A method and system for adaptive national secret algorithm communication of domain name registration system
By adopting the national secret algorithm, especially the SM2 asymmetric encryption algorithm, the problem of the risk of RSA algorithm being cracked is solved, communication security is improved, and the security and controllability of the network environment are enhanced.
Patent Information
- Application Number
- CN202210855922.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-07-19
- Publication Date
- 2024-12-24
- Estimated Expiration
- 2042-07-19
AI Technical Summary
In the prior art, RSA asymmetric encryption algorithm has been used in the field of communication encryption for a long time, but the low-digit 1024-bit RSA algorithm has the risk of being cracked and lacks security, resulting in the need of a more secure encryption algorithm to replace it.
The Guomin algorithm is adopted, especially the SM2 asymmetric encryption algorithm, based on the elliptic curve cipher, providing higher security and unit security strength. By adaptively selecting Guomin or RSA algorithm in the domain name registration system for verification and connection, the communication security is ensured. .
It improves communication security, reduces dependence on foreign technologies and products, enhances the network environment security of the national top-level domain registration industry, and provides a more secure and controllable solution.
Smart Images
Figure CN115174074B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of information technology, and in particular to a method and system for adaptive national encryption algorithm communication of a domain name registration system. Background Art
[0002] With the rapid development of the Internet, communication encryption has become an indispensable part of the Internet of Things. The Internet of Things refers to the real-time collection of any object or process that needs to be monitored, connected, and interacted through various devices and technologies such as various information sensors, radio frequency identification technology, global positioning system, infrared sensor, laser scanner, etc., and the collection of various required information such as sound, light, heat, electricity, mechanics, chemistry, biology, location, etc. Blockchain is a term in the field of information technology. In essence, it is a shared database, and the data or information stored in it has the characteristics of "unforgeable", "full trace", "traceable", "open and transparent", and "collective maintenance". Based on these characteristics, blockchain technology has laid a solid "trust" foundation, created a reliable "cooperation" mechanism, and has broad application prospects. When blockchain technology is used, many users store information in the terminal, but there is a lot of important information in the user information, which needs to be encrypted.
[0003] Communication encryption requires a relatively secure encryption algorithm. The certificate encryption algorithm that is currently widely used on the Internet uses the RSA asymmetric encryption technology dominated by European and American countries. This algorithm is currently the most influential and most commonly used public key encryption algorithm. It can resist most of the known password attacks so far and has been recommended by ISO as the public key data encryption standard. Today, only short RSA keys can be cracked by brute force. As of 2008, there is no reliable way to attack the RSA algorithm in the world. As long as the key length is long enough, the information encrypted with RSA is actually unbreakable. And this algorithm has been used in the field of communication encryption for 40 years and has been basically popularized. Therefore, many security experts have also studied the algorithm and found some defects in it, especially the low-bit 1024-bit RSA algorithm, which theoretically has the risk of being cracked.
[0004] Compared with the RSA encryption and decryption algorithm, the ECC elliptic curve algorithm used in the national secret certificate is more powerful, with a relatively higher unit security strength, and the difficulty of deciphering or solving is basically exponential. The national secret algorithm is a commercial cryptographic algorithm and specification independently developed by China and announced by the State Cryptography Administration to ensure the security of commercial cryptography. The national secret algorithm is also more secure and controllable in technology, and can get rid of excessive dependence on foreign technology and products, and has proposed an effective solution to further consolidate the secure and controllable network environment of the national top-level domain name registration industry. Summary of the invention
[0005] This application provides a method and system for adaptive national secret algorithm communication of domain name registration system, which solves the problem that the certificate encryption algorithm currently used on the Internet is the RSA asymmetric encryption technology dominated by European and American countries. However, this algorithm has been used in the field of communication encryption for 40 years and has been basically popularized. Therefore, many security experts have also studied this algorithm and found some defects in it, especially the low-bit 1024-bit RSA algorithm, which theoretically has the risk of being cracked, thus improving security.
