A method and system for accelerating https

Abstract

Disclosed are a method and system for accelerating https, comprising: a client initiating an https request and ClientHello information to a server; the server querying a client IP address from a cache list, sending ServerHello information and a certificate message to the client; the server obtaining an elliptic curve base point and generating a private key of the elliptic curve algorithm, generating an elliptic curve public key and sending the elliptic curve public key to the client with the elliptic curve base point, caching the IP address of the client and the private key and the public key of the elliptic curve; the client checking the legality of the server certificate, generating the public key and the private key of the elliptic curve of the client according to the information returned by the server, and sending the public key of the elliptic curve of the client to the server; and the server and the client calculating an encrypted symmetric key according to the public key of the elliptic curve of the other party, the private key of the self and the elliptic curve base point, and using the encrypted symmetric key for handshake checking and data transmission. The present application can greatly improve the SSL handshake efficiency under high concurrency, reduce the encryption and decryption processing time, and improve the user access experience.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer communication, and particularly relates to a method and system for accelerating HTTPS. BACKGROUND

[0002] HTTPS (Hyper Text Transfer Protocol over Secure Socket Layer) is a secure HTTP channel, which ensures the security of the transmission process through transmission encryption and identity authentication on the basis of HTTP. HTTPS adds SSL / TLS on the basis of HTTP, that is, HTTPS = HTTP + SSL / TLS. The information transmission of the server and the client is encrypted through SSL / TLS, thereby ensuring the security of data transmission.

[0003] Compared with the HTTP protocol, the HTTPS protocol greatly improves the data security and can effectively avoid the three risks of the HTTP protocol: eavesdropping risk (plain text transmission), tampering risk (data implantation) and impersonation risk (emulation service). At present, more and more website services are migrated from the HTTP protocol to the HTTPS.

[0004] Obviously, the advantage of HTTPS is to protect data security. However, there is also a disadvantage, that is, the server performance is sacrificed in order to protect data security. The HTTPS handshake process has six more steps than the HTTP, and the most time-consuming step is the generation of the asymmetric public and private keys. Therefore, it is increasingly important to improve the encryption and decryption speed and then improve the service efficiency and user experience in the case of protecting data security.

[0005] The basic process of the HTTPS protocol can be summarized as three steps:

[0006] 1. The client applies for and verifies the server public key;

[0007] 2. The two parties negotiate to produce a session key;

[0008] 3. The two parties use the session key for encrypted communication.

[0009] In the second step of negotiating to produce a session key, the DH key exchange protocol and the RSA asymmetric encryption and decryption algorithm are used to realize the generation and exchange of the key. The generation of the asymmetric key pair and the encryption and decryption algorithm need to consume more server resources for calculation. This feature has little difference in the case of a small number of client requests. If there are high-concurrency client requests, the server response is obviously slow, the service performance is reduced, the client access to the website is delayed, and the user experience is affected.

[0010] The existing HTTPS acceleration method mostly adopts a special server based on deployment, and realizes the acceleration service of HTTPS by improving the hardware capacity, thereby increasing the system deployment cost.

[0011] For example, the method shown in the application number CN201710074638.3 needs to additionally deploy an acceleration server. In the acceleration server, the correspondence relationship between the virtual domain name and the real domain name is utilized to cache the SSL / TLS connection corresponding to the domain name. The number of the same SSL / TLS connection is reduced to one time, and the acceleration service for the request of different domain names is realized.

[0012] For example, the method shown in the application number CN201610339509.8 needs to additionally deploy a decryption and encryption operation device or device cluster. The decryption and encryption calculation of the key negotiation is transferred to the external special device, the calculation speed of the asymmetric decryption and encryption algorithm is improved, and the service pressure of the server itself is relieved. SUMMARY

[0013] In order to solve the above technical problems in the prior art, the application provides a method and system for accelerating https to solve the above technical problems.

[0014] According to one aspect of the application, a method for accelerating https is provided, comprising:

[0015] S1: the client initiates an https request to the server and sends the ClientHello information;

[0016] S2: the server queries the IP address of the client from the cache list, sends the ServerHello information and the certificate message to the client;

[0017] S3: the server obtains the elliptic curve base point by using the elliptic curve algorithm, generates the private key of the elliptic curve algorithm, simultaneously generates the public key of the elliptic curve and sends the public key to the client together with the elliptic curve base point, and caches the IP address of the client and the private key and the public key of the elliptic curve;

[0018] S4: the client checks the legality of the certificate of the server, generates the public key and the private key of the elliptic curve of the client according to the information returned by the server, and sends the public key of the elliptic curve of the client to the server;

[0019] S5: the server and the client calculate the encrypted symmetric key according to the public key of the elliptic curve of the other party, the private key of the self and the elliptic curve base point, and perform the handshake check by using the symmetric key, and perform the data transmission after the check is successful.

