an https URL (for example, https://www.example.com). For the resource identified by using the http URL, it is not required to use TLS for security; for the resource identified by using the https URL, TLS is required for security protection. Since the accessed resources are protected by TLS, the end-to-end security between the client and the server can be implemented. Therefore, a trend of security protection is commonly used, that is, the resource identified by the http URL and the https URL are identified. Resources are secured using TLS.

In the prior art, the client determines the preset indication according to whether the resource to be accessed uses the identifier of the http URL, and then sends the preset indication to the proxy entity, and the proxy entity determines to decrypt the subsequent message according to the preset indication. , or forward processing. Nowadays, more and more resources that can be identified by the https URL can be identified by the http URL. Therefore, the current method of transmitting the request has the defect of low service quality.

In summary, the current method of transmitting requests has the defect of low service quality.

Summary of the invention

The embodiment of the invention provides a method and a client for transmitting a request, which are used to solve the defect that the service quality in the prior art is low.

In a first aspect, a method for transmitting a request is provided, including:

The client determines the preset indication according to the attribute of the resource to be accessed or the first user indication;

Transmitting, by the client, a transport layer secure TLS connection establishment request that carries the preset indication;

The preset indication is used to indicate that the proxy entity that receives the TLS connection establishment request processes the target message, where the target message is a TLS established by the TLS connection establishment request. Connect the transmitted message.

With reference to the first aspect, in a first possible implementation, the attributes of the to-be-accessed resource include: at least one of a type of the resource to be accessed and a domain name of the resource to be accessed.

With reference to the first possible implementation manner of the first aspect, in a second possible implementation manner, before the determining, by the client, the preset indication according to the attribute of the resource to be accessed or the first user indication, the method further includes:

Determining, by the client, an attribute of the resource to be accessed, or the client receiving the first user indication;

Determining, by the client, attributes of the to-be-accessed resource, including:

The client determines an attribute of the resource to be accessed according to a uniform resource locator URL and/or a hypertext markup language HTML file.

With reference to the first aspect, or the first to the second possible implementation manners of the first aspect, in a third possible implementation manner, the preset indication includes a first preset indication, and a second preset indication at least one;

The first preset indication is used to indicate that the proxy entity that received the TLS connection establishment request decrypts the target message;

The second preset indication is used to indicate that the proxy entity that received the TLS connection setup request forwards the target message.

With reference to the first aspect, or the first to third possible implementation manners of the first aspect, in a fourth possible implementation manner, the preset indication is a first preset indication, and the first preset indication Determining, by the proxy entity receiving the TLS connection establishment request, the target message;

After the client sends the TLS connection establishment request that carries the preset indication, the method further includes:

Receiving, by the client, a digital certificate of the proxy entity sent by the proxy entity;

Determining, by the client, the credibility of the proxy entity according to the digital certificate;

The client determines to send a message to the proxy entity to continue to establish the TLS connection when the proxy entity is trusted.

In conjunction with the fourth possible implementation of the first aspect, in a fifth possible implementation, Determining, by the client, that the proxy entity is trusted according to the digital certificate, including:

Determining, by the client, that the digital certificate successfully passes the detection of the certificate chain, and determining that the client stores the digital certificate, determining that the proxy entity is trusted; or

The client determines that the proxy entity is trusted according to the second user indication.

With reference to the first aspect, or the first to fifth possible implementation manners of the first aspect, in a sixth possible implementation, the method further includes:

Sending, by the client, a TLS connection establishment request that does not carry the preset indication;

Returning, by the client, a message that continues to establish the TLS connection to the proxy entity; or, the client returns a TLS connection establishment request that carries a second preset indication to the proxy entity, where the second preset indication The proxy entity for indicating that the TLS connection setup request is received forwards the target message.

With reference to the first aspect, or the first to fifth possible implementation manners of the first aspect, in a seventh possible implementation manner, the preset indication is a third preset indication, and the third preset indication And configured to instruct the proxy entity to query the client whether the proxy entity processes the received target message;

With reference to the fourth to seventh possible implementation manners of the first aspect, in the eighth possible implementation, the digital certificate is configured to add at least the first information and the second information to the digital certificate in the X.509 format a digital certificate, the first information is information for verifying an operation performed by the proxy entity after the proxy entity is trusted, and the second information is an operation performed by the proxy entity on the decrypted target message Information.