[0006] In a first aspect, the present application provides a method and system for adaptive national encryption algorithm communication of a domain name registration system, the method comprising:
[0007] Extracting a registration information structure stored in a first registration information structure queue; wherein the first registration information structure queue is used to store registration information structures corresponding to clients that have not established a communication connection with a domain name registration system; the registration information structure includes a client certificate and an identifier sent by the client, and the identifier is used to indicate the cumulative number of times the registration information structure has been verified by a resolution algorithm;
[0008] Verify the registration information structure using the parsing algorithm corresponding to the identifier to obtain a verification result;
[0009] The verification result is returned to the client.
[0010] In one implementation, the registration information structure is verified using a parsing algorithm corresponding to the identifier, and the step of obtaining a verification result includes:
[0011] If the identifier of the registration information structure is 0;
[0012] Determine whether the registration information structure is successfully parsed by the national secret root certificate;
[0013] If yes, storing the registration information structure into a second registration information structure queue;
[0014] Generate the verification result of successful connection.
[0015] In one implementation, the step of determining whether the registration information structure is successfully parsed by the national secret root certificate includes:
[0016] If not, determine whether the CA certificate is verified incorrectly;
[0017] If yes, change the flag of the registration information structure to 1;
[0018] The registration information structure with the changed identifier is stored in a first registration information structure queue.
[0019] In one implementation, the step of determining whether a CA certificate verification error occurs includes:
[0020] If not, generate the verification result of connection failure.
[0021] In one implementation, the registration information structure is verified using a parsing algorithm corresponding to the identifier, and the step of obtaining a verification result includes:
[0022] If the identifier of the registration information structure is 1;
[0023] Determine whether the RSA root certificate successfully parses the registration information structure;
[0024] If yes, storing the registration information structure into a second registration information structure queue;
[0025] Generate the verification result of successful connection.
[0026] In one implementation, the step of determining whether the RSA root certificate successfully parses the registration information structure includes:
[0027] If not, deleting the registration information structure in the first registration information structure queue;
[0028] The verification result of connection failure is generated.
[0029] In one implementation, before the step of extracting the registration information structure stored in the first registration information structure queue, the method further includes:
[0030] Receiving a verification request sent by a client, wherein the verification request includes the client certificate;
[0031] Generate a registration information structure according to the client certificate, wherein the registration information structure includes the client certificate and an identifier;
[0032] The registration information structure is stored in a first registration information structure queue.
[0033] In one implementation, in the first registration information structure queue, all registration information structures are arranged according to the timestamps of being put into the first registration information structure queue, and the step of extracting the registration information structure stored in the first registration information structure queue includes:
[0034] The registration information structures stored in the first registration information structure queue are sequentially extracted according to the timestamps.
[0035] In a second aspect, the present application provides a system for adaptive national secret algorithm communication of a domain name registration system, including: a message module, a parsing module, and a verification module;
[0036] The message module is configured to: extract a registration information structure stored in a first registration information structure queue; wherein the first registration information structure queue is used to store a registration information structure corresponding to a client that has not established a communication connection with a domain name registration system; the registration information structure includes a client certificate and an identifier sent by the client, and the identifier is used to indicate the cumulative number of times the registration information structure performs encryption algorithm verification;
[0037] The parsing module is configured to: verify the registration information structure using a parsing algorithm corresponding to the identifier to obtain a verification result;
[0038] The verification module is configured to return the verification result to the client.
[0039] It can be seen from the above technical solution that the specific access verification method is selected by two verification opportunities for the client certificate connection method and algorithm type memory training, so as to complete the design functions of the adaptive SM national encryption algorithm and RSA algorithm, and provide an effective solution for the application and promotion of the national encryption algorithm in the domain name registration system. BRIEF DESCRIPTION OF THE DRAWINGS
[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.
[0041] Figure 1 A flowchart of a method and system for adaptive national encryption algorithm communication of a domain name registration system provided by this application;
[0042] Figure 2 A method for adaptive national encryption algorithm communication of a domain name registration system and a flowchart of receiving client information of the system provided by this application;
[0043] Figure 3 A method for communicating with a domain name registration system with an adaptive national secret algorithm provided by the present application and a flowchart for parsing a registration information structure;
[0044] Figure 4 A flowchart of parsing a registration information structure under another situation of a method and system for adaptive national secret algorithm communication of a domain name registration system provided by the present application;
[0045] Figure 5 A schematic diagram of a method and system for adaptive national encryption algorithm communication of a domain name registration system provided in this application. DETAILED DESCRIPTION
[0046] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.