[0020] In some specific embodiments, the ClientHello information includes a TLS version number applicable to the client, a supported cipher suite list, and a generated random number.

[0021] In some specific embodiments, the ServerHello information includes a TLS version number confirmed by the server, a generated random number, and a cipher suite selected from the cipher suite list of the client.

[0022] In some specific embodiments, S3 further includes that the server presets a cache time of the private key of the elliptic curve algorithm of the server, the IP address of the client, and the private key and the public key of the elliptic curve, and the cache time is an integer greater than 0, and the longer the cache time, the more obvious the performance improvement of the server.

[0023] In some specific embodiments, the caching method in S3 specifically includes that the server maps the client IP and the corresponding public and private keys through a cache table, and the mapping record is only valid within the cache time.

[0024] In some specific embodiments, S5 specifically includes that the server and the client calculate the encrypted symmetric key through the ECDHE key agreement algorithm according to the elliptic curve public key of the other party, the private key of the self, and the elliptic curve base point.

[0025] According to a second aspect of the present application, a computer readable storage medium is provided, which stores one or more computer programs, and the one or more computer programs are executed by a computer processor to implement the method of any one of the above.

[0026] According to a third aspect of the present application, a system for accelerating https is provided, which includes:

[0027] a client configured to initiate an https request to a server and send ClientHello information, verify the legality of the certificate of the server, generate the public key and the private key of the elliptic curve of the client according to the information returned by the server, and send the public key of the elliptic curve of the client to the server;

[0028] a server configured to query the IP address of the client from a cache list, send ServerHello information and a certificate message to the client, obtain an elliptic curve base point by using an elliptic curve algorithm and generate a private key of the elliptic curve algorithm, generate an elliptic curve public key at the same time and send the elliptic curve public key to the client together with the elliptic curve base point, and cache the IP address of the client and the private key and the public key of the elliptic curve;

[0029] The server and the client calculate an encrypted symmetric key through the ECDHE key agreement algorithm according to the elliptic curve public key of the other party, the private key of the self, and the elliptic curve base point, and perform handshake verification by using the symmetric key, and perform data transmission after the verification is successful.

[0030] In some specific embodiments, the ClientHello information includes a TLS version number applicable to the client, a supported cipher suite list, and a generated random number; the ServerHello information includes a TLS version number confirmed by the server, a generated random number, and a cipher suite selected from the cipher suite list of the client.

[0031] In some specific embodiments, the server presets the cache time of the private key of the elliptic curve algorithm of the server, the IP address of the client, and the private key and public key of the elliptic curve, the cache time being an integer greater than 0, and the longer the cache time, the more obvious the performance improvement of the server; the server maps the client IP and the corresponding public and private keys through a cache table, and the mapping record is only valid within the cache time.

[0032] The application provides a method and system for accelerating https, and the asymmetric key generated by a client with the same source address is cached on a server side. The number of times of generating the asymmetric key of the client with the same source address within a certain time range is reduced to one time, the speed of key negotiation is improved, the SSL handshake efficiency under high concurrency is greatly improved, the encryption and decryption processing time is reduced, and the access experience of a user is improved. The method does not need to increase additional hardware configuration, and the response speed of a client request under high concurrency can be improved. The deployment cost of a system is saved. BRIEF DESCRIPTION OF DRAWINGS

[0033] The accompanying drawings are included to provide a further understanding of embodiments and are incorporated in and constitute a part of this specification. The drawings illustrate embodiments and serve to explain principles of the application. Other embodiments and many of the intended advantages of the present application will be readily appreciated as the same becomes better understood by reference to the following detailed description when considered in connection with the accompanying drawings, wherein:

[0034] Figure 1 is a flowchart of a method for accelerating https of an embodiment of the application;

[0035] Figure 2 is a flowchart of a method for accelerating https of a specific embodiment of the application;

[0036] Figure 3 is a framework diagram of a system for accelerating https of an embodiment of the application;

[0037] Figure 4 is a framework implementation flowchart of a system for accelerating https of a specific embodiment of the application;

[0038] Figure 5is a structural schematic diagram of a computer system of an electronic device suitable for implementing the embodiments of the present application. DETAILED DESCRIPTION

[0039] The present application will be further described below in conjunction with the drawings and embodiments. It should be understood that the specific embodiments described herein are merely intended for the purpose of interpretation of the related application and are not limiting of the application. In addition, it should be noted that only the parts related to the application are shown in the drawings for the purpose of description.