In a second aspect, a client is provided, including:

a processor, configured to determine a preset indication according to an attribute of the resource to be accessed or a first user indication;

a transmitter, configured to send a transport layer secure TLS connection establishment request that carries the preset indication;

The preset indication is used to indicate that the proxy entity that receives the TLS connection establishment request processes the target message, where the target message is a message transmitted by using the TLS connection established by the TLS connection establishment request.

With reference to the second aspect, in a first possible implementation, the attributes of the to-be-accessed resource include: at least one of a type of the resource to be accessed and a domain name of the resource to be accessed.

With reference to the first possible implementation of the second aspect, in a second possible implementation, the processor is further configured to determine an attribute of the resource to be accessed;

The client further includes a receiver, configured to receive the first user indication;

When the processor determines the attribute of the resource to be accessed, specifically:

The attribute of the resource to be accessed is determined according to a uniform resource locator URL and/or a hypertext markup language HTML file.

With reference to the second aspect, or the first to the second possible implementation manners of the second aspect, in a third possible implementation manner, the preset indication includes a first preset indication, and a second preset indication at least one;

With reference to the second aspect, or the first to third possible implementation manners of the second aspect, in a fourth possible implementation manner, the preset indication is a first preset indication, and the first preset indication Determining, by the proxy entity receiving the TLS connection establishment request, the target message;

The client further includes a receiver, configured to receive a digital certificate of the proxy entity sent by the proxy entity;

The processor is further configured to verify the credibility of the proxy entity according to the digital certificate;

The transmitter is further configured to send a message to the proxy entity to continue to establish the TLS connection when the processor determines that the proxy entity is trusted.

With reference to the fourth possible implementation manner of the second aspect, in a fifth possible implementation, the determining, by the processor, that the proxy entity is trusted according to the digital certificate is specifically:

Determining that the digital certificate successfully passes the detection of the certificate chain, and determining that the client stores the digital certificate, determining that the proxy entity is trusted; or

The proxy entity is determined to be trusted according to the second user indication.

With reference to the second aspect, or the first to fifth possible implementation manners of the second aspect, in a sixth possible implementation, the transmitter is further configured to send a TLS connection that does not carry the preset indication Establish a request;

The transmitter is further configured to: return, to the proxy entity, a message that continues to establish the TLS connection; or return a TLS connection establishment request that carries a second preset indication to the proxy entity, where the second preset indication The proxy entity for indicating that the TLS connection setup request is received forwards the target message.

With reference to the second aspect, or the first to fifth possible implementation manners of the second aspect, in a seventh possible implementation manner, the preset indication is a third preset indication, and the third preset indication And configured to instruct the proxy entity to query the client whether the proxy entity processes the received target message;

Combining the fourth to seventh possible implementations of the second aspect, in the eighth possible implementation Wherein the digital certificate is a digital certificate that adds at least one of the first information and the second information to the digital certificate in the X.509 format, the first information being the proxy entity after verifying that the proxy entity is trusted Information of the performed operation, the second information being information of an operation performed by the proxy entity on the decrypted target message.

The embodiment of the present invention provides a method for transmitting a request: the client determines a preset indication according to the attribute of the resource to be accessed or the first user indication; the client sends a TLS connection establishment request that carries the preset indication; Determining, by the proxy entity receiving the TLS connection establishment request, the target message, the target message is a message transmitted by the TLS connection established by the TLS connection establishment request, because the client is according to the attribute of the resource to be accessed or the first user indication. The preset indication is determined according to whether the resource to be accessed is identified by the https URL or the http URL identifier. Even if the resource identified by the https URL is used, the https URL identifier is used, and the client can accurately determine the identifier. The preset indication, in this way, the proxy entity can accurately decrypt the target message according to the received TLS connection establishment request, and then process the decrypted target message to improve the service quality.

DRAWINGS

FIG. 1A is a schematic diagram of working in the prior art using the HTTP protocol; FIG.

1B is a schematic diagram of a TLS protocol in the prior art;

2 is a schematic structural diagram of a transmission request according to an embodiment of the present invention;

FIG. 3A is a flowchart of a transmission request according to an embodiment of the present invention; FIG.