[0047] Nowadays, life and work cannot be separated from computers and networks, so the security of network communication is particularly important. For this reason, network communication needs to be encrypted to ensure the security of user data when it is transmitted on the network, and it will not be tampered with or forged. For communication encryption, a relatively safe encryption algorithm is required, which is not easy to be cracked. Generally speaking, the RSA asymmetric encryption technology is widely used on the Internet. This encryption technology can resist most of the known password attacks so far and has been recommended by ISO as the public key data encryption standard. Today, only short RSA keys can be cracked by brute force. However, many security experts have studied the algorithm and found some defects in it, especially the low-bit 1024-bit RSA algorithm, which theoretically has the risk of being cracked. Compared with the RSA encryption and decryption algorithm, the encryption technology of the ECC elliptic curve algorithm used in the national secret certificate is stronger, with a relatively higher unit security strength, and the difficulty of deciphering or solving is basically exponential. The national secret algorithm is a commercial cryptographic algorithm and specification independently developed by China and announced by the State Cryptography Administration to ensure the security of commercial cryptography. The national encryption algorithm is also more secure and controllable in technology, which can get rid of excessive dependence on foreign technology and products, and provides an effective solution for further consolidating the secure and controllable network environment of the national top-level domain name registration industry.
[0048] This application aims to solve the problem in the prior art that the certificate encryption algorithm currently used on the Internet is the RSA asymmetric encryption technology dominated by European and American countries. This algorithm has been used in the field of communication encryption for 40 years and has been basically popularized. Therefore, many security experts have also studied the algorithm and found some defects in it, especially the low-bit 1024-bit RSA algorithm, which theoretically has the risk of being cracked. Based on the above reasons, this application provides a method and system for adaptive national secret algorithm communication of a domain name registration system.
[0049] The following is a further description of a method and system for adaptive national encryption algorithm communication of a domain name registration system of the present invention in conjunction with specific embodiments.
[0050] In this embodiment, the first thing to understand is: the national secret algorithm, that is, the national commercial cryptographic algorithm. It is a cryptographic algorithm standard and its application specification recognized and announced by the National Cryptography Administration, and some of the cryptographic algorithms have become international standards. For example, the SM series of cryptography, SM stands for commercial secret, that is, commercial cryptography, refers to cryptographic technology used for business and does not involve state secrets. Among them: SM2 is an asymmetric encryption algorithm, which is a public key cryptographic algorithm standard based on elliptic curve cryptography, with a secret key length of 256 bits, including digital signatures, key exchange and public key encryption, and is used to replace international algorithms such as RSA / DH / ECDSA / ECDH. It can meet the application requirements of electronic certification service systems and was issued by the National Cryptography Administration on December 17, 2010. SM2 uses a 256-bit ECC, which has a higher security strength than RSA 2048 bits and a faster operating speed than RSA. In this application, the SM2 asymmetric encryption algorithm is also used. Compared with other encryption methods, the ECC elliptic curve algorithm used in the national secret certificate has stronger encryption technology, relatively higher unit security strength, and the difficulty of deciphering or solving is basically exponential. The national secret algorithm is a commercial encryption algorithm and specification independently developed by China and announced by the State Cryptography Administration to ensure the security of commercial encryption. The national secret algorithm is also more secure and controllable in technology, which can get rid of excessive dependence on foreign technology and products, and has proposed an effective solution to further consolidate the secure and controllable network environment of the national top-level domain name registration industry.