[0040] It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict. The present application will be described in detail below with reference to the drawings and in conjunction with the embodiments.

[0041] The method for accelerating https according to one embodiment of the present application, Figure 1 A flowchart of the method for accelerating https according to the embodiments of the present application is shown. As Figure 1 shown, the method comprises:

[0042] S101: The client initiates an https request to the server and sends ClientHello information. The ClientHello information includes the TLS version number used by the client, the supported cipher suite list, and the generated random number.

[0043] S102: The server queries the IP address of the client from the cache list, sends ServerHello information and a certificate message to the client. The ServerHello information includes the TLS version number confirmed by the server, the generated random number, and the cipher suite selected from the cipher suite list of the client.

[0044] S103: The server obtains an elliptic curve base point using an elliptic curve algorithm and generates a private key of the elliptic curve algorithm, simultaneously generates an elliptic curve public key and sends it to the client with the elliptic curve base point, and caches the IP address of the client and the private key and public key of the elliptic curve.

[0045] In a specific embodiment, it further includes that the server presets the cache time of the private key of the elliptic curve algorithm of the server, the IP address of the client, and the private key and public key of the elliptic curve, the cache time is an integer greater than 0, and the longer the cache time, the more obvious the performance improvement of the server. Wherein, the server maps the client IP and the corresponding public and private keys through the cache table, and the mapping record is only valid within the cache time.

[0046] S104: The client verifies the legality of the certificate of the server, generates the public key and private key of the elliptic curve of the client according to the information returned by the server, and sends the public key of the elliptic curve of the client to the server.

[0047] S105: The server and the client calculate the encrypted symmetric key according to the elliptic curve public key of the other party, the private key of itself and the elliptic curve base point, and perform handshake verification by using the symmetric key, and perform data transmission after the verification is successful.

[0048] In a specific embodiment, the server and the client calculate the encrypted symmetric key according to the elliptic curve public key of the other party, the private key of itself and the elliptic curve base point by using the ECDHE key agreement algorithm.

[0049] Figure 2 An algorithm framework diagram of the method for accelerating https according to one specific embodiment of the application is shown, Figure 4 is a framework implementation flowchart of the system for accelerating https of one specific embodiment of the application, and the following will be described in combination with Figure 2 and Figure 4 The method for accelerating https based on software algorithm of the application will be described, and specifically includes the following steps:

[0050] Step one: The client initiates an https request (SSL / TSL handshake request) to the server, and sends a ClientHello message. The message contains the TLS version number (Version) used by the client, the supported cipher suite list (CipherSuites), and the generated random number (ClientRandom).

[0051] Step two: The server queries the client IP address from the cache list:

[0052] 1. If the client IP address is not found, the following steps a, b, c and d are performed.

[0053] 2. If the client IP address is found, the following steps a, b and d are performed.

[0054] Step a: Send a ServerHello message to the client. The message contains the TLS version number (Version) confirmed by the server, the generated random number (ServerRandom), and the selected appropriate cipher suite (CipherSuite) from the client cipher suite list.

[0055] Step b: The server sends a Certificate message to the client in order to prove its identity.

[0056] Step c: the server selects an elliptic curve algorithm, obtains an elliptic curve base point G, and generates a private key of the elliptic curve algorithm, which is locally saved. Meanwhile, an elliptic curve public key is generated and sent to the client together with the elliptic curve base point G. The client IP, the private key and the public key of the elliptic curve are cached. The cache time is an integer value of a preset value of the server, which is generally an integer value greater than 0. The smaller the value, the shorter the cache time. The larger the value, the longer the cache time. The longer the cache time, the more obvious the performance improvement of the server;

[0057] Step d: the server sends ServerHello Done, indicating that the server handshake is complete;

[0058] 3. Regarding the caching method in step c, the server needs to maintain a cache table mapping the client IP and the corresponding public and private keys. The mapping is valid within a preset cache duration. Within the cache duration, the same client IP initiates a request to the server only once, generating a public and private key, which greatly reduces the server resource occupancy and improves service efficiency. The preset value can be configured. The longer the preset value, the more obvious the performance improvement of the server.

[0059] Step three: the client verifies the legality of the server certificate (Certificate), and then the client generates a client elliptic curve public and private key according to the information returned by the server, and sends the public key to the server.