3B is a schematic diagram of a digital certificate of a proxy entity in an embodiment of the present invention;

4A is an embodiment of a transmission request in an embodiment of the present invention;

4B is another embodiment of a transmission request in an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a client in an embodiment of the present invention.

detailed description

In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the following will be combined with the present invention. The technical solutions in the embodiments of the present invention are clearly and completely described in the drawings, and the embodiments are described as a part of the embodiments of the present invention, rather than all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

Hereinafter, the system involved in the present application will be described so as to be understood by those skilled in the art.

The communication system involved in the present invention is mainly a communication core network portion. The core network here may be the core network of the mobile network as shown in FIG. 2, and the core network shown in FIG. 2 refers to the E-UTRAN (Evolved Universal Terrestrial Radio Access Network). Network architecture consisting of devices other than the IP (Internet Protocol) data network, including: MME (Mobility Management Entity), HSS (Home Subscriber Server), Serving Gateway ( Service Gateway), PDN (Packet Data Network), and Policy and Charging Rules Function (PCRF). It should be noted that E-UTRAN refers to The network may be a core network of a fixed network. The fixed network refers to a traditional IP network. Since the IP network is a well-known technology for those skilled in the art, it will not be described in detail herein.

The entity involved in the present invention includes a client, a PDN (Packet Data Network) gateway, and a service gateway. The proxy entity may be located in the PDN Gateway, or may be a separate network device.

The proxy entity mentioned in the embodiment of the present invention may optionally be configured to intercept the TLS connection establishment request and decrypt or directly forward the target message transmitted based on the TLS connection according to the preset indication carried in the TLS connection establishment request. The function, it should be noted that the proxy entity is only the name of the device having the above functions, and may also be referred to as a TLS connection processing device, or may be another name, as long as it has the above functions, and is not specifically limited herein. The following describes the name of the device having the above functions as a proxy entity.

"Multiple" means two or more. "and / or", describing the association relationship of the associated object, the table There may be three relationships, for example, A and/or B, which may indicate that there are three cases where A exists separately, A and B exist at the same time, and B exists separately. The character "/" generally indicates that the contextual object is an "or" relationship.

The preferred embodiments of the present invention are described in detail below with reference to the accompanying drawings, and the preferred embodiments of the present invention are intended to illustrate and explain the invention, and not to limit the invention, and The embodiments in the application and the features in the embodiments may be combined with each other.

The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

Referring to FIG. 3A, in the embodiment of the present invention, a process for transmitting a request is as follows:

Step 300: The client determines a preset indication according to an attribute of the resource to be accessed or a first user indication.

Step 310: The client sends a TLS connection establishment request that carries a preset indication.

The first preset indication is used to indicate that the proxy entity that receives the TLS connection establishment request processes the target message, and the target message is a message that is transmitted through the TLS connection established by the TLS connection establishment request.

The client mentioned in the embodiment of the present invention may be referred to as a user equipment, and may also be a terminal.

In the embodiment of the present invention, the attribute of the resource to be accessed includes at least one of a type of the resource to be accessed and a domain name of the resource to be accessed.

For example, the resource to be accessed is a resource that needs to be encrypted end-to-end, such as a resource of a bank website or a resource of a login type; or, the resource to be accessed is a resource of the mpeg type (moving image expert group).

Optionally, the client can determine the type of the resource to be accessed through the URL, and can also determine the type of the resource to be accessed through an HTML (HyperText Markup Language) file, and determine the to-be-viewed by using the HTML file. When the type of the resource is used, the type of the resource to be accessed can be determined according to the context information of the content in the HTML file.

In the embodiment of the present invention, optionally, the preset indication may include at least one of a first preset indication and a second preset indication;

Optionally, the first preset indication may be used to indicate that the proxy entity that received the TLS connection establishment request decrypts the target message;

The second preset indication may be used to indicate that the proxy entity that received the TLS connection setup request forwards the target message.

For example, for a resource of a login type (login) type or a resource of a bank type, the TLS connection establishment request carries a first preset indication; for the mpeg (moving image expert group) type to be accessed The resource, the TLS connection establishment request carries a second preset indication.

That is, in the embodiment of the present invention, the client may carry the first preset indication in the TLS connection establishment request, and the proxy entity may be used to decrypt the target message. Of course, the TLS connection establishment request may not carry the first preset indication. Instead, the second preset indication is carried, indicating that the proxy entity does not decrypt the target message, but directly forwards the target message.