[0051] First, as Figure 1 As shown, the present application provides a method for adaptive national encryption algorithm communication of a domain name registration system, the method comprising:
[0052] S100, extracting a registration information structure stored in a first registration information structure queue; wherein the first registration information structure queue is used to store registration information structures corresponding to clients that have not established a communication connection with a domain name registration system; the registration information structure includes a client certificate and an identifier sent by the client, and the identifier is used to indicate the cumulative number of times the registration information structure has been verified by a resolution algorithm;
[0053] In step S100, before the step of extracting the registration information structure stored in the first registration information structure queue, the method further includes:
[0054] S110, receiving a verification request sent by a client, wherein the verification request includes the client certificate;
[0055] S120, generating a registration information structure according to the client certificate, wherein the registration information structure includes the client certificate and an identifier;
[0056] S130: Store the registration information structure into a first registration information structure queue.
[0057] Specifically, in this embodiment, if Figure 2 As shown, before the client connects to the domain name registration system, the domain name registration system needs to first receive a verification request sent by the client, where the verification request includes a client certificate. The client certificate refers to a digital certificate used to prove the identity of the client user in the application system, relative to the server-side SSL certificate. It is generally bound to the user's Email, so that the client user can prove his or her true identity when communicating with the server. Since the Email is bound, it can also be used for digital signatures and email encryption. The domain name registration system generates a registration information structure based on the client certificate, where an identifier is set on the registration information structure. The information of the registration information structure is as follows:
[0058] struct FD_SSL_INFO{
[0059] int fd;
[0060] SSL*pSSL;
[0061] int sslType;
[0062] bool isFirstca;
[0063] REG_INFO *regInfo;
[0064] }queFdInfo;
[0065] The domain name registration system stores the registration information structure in the first registration information structure queue. The first registration information structure queue is used to store the registration information structure sent by the client, or the registration information structure that has been parsed using the national secret algorithm but failed to parse. When storing in the queue, all registration information structures are arranged according to the timestamp when they are put into the first registration information structure queue. When extracting the registration information structure, the registration information structures stored in the first registration information structure queue need to be extracted in sequence according to the timestamp.
[0066] In the actual application scenario, the client first sends a verification request to the domain name registration system. At this time, the resolution algorithm verification has not started yet, so the registration information structure generated according to the client certificate needs to be stored in the first registration information structure queue first, waiting for the resolution algorithm verification to start. If before the resolution algorithm verification starts, the domain name registration system receives a new verification request sent by the client, then it is necessary to put the registration information structure generated by the verification request into the first registration information structure queue again. At this time, the registration information structures in the first registration information structure queue are arranged randomly. In order to ensure that after the resolution algorithm verification starts, each registration information structure in the first registration information structure queue is subjected to the resolution algorithm verification, it is necessary to arrange the registration information structures in the first registration information structure queue in the order of timestamps. When extracting the registration information structure stored in the first registration information structure queue, extract it in the order of the timestamps of the registration information structures.
[0067] S200, using the parsing algorithm corresponding to the identifier to verify the registration information structure to obtain a verification result;
[0068] In step S200, Figure 3 As shown, the registration information structure is verified by using the parsing algorithm corresponding to the identifier, and the steps of obtaining the verification result include:
[0069] S210, if the identifier of the registration information structure is 0;
[0070] S220, determining whether the registration information structure is successfully parsed by the national secret root certificate;
[0071] S230, if yes, storing the registration information structure into a second registration information structure queue;
[0072] S240, generating the verification result of successful connection.
[0073] S250, if not, determine whether the CA certificate is verified incorrectly;
[0074] S260, if yes, change the identifier of the registration information structure to 1;
[0075] S270: Store the registration information structure with the changed identifier into a first registration information structure queue.
[0076] S280: If not, generate the verification result of connection failure.
[0077] Specifically, in this embodiment, after the parsing algorithm verification begins, it is necessary to add module functions such as SSL_CTX_use_certificate_file, SSL_accept, SSL_write, and SSL_read in the domain name registration system in sequence and load the encryption and decryption and verification suite containing the elliptic curve algorithm, such as SSLv23_server_method() and the national secret root certificate SSL_CTX_use_certificate_file and secret key information. Among them, module functions such as SSL_accept, SSL_write, and SSL_read are used to monitor, receive, and send data of the client certificate sent by the client. After that, the root certificate is used to perform parsing algorithm verification on the client certificate information received by SSL_accept.
