Communication establishment method and system

Abstract

The present application provides a communication establishment method and system, wherein the communication establishment method is applied to a sending server and includes: obtaining a pre-shared key and a configuration key corresponding to the pre-shared key; encrypting the pre-shared key based on the configuration key to obtain an encrypted pre-shared key; adding the encrypted pre-shared key to an initial handshake message, and sending the initial handshake message to a receiving server, wherein the receiving server decrypts the pre-shared key from the initial handshake message based on the preset configuration key to create a communication key for communication with the sending server. This method implements communication authentication between the sending server and the receiving server directly based on the pre-stored pre-configuration key and configuration key, reducing the time consumption of the sending server and the receiving server for pre-key negotiation.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a communication establishment method. This application also relates to a communication method, a communication establishment system, a computing device, and a computer-readable storage medium. Background Technology

[0002] With the development of the internet, users have increasingly higher demands for network transmission speeds on their clients. Traditional network transmission architectures typically use TCP as the transport layer protocol to ensure reliable data delivery between the client and server, and TLS for encryption to guarantee data security. However, establishing a connection using TCP requires 1.5 RTTs, and TLS key negotiation and exchange also require 1.5 RTTs. Furthermore, over public network links, the RTT increases exponentially with the number of links, resulting in a significant amount of time spent on handshake and key negotiation before data transmission. Therefore, a solution to these problems is urgently needed. Summary of the Invention

[0003] In view of this, embodiments of this application provide a communication establishment method. This application also relates to a communication method, a communication establishment system, a computing device, and a computer-readable storage medium, to address the shortcomings of existing technologies where the round-trip time between the client and server is long.

[0004] According to a first aspect of the embodiments of this application, a first communication establishment method is provided, applied to a sending server, comprising:

[0005] Obtain the pre-shared key and the configuration key corresponding to the pre-shared key;

[0006] The pre-shared key is encrypted based on the configuration key to obtain the encrypted pre-shared key;

[0007] The encrypted pre-shared key is added to the handshake initiation message, and the handshake initiation message is sent to the receiving server. The receiving server decrypts the pre-shared key from the handshake initiation message based on the preset configuration key, and uses it to create a communication key for communication with the sending server.

[0008] According to a second aspect of the embodiments of this application, a second communication establishment method is provided, applied to a receiving server, comprising:

[0009] Receive a handshake initiation message sent by the sending server, wherein the handshake initiation message carries an encrypted pre-shared key obtained by the sending server based on the configuration key encrypted pre-shared key;

[0010] The pre-shared key in the received handshake initial message is decrypted based on the preset configuration key to obtain the pre-shared key, wherein the pre-shared key is used to create a communication key for communication between the sending server and the receiving server.

[0011] According to a third aspect of the embodiments of this application, a third communication establishment method is provided, applied to a communication establishment system, the communication establishment system including a client and a server, comprising:

[0012] The client obtains the pre-shared key and the configuration key corresponding to the pre-shared key.

[0013] The pre-shared key is encrypted based on the configuration key to obtain an encrypted pre-shared key. The encrypted pre-shared key is added to the handshake initial message, and the handshake initial message is sent to the server.

[0014] On the server side, the encrypted pre-shared key in the received handshake initial message is decrypted based on the preset configuration key to obtain the pre-shared key, wherein the pre-shared key is used to create a communication key for communication between the client and the server.

[0015] According to a fourth aspect of the embodiments of this application, a communication method is provided, applied to a communication system, the communication system including a client and a server, comprising:

[0016] The client obtains initial application data and creates an initial transmission key for the client based on the pre-shared key.

[0017] The initial application data is encrypted based on the client's initial transmission key to obtain encrypted data, and the encrypted data is sent to the server.

[0018] The server receives the encrypted data and creates an initial transmission key based on the pre-shared key sent by the client.

[0019] The encrypted data is decrypted based on the server's initial transmission key to obtain the initial application data.