[0060] Step four: by now, the server and the client have the other party's elliptic curve public key, their own private key, and the elliptic curve base point G. Using these information, both parties can calculate a symmetric key for data transmission encryption through the ECDHE key agreement algorithm.

[0061] Step five: the upper part performs the final handshake verification according to the generated symmetric key.

[0062] Step six: if the verification in step five is successful, the parties use the finally generated symmetric key to encrypt data for transmission. If the verification fails, the connection is terminated.

[0063] Since the generation of asymmetric public and private keys is time-consuming compared to symmetric keys, the method for accelerating https of the present application caches the public and private key pairs corresponding to each client on the server, which can greatly improve the SSL handshake efficiency under high concurrency, reduce the encryption and decryption processing time, and thus improve the user's access experience. Moreover, this method does not require additional hardware configuration to improve the response speed of client requests under high concurrency, saving the deployment cost of the system.

[0064] Continuing to refer to Figure 3 , Figure 3A framework diagram of a system for accelerating https according to an embodiment of the present application is shown. The system specifically comprises a client 301 and a server 302. The client 301 is configured to initiate an https request from the server, and send ClientHello information; check the legitimacy of the certificate of the server, generate the public key and the private key of the elliptic curve of the client according to the information returned by the server, and send the public key of the elliptic curve of the client to the server; the server 302 is configured to query the IP address of the client from a cache list, send ServerHello information and a certificate message to the client; obtain an elliptic curve base point by using an elliptic curve algorithm and generate a private key of the elliptic curve algorithm, at the same time generate an elliptic curve public key and send it to the client together with the elliptic curve base point, and cache the IP address of the client and the private key and the public key of the elliptic curve. The server 302 and the client 301 calculate an encrypted symmetric key by an ECDHE key negotiation algorithm according to the elliptic curve public key of the other party, the private key of the self and the elliptic curve base point, and perform handshake verification by using the symmetric key, and perform data transmission after the verification is successful.

[0065] Reference will now be made to the following description Figure 5 which shows a structural schematic diagram of a computer system of an electronic device suitable for implementing the embodiments of the present application. Figure 5 The electronic device shown is merely an example, and should not bring any limitation to the functions and use range of the embodiments of the present application.

[0066] As shown in Figure 5 , the computer system comprises a central processing unit (CPU) 501 which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 502 or programs loaded from a storage portion 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the system 500 are also stored. The CPU 501, the ROM 502 and the RAM 503 are connected to each other through a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0067] The following components are connected to the I / O interface 505: an input portion 506 including a keyboard, a mouse, etc.; an output portion 507 including a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 508 including a hard disk, etc.; and a communication portion 509 including a network interface card such as a LAN card, a modem, etc. The communication portion 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as necessary. A removable medium 511 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is mounted on the drive 510 as necessary, so that a computer program read out therefrom is installed in the storage portion 508 as necessary.

[0068] In particular, the processes described above with reference to the flowcharts can be implemented as a computer software program according to embodiments of the present disclosure. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer readable storage medium, the computer program comprising program code for performing the methods illustrated by the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via the communication section 509, and / or installed from the removable medium 511. When the computer program is executed by the central processing unit (CPU) 501, the above-described functions defined in the methods of the present application are performed. It should be noted that the computer readable storage medium of the present application can be a computer readable signal medium or a computer readable storage medium or any combination of the two. The computer readable storage medium may, for example, be but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or any suitable combination of the above. More specific examples of the computer readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus or device. In the present application, the computer readable signal medium can include a data signal carried in a baseband or as part of a carrier wave, in which the computer readable program code is carried. Such a propagated data signal can take any of a variety of forms, including but not limited to electro-magnetic, optical, or any suitable combination thereof. The computer readable signal medium can also be any computer readable storage medium that can be used for carrying or transporting the program for use by or in connection with an instruction execution system, apparatus or device. The program code contained on the computer readable storage medium can be transmitted by any suitable medium, including but not limited to wireless, wire line, optical fiber cable, RF, etc., or any suitable combination of the above.

[0069] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0070] The computer program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0071] The modules involved in the embodiments of the present application can be implemented in the form of software or hardware.