When the preset indication includes the first preset indication, further, in order to improve the security, after the client sends the TLS connection establishment request that carries the preset indication, the following operations are also included:

The client receives a digital certificate of the proxy entity sent by the proxy entity;

The client verifies the authenticity of the proxy entity based on the digital certificate;

The client determines to send a message to the proxy entity to continue to establish a TLS connection when the proxy entity is trusted.

In the embodiment of the present invention, there are multiple ways for the client to determine the trustedness of the proxy entity according to the digital certificate. Alternatively, the method may be as follows:

The client determines that the digital certificate successfully passes the detection of the certificate chain, and determines that the client entity is trusted when storing the digital certificate; or

If the digital certificate is not stored in the client, the client can determine that the proxy entity is trusted according to the second user indication.

In the embodiment of the present invention, the verification process of the digital certificate of the proxy entity is different from the verification process of the common SSL certificate in the prior art. The main difference is that, in the embodiment of the present invention, the number of the proxy entity is not The certificate performs verification of the domain name information, that is, whether the domain name information of the accessed resource is not compared with the Common Name field in the digital certificate.

The above describes that the TLS connection establishment request carries the first preset indication or the second preset indication. In the actual application, the TLS connection establishment request may not carry the first preset indication or the second preset indication. In this case, the proxy entity sends the digital certificate of the proxy entity to the client, and queries the client. When the proxy entity receives the target message, whether the target message is to be decrypted or the target message is to be forwarded. Therefore, in the embodiment of the present invention, the method further includes:

The client sends a TLS connection establishment request that does not carry the preset indication.

The client returns a message to the proxy entity to continue to establish a TLS connection; or the client returns a TLS connection establishment request carrying the second preset indication to the proxy entity, and the second preset indication is used to indicate the proxy entity that receives the TLS connection establishment request Forward the target message.

The above description is that the proxy entity sends a digital certificate of the proxy entity to the client, asking whether the client decrypts the target message or forwards the target message. In the application, the proxy entity may also decide whether to decrypt the target message or forward the target message, or It is processed directly according to decryption, and will not be detailed here.

It should be noted that even if the proxy entity decides whether to decrypt the target message, the final decision whether to decrypt the decryption is still on the client side.

The above description is that when the TLS connection establishment request does not carry the preset indication, the proxy entity asks the client to decrypt the target message or forward the target message. Of course, in the actual application, it may also be in the TLS connection establishment request. Carrying the preset indication, and when the preset indication is the third preset indication, the third preset indication is used to instruct the proxy entity to query whether the client proxy entity processes the received target message, and the proxy entity also asks the client to decrypt The target message is forwarded or forwarded to the target message. The specific implementation process is as follows:

The preset indication is a third preset indication, where the third preset indication is used to instruct the proxy entity to query the client proxy entity whether to process the received target message;

After the client sends a TLS connection establishment request that carries the preset indication, the method further includes:

The client returns a message to the proxy entity to continue to establish a TLS connection; or the client returns a TLS connection establishment request carrying the second preset indication to the proxy entity, where the second preset indication is used to indicate The proxy entity that received the TLS connection setup request forwards the target message.

In the embodiment of the present invention, the digital certificate has multiple forms. Optionally, a digital certificate of at least one of the first information and the second information may be added to the digital certificate in the X.509 format; the first information is a verification proxy entity. The information of the operation performed by the post-letter proxy entity, and the second information is information of the operation performed by the proxy entity on the decrypted target message.

3B is a schematic diagram of a digital certificate of a proxy entity in an embodiment of the present invention. As shown in FIG. 3B, a key usage (KeyUsage) field is added to the digital certificate, and the field is used to indicate that the proxy entity decrypts the target message when the client verifies that the proxy entity is trusted according to the data certificate;

The field of function (Functions) is also added to the digital certificate shown in FIG. 3B. This field is used to indicate what the proxy entity should perform on the decrypted target message.

In the embodiment of the present invention, the client determines the preset indication according to the attribute of the resource to be accessed or the first user indication, and determines whether the preset indication is based on whether the resource to be accessed is identified by the https URL or the http URL identifier. The accuracy of the preset indication is determined according to the attribute of the resource to be accessed or the first user indication, so that the proxy entity can accurately decrypt the target message, and then process the decrypted target message to improve the service quality.