[0020] According to a fifth aspect of the embodiments of this application, a communication establishment system is provided, comprising:

[0021] Client and server;

[0022] The client obtains a pre-shared key and a configuration key corresponding to the pre-shared key, encrypts the pre-shared key based on the configuration key to obtain an encrypted pre-shared key, adds the encrypted pre-shared key to the handshake initial message, and sends the handshake initial message to the server.

[0023] The server decrypts the encrypted pre-shared key in the received handshake initial message based on the preset configuration key to obtain the pre-shared key, wherein the pre-shared key is used to create a communication key for communication between the client and the server.

[0024] According to a sixth aspect of the present application, a computing device is provided, including a memory, a processor, and computer instructions stored in the memory and executable on the processor, wherein the processor executes the instructions to implement the steps of the communication establishment method or communication method.

[0025] According to a seventh aspect of the present application, a computer-readable storage medium is provided that stores computer instructions which, when executed by a processor, implement the steps of the communication establishment method or communication method.

[0026] The first communication establishment method provided in this embodiment is applied to a sending server. To reduce the round-trip latency between the sending server and the receiving server, the sending server obtains a pre-shared key and a corresponding configuration key, encrypts the pre-shared key based on the configuration key to obtain an encrypted pre-shared key, adds the encrypted pre-shared key to the handshake initial message, and sends the handshake initial message to the receiving server. This enables the sending server to initiate communication verification with the receiving server based on the pre-obtained pre-shared key. The receiving server decrypts the pre-shared key from the handshake initial message based on the preset configuration key, and uses it to create a communication key for communication with the sending server. This enables direct communication authentication between the sending server and the receiving server based on the pre-stored pre-configured key and the configuration key. Therefore, the sending server can directly transmit application data without waiting for a response from the receiving server, reducing the time consumed by the handshake and key negotiation between the sending server and the receiving server before communication. Attached Figure Description

[0027] Figure 1 This is a schematic diagram illustrating the application of a communication establishment method provided in an embodiment of this application;

[0028] Figure 2 This is a flowchart of a first communication establishment method provided in an embodiment of this application;

[0029] Figure 3This is a schematic diagram of the key calculation process in a communication establishment method provided in an embodiment of this application;

[0030] Figure 4 This is a schematic diagram of the communication establishment process in a communication method provided in an embodiment of this application;

[0031] Figure 5 This is a flowchart of a second communication establishment method provided in an embodiment of this application;

[0032] Figure 6 This is a flowchart of a third communication establishment method provided in an embodiment of this application;

[0033] Figure 7 This is a flowchart illustrating a communication method provided in an embodiment of this application;

[0034] Figure 8 This is an interactive schematic diagram of a communication establishment method provided in an embodiment of this application;

[0035] Figure 9 This is a schematic diagram of the structure of a communication establishment system provided in one embodiment of this application;

[0036] Figure 10 This is a structural block diagram of a computing device provided in one embodiment of this application. Detailed Implementation

[0037] Many specific details are set forth in the following description to provide a full understanding of this application. However, this application can be implemented in many other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of this application; therefore, this application is not limited to the specific embodiments disclosed below.

[0038] The terminology used in one or more embodiments of this application is for the purpose of describing particular embodiments only and is not intended to limit the scope of one or more embodiments of this application. The singular forms “a,” “the,” and “the” used in one or more embodiments of this application and in the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” used in one or more embodiments of this application refers to and includes any or all possible combinations of one or more associated listed items.

[0039] It should be understood that although the terms first, second, etc., may be used to describe various information in one or more embodiments of this application, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first may also be referred to as second without departing from the scope of one or more embodiments of this application, and similarly, second may also be referred to as first. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."

[0040] First, the terms and concepts involved in one or more embodiments of this application will be explained.

[0041] QUIC (QuickUDP Internet Connection) is a low-latency Internet transport layer protocol based on UDP, which was later standardized as the HTTP / 3.0 protocol.

