状态机无关的TLS数据采集方法研究  

State Machine Independent Algorithm for Collecting TLS Data

作　　者：闫露[1,2] 邓浩江 陈晓[1] 叶晓舟[1] YAN Lu;DENG Hao-jiang;CHEN Xiao;YE Xiao-zhou(National Network New Media Engineering Research Center,Institute of Acoustics,Beijing 100190,China;Chinese Academy of Sciences,Beijing 100190,China)

机构地区：[1]中国科学院声学研究所国家网络新媒体工程技术研究中心,北京100190 [2]中国科学院大学,北京100190

出　　处：《小型微型计算机系统》2019年第6期1260-1265,共6页Journal of Chinese Computer Systems

基　　金：中科院声学所率先行动计划项目(SXJH201609)资助

摘　　要：网络安全审计系统用于监督规范用户行为,防止内部人员对网络的损害,对于保障内网安全有着重要的意义.传输层安全协议是网络上应用广泛的安全协议,由于协议对数据进行加密传输,在审计系统中需要采取一定的技术手段将其转化为相应的明文后才能进行分析审计工作.本文基于多核网络处理器实现传输层安全协议数据采集,提出了一种状态机无关的数据采集方法,使得系统具有更高的灵活性和可维护性.针对私钥操作,提出一种结构化私钥信息缓存算法,提高了系统的性能,实验表明当配置1024位和2048位RSA证书时,系统每秒新建连接数性能分别提升了130%和50%.Network security audit system is used to monitor user behavior and prevent internal person from damaging the network,it is of great importance to Intranet security. The Transport Layer Security( TLS) protocol is widely used on the Internet,since the data transmitted by TLS is encrypted,we need to change it to the corresponding plain data firstly in audit system. In this paper,we collect TLS plain data based on a multi-core network processor. Then we propose a state machine independent method to get flexibility and scalability. In addition,we put forward a private key encapsulation structure caching algorithm( PKES) algorithm to improve the performance.The experiments show that with the PKES algorithm,the system’s CPS has increased by 130% when the certificate with1024 bits RSA key and by 50% when 2048 bits.

关 键 词：数据采集 传输层安全协议 状态机 私钥查找 多核网络处理器 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]