Header enrichment for hypertext transfer protocol secure
Methods, apparatus, and systems for enhancing the CP Function and UP Function to support the header enrichment for HTTPS are disclosed. In one example aspect, the method includes transmitting, by a first communication component, to a second communication component, a session message instructing the second communication component to detect one or more messages from a user device based on a communication security protocol, wherein the session message includes detection information for the communication security protocol.
1. A data communication method, comprising:
transmitting, by a first communication component, to a second communication component, a session message instructing the second communication component to perform operations comprising:
detecting a handshake message from a user device based on a communication security protocol, wherein the communication security protocol comprising at least one of secure sockets layer (SSL), transport layer security (TLS), or hypertext transfer protocol secure (HTTPS);
identifying, based on the session message, at least one header field name and a corresponding value;
inserting, into the handshake message, the at least one header field name and a corresponding value as an additional extension for the communication security protocol; and
forwarding, to a server, a modified handshake message that includes the additional extension,
wherein the session message includes detection information indicating use of the communication security protocol and header enrichment information including the at least one header field name and the corresponding value.
2. The method of claim 1 , wherein the detection information includes an indication for at least one of transport layer security (TLS) or hypertext transfer protocol secure (HTTPS) in at least one of a packet detection rule or a service data flow filter.
3. The method of claim 1 , wherein the detection information includes at least one of a well-known port for an SSL or TLS protocol in a service data flow filter, or a pre-configured port for SSL or TLS protocol in the service data flow filter known by the first and second communication components.
4. The method of claim 1 , wherein the header enrichment information includes a header type of a header enrichment information element set to a value corresponding to at least one of TLS, SSL/TLS, or HTTPS.
5. The method of claim 1 , wherein the header enrichment information includes header field names and values to be inserted into the handshake message from the user device.
6. The method of claim 1 , further comprising:
receiving, by the first communication component, a trigger entity of a packet data network connection establish request or a packet data unit session establishment request; and
transmitting, by the first communication component, a packet data network connection establishment response or a packet data unit session establishment response.
7. A data communication method, comprising:
receiving, by a second communication component, from a first communication component, a session message including detection information indicating use of a communication security protocol that includes at least one of secure sockets layer (SSL), transport layer security (TLS), or hypertext transfer protocol secure (HTTPS), and header enrichment information including at least one header field name and a corresponding value;
detecting, by the second communication component, a handshake message from a user device based on the communication security protocol;
identifying, from the session message, the at least one header field name and the corresponding value;
inserting, by the second communication component, into the handshake message, the at least one header field name and the corresponding value as an additional extension for the communication security protocol; and
forwarding, to a server, a modified handshake message that includes the additional extension.
8. The method of claim 7 , wherein the detection information includes an indication for at least one of transport layer security (TLS) or hypertext transfer protocol secure (HTTPS) in at least one of a packet detection rule or a service data flow filter.
9. The method of claim 7 , wherein the detection information includes at least one of a well-known port for an SSL or TLS protocol in a service data flow filter, or a pre-configured port for SSL or TLS protocol in the service data flow filter known by the first and second communication components.
10. The method of claim 7 , wherein the detecting the handshake message from a user device based on the detection information includes:
determining whether a destination port matches a well-known port for secure sockets layer (SSL) or transport layer security (TLS) protocol; and
determining, upon determination that the destination port matches the well-known port for the SSL or TLS protocol, that a current service data flow uses the SSL or TLS protocol.
11. The method of claim 7 , wherein the detection information includes a header type of a header enrichment information element set to a value corresponding to at least one of TLS, SSL/TLS, or HTTPS.
12. The method of claim 7 , further comprising parsing encapsulated SSL or TLS packets of the handshake message.
13. The method of claim 7 , further comprising, upon receiving a packet forwarding control protocol (PFCP) session establishment request from the first communication component, installing, by the second communication component, at least one of packet detection rule (PDR), QoS enforcement rule (QER), forwarding action rule (FAR), or usage reporting rule (URR).
14. A data communication method, comprising:
receiving, by a second communication component, from a first communication component, a session message that includes header enrichment information including at least one header field name and a corresponding value;
detecting, by the second communication component, a handshake message from a user device based on a communication security protocol that includes at least one of secure sockets layer (SSL), transport layer security (TLS), or hypertext transfer protocol secure (HTTPS);
inserting, by the second communication component, into the handshake message, the at least one header field name and the corresponding value as an additional extension for the communication security protocol; and
forwarding, to a server, a modified handshake message that includes the additional extension.
15. The method of claim 14 , wherein the header enrichment information includes a header type of a header enrichment information element set to a value corresponding to at least one of TLS, SSL/TLS, or HTTPS.
16. The method of claim 14 , wherein the header enrichment information includes one or more header field names and values to be inserted into the message.
17. The method of claim 14 , wherein the inserting the at least one header field name and a corresponding value into the handshake message comprises:
detecting one or more uplink IP packets from the user device are secure sockets layer (SSL) or transport layer security (TLS) packets carrying an SSL or TLS handshake message; and
inserting an additional SSL or TLS extension to the SSL or TLS handshake message while placing the one or more header field names and values indicated by the header enrichment information in the inserted additional SSL or TLS extension.