[0042] TLS (Transport Layer Security) is a security protocol designed to provide security and data integrity guarantees for internet communications. This invention is based on its latest version 1.3, hence the name TLS 1.3.

[0043] RTT (Round Trip Time): An important performance metric in computer networks, it represents the total time delay from when the sender begins sending data until the sender receives an acknowledgment from the receiver (the receiver sends an acknowledgment immediately upon receiving the data). 0 RTT means that application data can be sent during the handshake phase.

[0044] HKDF (HMAC-based Key Derivation Function): It can be applied to the construction of various protocols and applications. HKDF logically consists of two parts. The first part takes the input key material and "extracts" it to obtain a fixed-length pseudo-random key K. The second part expands the key into several random keys and outputs them at the desired length.

[0045] This application provides a communication establishment method, and also relates to a communication method, a communication establishment system, a computing device, and a computer-readable storage medium, which will be described in detail in the following embodiments.

[0046] See Figure 1The schematic diagram illustrates the first communication establishment method provided in this embodiment, applied to a sending server. To reduce the round-trip latency between the sending and receiving servers, the sending server obtains a pre-shared key and a corresponding configuration key. It then encrypts the pre-shared key using the configuration key to obtain an encrypted pre-shared key. This encrypted pre-shared key is added to the handshake initial message, which is then sent to the receiving server. This enables the sending server to initiate communication verification with the receiving server based on the pre-obtained pre-shared key. The receiving server decrypts the pre-shared key from the handshake initial message using a preset configuration key, which is then used to create a communication key for communication with the sending server. This method enables direct communication authentication between the sending and receiving servers based on a pre-stored pre-configured key and a configuration key. Therefore, the sending server can directly transmit application data without waiting for a response from the receiving server, reducing the time consumed by handshakes and key negotiation before communication.

[0047] Figure 2 A flowchart of a first communication establishment method according to an embodiment of this application is shown, applied to a sending server, and specifically includes the following steps:

[0048] Step 202: Obtain the pre-shared key and the configuration key corresponding to the pre-shared key.

[0049] Specifically, the sending server is the server that initiates the communication request. Correspondingly, the server that receives the communication request from the sending server is the receiving server. The pre-shared key is a key created in advance to enable the sending server and the receiving server to establish a communication connection. The configuration key is a key pre-configured in both the sending and receiving servers to encrypt or decrypt the pre-shared key. This configuration key is typically an additional key pre-configured for the pre-shared key at the application layer; it can be a symmetric key or an asymmetric key, without restriction.

[0050] It should be noted that the communication establishment method provided in this application can establish communication between any sending server and receiving server. For ease of description, this embodiment takes the sending server as a live streaming server as an example. The process of establishing communication between other sending servers and receiving servers can refer to the same or corresponding description in this embodiment. This embodiment will not be elaborated on in detail here.

[0051] Since communication between the sending and receiving servers requires a pre-defined communication protocol, from a protocol perspective, the sending server is equivalent to the client, and the receiving server is equivalent to the server. In traditional network transmission architectures, the transport layer protocols used to ensure the reliability and security of data between the client and server typically consume a significant amount of time in the handshake and key negotiation phases.

[0052] In existing technologies, network transmission architectures using the QUIC protocol and TLS 1.3 compatibility can control the time consumed by the transport layer handshake and TLS key negotiation to within one RTT. If the sending server and receiving server have established a connection beforehand, application data can be sent directly under secure conditions, thus eliminating the time consumed by the client and server handshake and key negotiation. However, 0 RTT requires prior connection establishment between the client and server. Therefore, this application provides a solution that allows the client and server (i.e., the sending server and the receiving server) to send application data directly without ever having connected before, while ensuring security.

[0053] Based on this, this application directly obtains the pre-shared key used for communication authentication with the receiving server from the sending server, sends the encrypted pre-shared key to the receiving server, and the receiving server verifies the pre-shared key by correctly decrypting the encrypted pre-shared key, thus achieving communication authentication between the sending and receiving servers. This pre-shared key can be referred to as PSK (Pre-Shared Key) in a QUIC protocol-compliant TLS 1.3 network transmission architecture.