[0078] During verification, the identification of the registration information structure must be set to 0, indicating the national secret algorithm verification method. If the parsing algorithm is verified, the identification of the extracted registration information structure is 0, and the domain name registration system automatically uses the national secret algorithm for parsing, and tracks the results of the parsing algorithm verification through the SSL_get_error function. If the parsing is successful, the registration information structure is stored in the second registration information structure queue and saved, and a successful connection verification result is generated, and the successful connection verification result is sent to the client. When the client corresponding to the registration information structure connects again, the connection method corresponding to the registration information structure in the second registration information structure queue is used first. If the parsing fails, it is necessary to determine whether it is due to a CA certificate verification error, where CA is the issuing authority of the certificate, which is the core of the Public Key Infrastructure (PKI). CA is the authority responsible for issuing certificates, authenticating certificates, and managing issued certificates.
[0079] CA has a certificate (including a public key). Public users on the Internet trust CA by verifying its signature. Anyone can get CA's certificate (including public key) to verify the certificate it issued. If a user wants to get a certificate of his own, he should first apply to CA. After CA determines the identity of the applicant, it will assign a public key to the applicant, and CA will bind the public key with the applicant's identity information, sign it, and then issue a certificate to the applicant. If a user wants to verify the authenticity of another certificate, he can verify the signature on the other certificate through CA's public key. Once the verification is passed, the other certificate is considered valid. The certificate is actually an authentication of the user's public key issued by the certificate issuing authority (CA). The content of the certificate includes: information about the electronic visa authority, public key user information, public key, signature of the authority and validity period, etc. The format and verification method of the certificate generally follow the X.509 international standard.
[0080] If it is because of a CA certificate verification error, it means that the client may use an RSA algorithm certificate, then the identifier of the registration information structure needs to be changed to 1, indicating that a national secret algorithm verification has been performed once, but the parsing failed, and the registration information structure with the changed identifier is stored in the first registration information structure queue, waiting for the next verification. If it is not because of a CA certificate verification error, then a verification result of connection failure needs to be generated and sent to the client. At this time, the connection with the domain name registration system fails.
[0081] like Figure 4 As shown, the registration information structure is verified by using the parsing algorithm corresponding to the identifier, and the steps of obtaining the verification result include:
[0082] S211, if the identifier of the registration information structure is 1;
[0083] S212, determining whether the registration information structure is successfully parsed by the RSA root certificate;
[0084] S213, if yes, storing the registration information structure into a second registration information structure queue;
[0085] S214, generating the verification result of successful connection.
[0086] S215, if not, deleting the registration information structure in the first registration information structure queue;
[0087] S216, generating the verification result of connection failure.
[0088] In actual application scenarios, if the extracted registration information structure is identified as 1 during the parsing algorithm verification, it proves that the registration information structure has been verified by the national secret algorithm, but the connection fails, so the domain name registration system automatically uses the RSA algorithm for parsing. It should be understood that the RSA public key encryption algorithm is currently the most influential and most commonly used public key encryption algorithm. It can resist most of the known cryptographic attacks and has been recommended by ISO as the public key data encryption standard. Today, only short RSA keys can be cracked by brute force. As of 2008, there is no reliable way to attack the RSA algorithm in the world. As long as the key length is long enough, the information encrypted with RSA is actually unbreakable. However, with the increasing maturity of distributed computing and quantum computer theory, the security of RSA encryption has been challenged and questioned. The RSA algorithm is based on a very simple number theory fact: it is very easy to multiply two large prime numbers, but it is extremely difficult to factorize their product, so the product can be made public as an encryption key.