For a better understanding of the embodiments of the present invention, a specific application scenario is given below. For the process of transmitting a request, an example is described. Referring to FIG. 4A and FIG. 4B, the client sends a TLS connection establishment request, and the proxy entity according to Flowchart of the received TLS connection establishment request to perform the corresponding process:

In FIG. 4A, step 400: the client receives the first user indication sent by the user, and determines the first preset indication according to the first user indication;

Step 410: The client carries the first preset indication in the TLS connection establishment request, and sends the TLS connection establishment request.

Step 420: After receiving the TLS connection establishment request, the proxy entity sends the digital certificate of the proxy entity to the client.

Step 430: The client determines whether the proxy entity is trusted according to the digital certificate of the proxy entity, and if so, step 440 is performed, otherwise, step 470 is performed;

Step 440: The client sends a message to the proxy entity to continue to establish a TLS connection.

Step 450: After completing the establishment of the TLS connection, the proxy entity decrypts the target message.

Step 460: The proxy entity sends the decrypted target message to the server.

Step 470: The client sends a TLS connection establishment request that carries the second preset indication to the proxy entity.

Step 480: The proxy entity does not decrypt the target message, and forwards the target message directly to the server.

In the embodiment shown in FIG. 4A, in order to improve the security of the transmitted target message, after receiving the TLS connection establishment request carrying the first preset indication, the proxy entity sends the digital certificate of the proxy entity to the client, the client. According to the digital certificate to verify the credibility of the proxy entity, when the client determines that the proxy entity is trusted, the proxy entity continues to establish a TLS connection and decrypts the target message. Of course, the proxy entity may also directly establish a TLS connection without sending the digital certificate of the proxy entity. And decrypt the target message.

That is, step 400, step 410, step 450, and step 460 are mandatory steps, and step 420, step 430, step 440, step 470, and step 480 are optional steps.

The above describes a process in which the client determines the first preset indication according to the first user indication of the user. Of course, the client may also determine the second preset indication according to the first user indication, and the following is based on the user's first The process of the user instructing to determine the second preset indication is described as shown in FIG. 4B:

Step 4000: The client receives the first user indication sent by the user, and determines a second preset indication according to the first user indication.

Step 4100: The client carries the second preset indication in the TLS connection establishment request, and sends a TLS connection establishment request.

Step 4200: After receiving the second preset indication TLS connection establishment request, the proxy entity does not decrypt the target message and directly forwards the target message to the server.

Referring to FIG. 5, a client is provided, which includes a processor 50 and a transmitter 51, wherein:

The processor 50 is configured to determine, according to an attribute of the resource to be accessed or a first user indication, a preset finger Show

a transmitter 51, configured to send a transport layer secure TLS connection establishment request that carries a preset indication;

The preset indication is used to indicate that the proxy entity receiving the TLS connection establishment request processes the target message, and the target message is a message transmitted by using the TLS connection established by the TLS connection establishment request.

In the embodiment of the present invention, the processor 50 is further configured to determine an attribute of the resource to be accessed;

Further, the client further includes a receiver 52, configured to receive the first user indication;

Optionally, when the processor 50 determines an attribute of the resource to be accessed, specifically:

The attributes of the resource to be accessed are determined according to the URL and/or the HTML file.

In the embodiment of the present invention, optionally, the preset indication includes at least one of a first preset indication and a second preset indication;

In the embodiment of the present invention, optionally, the preset indication is a first preset indication, where the first preset indication is used to indicate that the proxy entity that receives the TLS connection establishment request decrypts the target message;

Further, the client further includes a receiver 52, configured to receive a digital certificate of the proxy entity sent by the proxy entity;

Further, the processor 50 is further configured to verify the credibility of the proxy entity according to the digital certificate;

Further, the transmitter 51 is further configured to send a message to the proxy entity to continue to establish a TLS connection when the processor 50 determines that the proxy entity is trusted.

In the embodiment of the present invention, optionally, when the processor 50 determines that the proxy entity is trusted according to the digital certificate, specifically:

Determine that the digital certificate successfully passes the certificate chain detection and determines that the client stores a digital certificate. Determining that the proxy entity is trusted; or

Further, the transmitter 51 is further configured to send a TLS connection establishment request that does not carry the preset indication;

The client further includes a receiver 52, configured to receive a digital certificate of the proxy entity sent by the proxy entity;

The transmitter 51 is further configured to: return a message to the proxy entity to continue to establish a TLS connection; or return a TLS connection establishment request carrying a second preset indication to the proxy entity, where the second preset indication is used to indicate that the TLS connection establishment request is received The proxy entity forwards the target message.