[0054] Considering that there may be multiple sending and receiving servers, and multiple pre-shared keys, it is necessary to manage the pre-shared keys. In this embodiment, to facilitate the management of the pre-shared keys and ensure their security, the configuration center manages the pre-shared keys uniformly. The specific implementation is as follows:

[0055] Obtain the pre-shared key and the configuration key corresponding to the pre-shared key from the configuration center.

[0056] Specifically, the configuration center can be a functional module installed on a server, or it can be a smart device with storage and management functions; there are no restrictions here. This configuration center is used to store, update, and manage pre-shared keys and configuration keys.

[0057] Therefore, since the configuration center stores the pre-shared key and the configuration key, to ensure the security of the pre-shared key during transmission, it can be encrypted in the configuration center based on the configuration key. After the sending server obtains the encrypted pre-shared key and the configuration key, it then decrypts the encrypted pre-shared key based on the configuration key. Furthermore, to avoid the time-consuming process of temporarily retrieving the pre-shared key and the configuration key from the configuration center before communication is required, the pre-shared key and the configuration key can be retrieved from the configuration center immediately after the sending server starts, and the retrieved pre-shared key can be loaded.

[0058] Furthermore, to ensure the security of the pre-shared key and configuration key, the configuration center typically stores the creation time (i.e., the time the pre-shared key was created) and expiration time (i.e., the time the pre-shared key expires) of the pre-shared key, and updates the pre-shared key and / or configuration key based on the creation and expiration times. Additionally, the configuration key can also be updated based on the creation and expiration times.

[0059] For example: obtain the PSK and the corresponding configuration key K from the configuration center through the live streaming server A.

[0060] In summary, the sending server obtains the pre-shared key and configuration key from the configuration center in advance, and then performs communication authentication with the receiving server based on the obtained pre-shared key and configuration key. This avoids the sending server and receiving server establishing a connection in advance and reduces the time spent on handshake and key negotiation between the two.

[0061] Since there are various ways to create a pre-shared key, in order to ensure that the creation of the pre-shared key complies with communication rules, this embodiment uses a pre-built virtual client and virtual server to create the pre-shared key. Before obtaining the pre-shared key and the corresponding configuration key from the configuration center through the client, the following steps are also included:

[0062] The virtual client and the virtual server create the pre-shared key based on the preset shared key parameters and the preset configuration key, and send the pre-shared key and the configuration key to the configuration center.

[0063] Specifically, a virtual client is a client pre-built according to the client protocol rules included in the required communication protocol. Similarly, a virtual server is a server pre-built according to the server protocol rules included in the required communication protocol. Pre-set shared key parameters refer to the key parameters that the virtual client and virtual server can use during key derivation. When the communication protocol used is QUIC compatible with TLS 1.3, these pre-set shared key parameters can be the pre-set ECDHE algorithm parameters, which include the elliptic curve function corresponding to the ECDHE algorithm and the base point G.

[0064] Based on this, the two can achieve key derivation and key exchange involved in handshake and key negotiation processes even offline, using pre-set shared key parameters and configuration keys. That is, they can create a pre-shared key using the key algorithm included in the communication protocol, without the need for an actual connection (e.g., offline). In practical applications, during or after the creation of the pre-shared key, the creation time and expiration time of the pre-shared key can also be set. Then, the configuration key, the pre-shared key, and the corresponding creation and expiration times are uploaded to the configuration center.

[0065] Using the previous example: In offline mode, a virtual live streaming client and a virtual live streaming server are built. Both create a PSK based on the pre-set ECDHE algorithm parameters and configuration key K, and upload the created PSK and configuration key K to the configuration center.