[0089] RSA public key cryptography. The so-called public key cryptography uses different encryption keys and decryption keys. It is a cryptography system in which "it is computationally infeasible to derive the decryption key from the known encryption key". In the public key cryptography, the encryption key (i.e. public key) PK is public information, while the decryption key (i.e. secret key) SK needs to be kept secret. The encryption algorithm E and the decryption algorithm D are also public. Although the decryption key SK is determined by the public key PK, SK cannot be calculated based on PK. It is based on this theory that the famous RSA algorithm appeared in 1978. It usually generates a pair of RSA keys, one of which is a secret key that is saved by the user; the other is a public key that can be made public and even registered in a network server. To improve the confidentiality strength, the RSA key is at least 500 bits long, and 1024 bits is generally recommended. This makes the encryption calculation very large. In order to reduce the amount of calculation, when transmitting information, a combination of traditional encryption methods and public key encryption methods is often used, that is, the information is encrypted using an improved DES or IDEA session key, and then the session key and information digest are encrypted using an RSA key. After receiving the message, the other party can decrypt it with a different key and verify the message summary. The RSA algorithm is the first algorithm that can be used for both encryption and digital signatures, and is also easy to understand and operate. RSA is the most widely studied public key algorithm. In the more than 30 years since it was proposed, it has experienced the test of various attacks and has gradually been accepted by people. As of 2017, it is generally considered to be one of the best public key schemes.
[0090] After that, the result of the parsing algorithm verification needs to be tracked through the SSL_get_error function. If the parsing is successful, the registration information structure is stored in the second registration information structure queue and saved, and a successful connection verification result is generated, and the successful connection verification result is sent to the client. When the client corresponding to the registration information structure connects again, the connection method corresponding to the registration information structure in the second registration information structure queue is used first. If the parsing fails, the registration information structure has no chance to be parsed again, and it is necessary to delete the registration information structure in the first registration information structure queue, generate a connection failure verification result, and send the connection failure verification result to the client.
[0091] S300: Return the verification result to the client.
[0092] Specifically, in this embodiment, when the domain name registration system extracts the registration information structure in the first registration information structure queue, two situations may occur. The first situation is the registration information structure that is first subjected to resolution algorithm verification. The identifier of the registration information structure is 0, indicating that the registration information structure is sent from the client and is first subjected to resolution verification. During the resolution algorithm verification, the domain name registration system automatically uses the national secret algorithm for resolution, and tracks the result of the resolution algorithm verification through the SSL_get_error function. If the resolution is successful, the registration information structure is stored in the second registration information structure queue and saved, and a successful connection verification result is generated, which is sent to the client. When the client corresponding to the registration information structure connects again, the connection method corresponding to the registration information structure in the second registration information structure queue is preferentially used. If the parsing fails, it is necessary to determine whether it is due to a CA certificate verification error. If it is due to a CA certificate verification error, it means that the client may use an RSA algorithm certificate, then the registration information structure identifier needs to be changed to 1, indicating that a parsing algorithm verification has been performed once, and the registration information structure with the changed identifier is stored in the first registration information structure queue, waiting for the next verification. If it is not due to a CA certificate verification error, then a verification result of a connection failure needs to be generated and sent to the client.
[0093] The second case is a registration information structure that fails the first verification. When the second parsing algorithm verification is performed, the identification of the registration information structure is 1, indicating that the registration information structure has not passed the national secret algorithm verification, and because of the CA certificate verification error, the domain name registration system automatically uses the RSA algorithm for parsing, and tracks the results of the parsing algorithm verification through the SSL_get_error function. If the parsing is successful, the registration information structure is stored in the second registration information structure queue and saved, and a successful connection verification result is generated, and the successful connection verification result is sent to the client. When the client corresponding to the registration information structure connects again, the connection method corresponding to the registration information structure in the second registration information structure queue is used first. If the parsing fails, since each registration information structure has only two parsing verification opportunities, and the registration information structure has no chance to be parsed again, it is necessary to delete the registration information structure in the first registration information structure queue, and generate a connection failure verification result, and send the connection failure verification result to the client.
[0094] Second, as Figure 5 As shown, the present application provides a system for adaptive national secret algorithm communication of a domain name registration system, including: a message module, a parsing module, and a verification module;
[0095] The message module is configured to: extract a registration information structure stored in a first registration information structure queue; wherein the first registration information structure queue is used to store a registration information structure corresponding to a client that has not established a communication connection with a domain name registration system; the registration information structure includes a client certificate and an identifier sent by the client, and the identifier is used to indicate the cumulative number of times the registration information structure performs encryption algorithm verification;
[0096] The parsing module is configured to: verify the registration information structure using a parsing algorithm corresponding to the identifier to obtain a verification result;
[0097] The verification module is configured to return the verification result to the client.