In the embodiment of the present invention, optionally, the preset indication is a third preset indication, where the third preset indication is used to instruct the proxy entity to query the client proxy entity whether to process the received target message;

Further, the transmitter 51 is further configured to: return a message to the proxy entity to continue to establish a TLS connection; or return a TLS connection establishment request carrying a second preset indication to the proxy entity, where the second preset indication is used to indicate that the TLS is received. The proxy entity that connects to the setup request forwards the target message.

In the embodiment of the present invention, optionally, the digital certificate is a digital certificate that adds at least one of the first information and the second information to the digital certificate in the X.509 format, where the first information is verified by the proxy entity after the trusted proxy entity The information of the performed operation, the second information is information of the operation performed by the proxy entity on the decrypted target message.

The present invention has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (system), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions may be provided to a processor 50 of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that instructions are executed by a processor 50 of a computer or other programmable data processing device. Means for implementing the functions in one or more of the flow or in a block or blocks of a flow diagram.

These computer program instructions can also be stored in a bootable computer or other programmable data processing device. In a computer readable memory that operates in a particular manner, causing instructions stored in the computer readable memory to produce an article of manufacture comprising an instruction device implemented in one or more flows and/or block diagrams of the flowchart The function in a box or multiple boxes.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions in one or more blocks of the flowchart or in a flow or block of the flowchart.

While the preferred embodiment of the invention has been described, it will be understood that Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and the modifications and

It is apparent that those skilled in the art can make various modifications and variations to the embodiments of the invention without departing from the spirit and scope of the embodiments of the invention. Thus, it is intended that the present invention cover the modifications and modifications of the embodiments of the invention.

Claims

A method for transmitting a request, comprising:

The client determines the preset indication according to the attribute of the resource to be accessed or the first user indication;

Transmitting, by the client, a transport layer secure TLS connection establishment request that carries the preset indication;

The preset indication is used to indicate that the proxy entity that receives the TLS connection establishment request processes the target message, where the target message is a message transmitted by using the TLS connection established by the TLS connection establishment request.
The method of claim 1, wherein the attribute of the resource to be accessed comprises at least one of a type of the resource to be accessed and a domain name of the resource to be accessed.
The method according to claim 2, wherein before the determining, by the client, the preset indication according to the attribute of the resource to be accessed or the first user indication, the method further includes:

Determining, by the client, an attribute of the resource to be accessed, or the client receiving the first user indication;

Determining, by the client, attributes of the to-be-accessed resource, including:

The client determines an attribute of the resource to be accessed according to a uniform resource locator URL and/or a hypertext markup language HTML file.
The method according to any one of claims 1-3, wherein the preset indication comprises at least one of a first preset indication and a second preset indication;

The first preset indication is used to indicate that the proxy entity that received the TLS connection establishment request decrypts the target message;

The second preset indication is used to indicate that the proxy entity that received the TLS connection setup request forwards the target message.
The method according to any one of claims 1 to 4, wherein the preset indication is a first preset indication, and the first preset indication is used to indicate an agent that receives the TLS connection establishment request Entity decrypting the target message;

After the client sends the TLS connection establishment request that carries the preset indication, the method further includes:

Receiving, by the client, a digital certificate of the proxy entity sent by the proxy entity;

Determining, by the client, the credibility of the proxy entity according to the digital certificate;

The client determines to send a message to the proxy entity to continue to establish the TLS connection when the proxy entity is trusted.
The method of claim 5, wherein the client determines that the proxy entity is trusted according to the digital certificate, comprising:

Determining, by the client, that the digital certificate successfully passes the detection of the certificate chain, and determining that the client stores the digital certificate, determining that the proxy entity is trusted; or

The client determines that the proxy entity is trusted according to the second user indication.
The method of any of claims 1-6, wherein the method further comprises:

Sending, by the client, a TLS connection establishment request that does not carry the preset indication;

Receiving, by the client, a digital certificate of the proxy entity sent by the proxy entity;