[0066] In summary, by pre-creating the pre-shared keys required for communication through virtual clients and virtual servers, the standardization of the created pre-shared keys is ensured. Then, the configuration key and the created pre-shared keys are uploaded to the configuration center so that the sending server can obtain this information from the configuration center in advance before communication.

[0067] Step 204: Encrypt the pre-shared key based on the configuration key to obtain the encrypted pre-shared key.

[0068] Specifically, based on the above-mentioned acquisition of the pre-shared key and configuration key, considering the need to encrypt and decrypt the pre-shared key to achieve communication authentication between the sending server and the receiving server, the pre-shared key is encrypted using the configuration key to obtain the encrypted pre-shared key.

[0069] The encrypted pre-shared key refers to the encrypted key obtained after encrypting the pre-shared key.

[0070] Based on the above, the PSK and the corresponding configuration key K are obtained from the configuration center through the live streaming server A. The live streaming server A then encrypts the PSK using the configuration key K to obtain an encrypted PSK.

[0071] Step 206: Add the encrypted pre-shared key to the handshake initial message and send the handshake initial message to the receiving server. The receiving server decrypts the pre-shared key from the handshake initial message based on the preset configuration key and uses it to create a communication key for communication with the sending server.

[0072] Specifically, based on the above-mentioned acquisition of the encrypted pre-shared key, in order to ensure that the receiving server correctly receives the encrypted pre-shared key, the encrypted pre-shared key is added to the corresponding field in the handshake initial message, and then the handshake initial message with the encrypted pre-shared key added is sent to the receiving server, so that the receiving server can correctly decrypt the encrypted pre-shared key based on the pre-set configuration key, thereby realizing the communication authentication between the two.

[0073] The handshake initiation message can be understood as the Client Hello message sent by the client. This message contains a field for storing the encrypted pre-shared key. Therefore, after generating the encrypted pre-shared key, it is added to this field in the handshake initiation message.

[0074] In practical applications, to ensure the security of the initial handshake message transmission, the initial handshake message can be encrypted before being sent to the receiving server. The key used to encrypt the initial handshake message can be any key provided with the communication protocol; there are no restrictions on its use.

[0075] Furthermore, after the sending server sends the handshake initial message carrying the encrypted pre-shared key to the receiving server, in order for the receiving server to verify the pre-shared key, a configuration key pre-set or stored on the receiving server is needed to decrypt the encrypted pre-shared key. If the configuration key can correctly decrypt the encrypted pre-shared key, the verification is considered successful. The configuration key preset on the server can also be obtained by the receiving server from a configuration center in advance, or pre-issued by the configuration center, to ensure the matching of the pre-shared key and the configuration key between the sending and receiving servers.

[0076] By creating a communication key based on the shared pre-shared key between the two parties to encrypt or decrypt the application data to be transmitted, zero-RTT data communication between the client and the server can be achieved.

[0077] After the live streaming server A encrypts the PSK using the configuration key K to obtain the encrypted PSK, it adds the encrypted PSK to the pre_shared_key field of the Client Hello, and then sends the Client Hello message carrying the encrypted PSK to the live streaming server B. The live streaming server B can then decrypt the encrypted PSK in the Client Hello message based on the pre-configured configuration key K to obtain the PSK.

[0078] Since the sending server and receiving server directly complete communication authentication based on the encryption and decryption of the pre-shared key, after the sending server sends the handshake initial message, it can directly send application data without waiting for the receiving server's reply to the handshake initial message. In this embodiment, after sending the handshake initial message to the receiving server, the process further includes:

[0079] Obtain initial application data and create a client initial transmission key based on the pre-shared key;

[0080] The initial application data is encrypted using the client's initial transmission key to obtain encrypted data, which is then sent to the receiving server.

[0081] Accordingly, the receiving server decrypts the encrypted pre-shared key in the received handshake initial message based on the preset configuration key, and after obtaining the pre-shared key, it further includes:

[0082] The receiving server receives the encrypted data and creates a server-side initial transmission key based on the pre-shared key;

[0083] The encrypted data is decrypted based on the server's initial transmission key to obtain the initial application data.