[0098] The effects of the above-mentioned system when applying the above-mentioned method can be found in the description of the above-mentioned method embodiment, which will not be repeated here.
[0099] Those skilled in the art will readily appreciate other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary techniques in the art that are not disclosed by the present invention. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present invention are indicated by the claims of the present application.
Claims
1. A method for adaptive national secret algorithm communication of a domain name registration system, the method comprising: Extracting a registration information structure stored in a first registration information structure queue; wherein the first registration information structure queue is used to store registration information structures corresponding to clients that have not established a communication connection with a domain name registration system; the registration information structure includes a client certificate and an identifier sent by the client, and the identifier is used to indicate the cumulative number of times the registration information structure has been verified by a resolution algorithm; Verify the registration information structure using the parsing algorithm corresponding to the identifier to obtain a verification result; The verification result is returned to the client.
2. According to claim 1, a method for adaptive national secret algorithm communication of a domain name registration system is characterized in that: The steps of verifying the registration information structure using the parsing algorithm corresponding to the identifier and obtaining the verification result include: If the identifier of the registration information structure is 0; Determine whether the registration information structure is successfully parsed by the national secret root certificate; If yes, storing the registration information structure into a second registration information structure queue; Generate the verification result of successful connection.
3. A method for adaptive national secret algorithm communication of a domain name registration system according to claim 2, characterized in that: The step of determining whether the registration information structure is successfully parsed by the national secret root certificate includes: If not, determine whether the CA certificate is verified incorrectly; If yes, change the flag of the registration information structure to 1; The registration information structure with the changed identifier is stored in a first registration information structure queue.
4. A method for adaptive national secret algorithm communication of a domain name registration system according to claim 3, characterized in that: The steps to determine whether the CA certificate verification error is included: If not, generate the verification result of connection failure.
5. A method for adaptive national secret algorithm communication of a domain name registration system according to claim 1, characterized in that: The steps of verifying the registration information structure using the parsing algorithm corresponding to the identifier and obtaining the verification result include: If the identifier of the registration information structure is 1; Determine whether the RSA root certificate successfully parses the registration information structure; If yes, storing the registration information structure into a second registration information structure queue; Generate the verification result of successful connection.
6. A method for adaptive national secret algorithm communication of a domain name registration system according to claim 5, characterized in that: The step of determining whether the RSA root certificate successfully parses the registration information structure comprises: If not, deleting the registration information structure in the first registration information structure queue; The verification result of connection failure is generated.
7. A method for adaptive national secret algorithm communication of a domain name registration system according to claim 1, characterized in that: Before the step of extracting the registration information structure stored in the first registration information structure queue, the method further includes: Receiving a verification request sent by a client, wherein the verification request includes the client certificate; Generate a registration information structure according to the client certificate, wherein the registration information structure includes the client certificate and an identifier; The registration information structure is stored in a first registration information structure queue.
8. A method for adaptive national secret algorithm communication of a domain name registration system according to claim 1, characterized in that: In the first registration information structure queue, all registration information structures are arranged according to the timestamps of being put into the first registration information structure queue, and the step of extracting the registration information structure stored in the first registration information structure queue includes: The registration information structures stored in the first registration information structure queue are sequentially extracted according to the timestamps.
9. A domain name registration system adaptive national secret algorithm communication system, characterized in that: include: Message module, parsing module, verification module; The message module is configured to: extract a registration information structure stored in a first registration information structure queue; wherein the first registration information structure queue is used to store a registration information structure corresponding to a client that has not established a communication connection with a domain name registration system; the registration information structure includes a client certificate and an identifier sent by the client, and the identifier is used to indicate the cumulative number of times the registration information structure performs encryption algorithm verification; The parsing module is configured to: verify the registration information structure using a parsing algorithm corresponding to the identifier to obtain a verification result; The verification module is configured to return the verification result to the client.