Returning, by the client, a message that continues to establish the TLS connection to the proxy entity; or, the client returns a TLS connection establishment request that carries a second preset indication to the proxy entity, where the second preset indication The proxy entity for indicating that the TLS connection setup request is received forwards the target message.
The method according to any one of claims 1-6, wherein the preset indication is a third preset indication, and the third preset indication is used to instruct the proxy entity to query the client Whether the proxy entity processes the received target message;

After the client sends the TLS connection establishment request that carries the preset indication, the method further includes:

Receiving, by the client, a digital certificate of the proxy entity sent by the proxy entity;

Returning, by the client, a message that continues to establish the TLS connection to the proxy entity; or, the client returns a TLS connection establishment request that carries a second preset indication to the proxy entity, where the second preset indication The proxy entity for indicating that the TLS connection setup request is received forwards the target message.
The method according to any one of claims 5-8, wherein the digital certificate is a digital certificate in which at least one of the first information and the second information is added to the digital certificate in the X.509 format, the A message is information for verifying operations performed by the proxy entity after the proxy entity is trusted, The second information is information of an operation performed by the proxy entity on the decrypted target message.
A client, comprising:

a processor, configured to determine a preset indication according to an attribute of the resource to be accessed or a first user indication;

a transmitter, configured to send a transport layer secure TLS connection establishment request that carries the preset indication;

The preset indication is used to indicate that the proxy entity that receives the TLS connection establishment request processes the target message, where the target message is a message transmitted by using the TLS connection established by the TLS connection establishment request.
The client according to claim 10, wherein the attribute of the resource to be accessed comprises at least one of a type of the resource to be accessed and a domain name of the resource to be accessed.
The client according to claim 11, wherein the processor is further configured to determine an attribute of the resource to be accessed;

The client further includes a receiver, configured to receive the first user indication;

When the processor determines the attribute of the resource to be accessed, specifically:

The attribute of the resource to be accessed is determined according to a uniform resource locator URL and/or a hypertext markup language HTML file.
The client according to any one of claims 10 to 12, wherein the preset indication comprises at least one of a first preset indication and a second preset indication;

The first preset indication is used to indicate that the proxy entity that received the TLS connection establishment request decrypts the target message;

The second preset indication is used to indicate that the proxy entity that received the TLS connection setup request forwards the target message.
The client according to any one of claims 10 to 13, wherein the preset indication is a first preset indication, and the first preset indication is used to indicate that the TLS connection establishment request is received. The proxy entity decrypts the target message;

The client further includes a receiver, configured to receive a digital certificate of the proxy entity sent by the proxy entity;

The processor is further configured to verify the credibility of the proxy entity according to the digital certificate;

The transmitter is further configured to send a message to the proxy entity to continue to establish the TLS connection when the processor determines that the proxy entity is trusted.
The client according to claim 14, wherein the processor determines, when the proxy entity is trusted according to the digital certificate, specifically:

Determining that the digital certificate successfully passes the detection of the certificate chain, and determining that the client stores the digital certificate, determining that the proxy entity is trusted; or

The proxy entity is determined to be trusted according to the second user indication.
The client according to any one of claims 10-15, wherein the transmitter is further configured to send a TLS connection establishment request that does not carry the preset indication;

The client further includes a receiver, configured to receive a digital certificate of the proxy entity sent by the proxy entity;

The transmitter is further configured to: return, to the proxy entity, a message that continues to establish the TLS connection; or return a TLS connection establishment request that carries a second preset indication to the proxy entity, where the second preset indication The proxy entity for indicating that the TLS connection setup request is received forwards the target message.
The client according to any one of claims 10-15, wherein the preset indication is a third preset indication, and the third preset indication is used to instruct the proxy entity to query the client Whether the proxy entity processes the received target message;

The client further includes a receiver, configured to receive a digital certificate of the proxy entity sent by the proxy entity;

The transmitter is further configured to: return, to the proxy entity, a message that continues to establish the TLS connection; or return a TLS connection establishment request that carries a second preset indication to the proxy entity, where the second preset indication The proxy entity for indicating that the TLS connection setup request is received forwards the target message.
The client according to any one of claims 14-17, wherein the digital certificate is a digital certificate in which at least one of the first information and the second information is added to the digital certificate in the X.509 format, The first information is an operation performed by the proxy entity after verifying that the proxy entity is trusted Information, the second information being information of an operation performed by the proxy entity on the decrypted target message.