[0084] Specifically, the initial application data refers to the first application data packet sent by the server. Correspondingly, the client's initial transmission key is the key used to encrypt the initial application data. The server's initial transmission key is the key used to decrypt the encrypted data to obtain the initial application data.

[0085] Since the sending server can obtain the pre-shared encryption key by correctly decrypting it after sending it to the receiving server, both the sending and receiving servers can use the same key creation algorithm to create keys based on this pre-shared key. The resulting client-side initial transmission key and server-side initial transmission key are also identical. Subsequently, the sending server encrypts the initial application data based on the client-side initial transmission key. After obtaining the encrypted data, the receiving server can decrypt it based on the server-side initial transmission key to restore the initial application data.

[0086] Continuing with the previous example, after live streaming server A sends a Client Hello message carrying an encrypted PSK, and if live streaming server A does not receive a reply from live streaming server B for the Client Hello message, it creates a client initial transmission key 0RTT-key based on the PSK, and encrypts the initial application data d1 based on the 0RTT-key to obtain encrypted data ed1. After live streaming server B obtains the PSK, it also creates a server transmission key 0RTT-key based on the PSK, and decrypts the encrypted data ed1 based on the 0RTT-key to obtain the initial application data d1.

[0087] In summary, when the sending server does not receive a handshake reply message from the receiving server in response to the initial handshake message, it encrypts the initial application data using the client initial transmission key created from the pre-shared key. After obtaining the encrypted data, it directly sends the encrypted data to the receiving server. The receiving server decrypts the encrypted data using the server initial transmission key created from the pre-shared key, restoring the initial application data. This means that the two servers do not need to negotiate or interact based on keys before communication, achieving 0RTT communication between the sending and receiving servers.

[0088] Furthermore, the step of creating a client initial transmission key based on the pre-shared key includes:

[0089] The pre-shared key is extracted using a preset key extraction function to obtain the client's initial key;

[0090] The client's initial transmission key is obtained by expanding the client's initial key using a preset key expansion function.

[0091] Specifically, the key extraction function is the function that extracts the key from the key, aiming to pseudo-randomize the user-input key as much as possible. In the TLS 1.3 protocol, the key extraction function is the HKDF-Extract function. The client's initial key can be understood as the key material extracted by the client from the pre-shared key. Correspondingly, the receiving server also has a server's initial key, which can be understood as the key material extracted by the receiving server from the pre-shared key. The key expansion function is the function that expands the key to the required length through a series of hash operations; in the TLS 1.3 protocol, the key extraction function is the HKDF-Expand function.

[0092] Since both the receiving server and the receiving client derive their keys based on the same key extraction and key expansion functions using the pre-shared key, thus obtaining the client's initial transmission key and the server's initial transmission key, they are essentially using the same key.

[0093] Taking a QUIC-compatible TLS 1.3 communication protocol as an example, the process of deducing the connection key between the sending server (client) and the receiving server (server) is as follows: Figure 3 As shown: First, the PSK and 0 are used as input. The HKDF extraction function HKDF-Extract extracts the input material to obtain the Early Secret. Based on the Early Secret, the client key material (client_early_traffic_secret) is derived. Then, based on the client key material (client_early_traffic_secret), the 0RTT-key (write_key) is derived, and the application data is processed using the 0RTT-key. Here, the Early Secret can be understood as either the client-side Early Secret or the server-side Early Secret; the 0RTT-key is either the client-side Early Transmission Key or the server-side Early Transmission Key.

[0094] In summary, by extracting and expanding the key based on the pre-shared key, and then generating the initial transmission key (i.e., the server-side initial transmission key and the client-side initial transmission key) for encrypting and decrypting the initial application data, the security of the initial transmission key is ensured, and the security of data transmission is potentially guaranteed.