[0072] As another aspect, the application also provides a computer readable storage medium, which can be included in the electronic device described in the above embodiments, or can exist independently without being assembled into the electronic device. The computer readable storage medium carries one or more programs, when the one or more programs are executed by the electronic device, the electronic device is caused to: a client initiates an https request to a server and sends ClientHello information; the server queries the IP address of the client from a cache list, sends ServerHello information and a certificate message to the client; the server obtains an elliptic curve base point by using an elliptic curve algorithm and generates a private key of the elliptic curve algorithm, and at the same time generates an elliptic curve public key and sends the elliptic curve public key to the client with the elliptic curve base point, and caches the IP address of the client and the private key and the public key of the elliptic curve; the client checks the legality of the certificate of the server, generates the public key and the private key of the elliptic curve of the client according to the information returned by the server, and sends the public key of the elliptic curve of the client to the server; the server and the client calculate an encrypted symmetric key according to the public key of the elliptic curve of the other party, the private key of the self and the elliptic curve base point, and perform handshake verification by using the symmetric key, and perform data transmission after the verification is successful.

[0073] The above description is merely the preferred embodiments of the application and the explanation of the applied technical principles. It should be understood by those skilled in the art that the application scope involved in the application is not limited to the technical solutions formed by the specific combinations of the above technical features, and should also cover other technical solutions formed by the arbitrary combinations of the above technical features or equivalent features without departing from the above inventive concept. For example, the above features can be replaced with the technical features disclosed in the application (but not limited to) having similar functions to form the technical solutions.

Claims

1. A method of accelerating https, characterized in that, The method comprises the following steps: S1: a client initiates an https request to a server and sends ClientHello information; S2: the server queries an IP address of the client from a cache list, sends ServerHello information and a certificate message to the client; S3: the server obtains an elliptic curve base point by using an elliptic curve algorithm, generates a private key of the elliptic curve algorithm, simultaneously generates an elliptic curve public key and sends the elliptic curve public key to the client together with the elliptic curve base point, caches the IP address of the client and the private key and the public key of the elliptic curve, and the server is preset to cache a cache time of the private key of the elliptic curve algorithm of the server, the IP address of the client and the private key and the public key of the elliptic curve, the cache time is an integer greater than 0, and a cache method specifically comprises that the server maps a client IP and a corresponding public and private key through a cache table, and the mapping record is valid only within the cache time length; S4: the client checks the legality of a certificate of the server, generates an elliptic curve public key and a private key of the client according to information returned by the server, and sends the elliptic curve public key of the client to the server; S5: the server and the client calculate an encrypted symmetric key according to an elliptic curve public key of the other party, a private key of the self and an elliptic curve base point, perform handshake verification by using the symmetric key, perform data transmission after the verification is successful, and calculate the encrypted symmetric key by using an ECDHE key negotiation algorithm according to the elliptic curve public key of the other party, the private key of the self and the elliptic curve base point.

2. The method of claim 1, wherein, The ClientHello information comprises a TLS version number actually used by the client, a supported cipher suite list and a generated random number.

3. The method of accelerating https of claim 2, wherein, The ServerHello information comprises a TLS version number confirmed by the server, a generated random number and a cipher suite selected from the cipher suite list of the client.

4. A computer readable storage medium having stored thereon one or more computer programs, The one or more computer programs are executed by a computer processor to implement the method of any one of claims 1 to 3.

5. A system for accelerating https, characterized in that, The system comprises: a client configured to initiate an https request to a server, send ClientHello information, check the legality of a certificate of the server, generate an elliptic curve public key and a private key of the client according to information returned by the server, and send the elliptic curve public key of the client to the server; and The server is configured to query the IP address of the client from the cache list, send ServerHello information and a certificate message to the client, obtain an elliptic curve base point by using an elliptic curve algorithm, generate a private key of the elliptic curve algorithm, generate an elliptic curve public key at the same time, send the elliptic curve public key to the client together with the elliptic curve base point, cache the IP address of the client and the private key and the public key of the elliptic curve, and preset a cache time of the private key of the elliptic curve algorithm of the server, the IP address of the client and the private key and the public key of the elliptic curve in the server, wherein the cache time is an integer greater than 0, and the server maps the client IP and the corresponding public and private keys through a cache table, and the mapping record is valid only within the cache time length. The server and the client calculate an encrypted symmetric key by using an ECDHE key negotiation algorithm according to the elliptic curve public key of the other party, the private key of the self and the elliptic curve base point, and perform handshake verification by using the symmetric key, and perform data transmission after the verification is successful.

6. The system for accelerating https of claim 5, wherein, The ClientHello information includes a TLS version number actually used by the client, a supported cipher suite list and a generated random number; and the ServerHello information includes a TLS version number confirmed by the server, a generated random number and a cipher suite selected from the cipher suite list of the client.

Images