[0095] Considering the possibility of connection interruptions between the sending and receiving servers, and the security risks associated with the pre-shared key in the configuration center remaining unchanged for an extended period, this embodiment further includes the following to ensure the stability and security of communication between the sending and receiving servers:

[0096] Receive the encrypted reconnection pre-shared key sent by the receiving server;

[0097] The encrypted reconnection pre-shared key is sent to the configuration center.

[0098] Specifically, the implementation of the receiving server creating the encrypted reconnection shared key is as follows:

[0099] The server retrieves the client shared key parameter from the handshake initial message.

[0100] A reconnection pre-shared key is created based on the server key material corresponding to the server initial transmission key and the client shared key parameters.

[0101] The reconnection pre-shared key is encrypted based on the configuration key to obtain an encrypted reconnection pre-shared key, and the encrypted reconnection pre-shared key is sent to the client.

[0102] Specifically, the client-side shared key parameter refers to the key parameters issued by the sending server that can be shared with the receiving server. This client-side shared key parameter may include the client's public key and other parameters used by the server to create the reconnection shared key. When the communication protocol is QUIC and TLS 1.3 compatible, this client-side shared key parameter may include the client's public key, the elliptic curve function involved in the ECDHE algorithm, and the base point G, etc. The reconnection pre-shared key refers to another pre-shared key created based on the connection between the sending and receiving servers. This reconnection pre-shared key is used for authentication during reconnection between the sending and receiving servers. The server-side key material corresponding to the server-side initial transmission key is specifically the intermediate key generated during the creation of the server-side initial transmission key based on the pre-shared key.

[0103] Furthermore, since the reconnection pre-shared key is itself a pre-shared key, it is sent to the configuration center after creation. Similarly, during the creation of the reconnection pre-shared key, a creation time and expiration time can also be created, and these, along with the key itself, are sent to the configuration center. To ensure the security of the reconnection pre-shared key, an encrypted version is sent directly to the configuration center.

[0104] In practical applications, the sending server can create a JSON-formatted configuration file based on the encrypted reconnection pre-shared key, its corresponding creation time, and expiration time, and then upload the configuration file to the configuration center. Correspondingly, the sending server can obtain the pre-shared key and configuration key from the configuration center, and also obtain the JSON-formatted configuration file containing these contents.

[0105] Specifically, such as Figure 4 As shown, the configuration center stores configuration files containing a pre-shared key and its corresponding timestamps (creation time and / or expiration time). Clients (sending servers) can request or push configuration files from the configuration center. Upon receiving a client request, the configuration center sends the configuration file to the client. If the client requires communication with the server (receiving server), the client directly sends a handshake initiation message carrying the pre-shared key to the server. Without requiring a server response, the client directly sends the initial application data packet, achieving zero-RTT application data transmission. Based on the pre-shared key, the client derives the encryption and decryption keys required for subsequent application data packets for transmission.

[0106] Continuing with the previous example, after live streaming server A sends a Client Hello message, live streaming server B receives the message, retrieves the client shared key parameters p1 and p2 from it, and creates a reconnection pre-shared key PSK1 based on these parameters and the server-side key material. This PSK1 is then encrypted using the configuration key K to obtain encrypted PSK1, which is sent to live streaming server A. Live streaming server A then forwards this encrypted PSK1 to the configuration center.

[0107] In summary, the receiving server creates a reconnection pre-shared key and sends the encrypted reconnection pre-shared key to the sending server, enabling the sending server to reconnect with the server based on this key. The sending server then sends the encrypted reconnection pre-shared key to the configuration center, allowing the configuration center to update its stored pre-shared key based on the received key.

[0108] Based on the completion of the first application data packet transmission, and considering the low security of continuously using the client's initial transmission key and the server's initial transmission key to encrypt and decrypt application data, this embodiment, to enhance the security of subsequent application data transmission, includes the following after the receiving server receives the handshake initial message:

[0109] Receive an initial reply message corresponding to the handshake initial message sent by the receiving server, wherein the initial reply message includes server shared key parameters;

[0110] A client transmission key is created based on the client key material corresponding to the client initial transmission key and the server shared key parameters obtained in the handshake initial message.

[0111] Based on the client's transmission key, encrypted communication application data is obtained, and the encrypted communication data is sent to the receiving server.

[0112] Accordingly, the receiving server creates a server-side transmission key based on the server-side key material corresponding to the server-side initial transmission key and the client-side shared key parameters;

[0113] The encrypted communication data is decrypted based on the server-side transmission key to obtain the communication application data.

[0114] Specifically, the initial reply message refers to the receiving server's reply message to the initial handshake message. This initial reply message can be understood as a Server Hello message sent by the receiving server. The server-side shared key parameters refer to the key parameters sent by the receiving server that can be shared with the sending server. These server-side shared key parameters may include the server's public key and parameters used by the sending server to create the client transmission key. The client transmission key is the key used by the sending server to encrypt communication application data. Correspondingly, the server transmission key is the key used by the receiving server to decrypt encrypted communication data. The communication application data can be the second application data packet following the first application data packet, or it can be other application data besides the initial application data; there are no restrictions here. The client transmission key and the server transmission key are mutually encryption and decryption keys; that is, the client transmission key and the server transmission key can be exactly the same key.

[0115] Corresponding to the server-side key materials mentioned above, the client-side key materials for the client's initial transmission key refer to the key used to create the client's initial transmission key. Specifically, this server-side key material is the intermediate key generated during the process of creating the client's initial transmission key based on the pre-shared key.

[0116] like Figure 3As shown, the Early Secret and ECDHE key are taken as input and extracted using the HKDF extraction function HKDF-Extract to obtain the Handshake Secret. If the connection is not established using the ORRT-key, the Handshake Secret needs to be further expanded using the HKDF expansion function HKDF-Expand to derive the server_handshake_traffic_secret and client_handshake_traffic_secret. These two secrets are used to expand the write_key and write_IV for the handshake phase. Finally, the Handshake Secret and 0 are input, and the HKDF extraction function HKDF-Extract extracts the Master Secret. The Master Secret is then expanded by the HKDF expansion function HKDF-Expand to obtain the server_application_traffic_secret, client_application_traffic_secret, and reuse_master_secret. The server and client application transport keys are used to expand the write_key and write_IV for the data transmission phase. The write_key for the data transmission phase can be understood as either the server or client transport key mentioned above; the reuse master key can be understood as the reconnection pre-shared key mentioned above; the initial key, handshake key, and ECDHE key can all be understood as part of the server or client key materials mentioned above.

[0117] In summary, after the initial application data transmission is completed, subsequent application data is encrypted or decrypted by creating new transmission keys (i.e., client transmission key and server transmission key) on the sending server and receiving server respectively, which further enhances the security of data transmission.

[0118] Considering that the sending server uses a pre-shared key to communicate with the receiving server for an extended period, and that this pre-shared key is at risk of being cracked, this embodiment also includes:

[0119] The storage pre-shared key is obtained from the configuration center according to a preset time period;

[0120] If the pre-shared key expires based on its creation and expiration times, the pre-shared key is removed, and the stored pre-shared key is loaded.

[0121] Specifically, the preset time period refers to a pre-set time interval, which can be 1 hour, 5 hours, or 1 day, etc., without restriction. The stored pre-shared key refers to the pre-shared key stored in the configuration center, which can be an updated version of the aforementioned pre-shared key.

[0122] Based on this, after the sending server obtains the stored pre-shared key from the configuration center, it can determine whether the pre-shared key has expired based on its creation and expiration times. If the ratio of the time between the current time and the creation time to the time between the creation and expiration times does not reach a threshold, the pre-shared key is considered not expired. If the ratio reaches the threshold, the pre-shared key meets the expiration condition, which can also be interpreted as the pre-shared key expiring. If the pre-shared key is determined to be expired, it needs to be replaced in the sending server promptly, i.e., the expired pre-shared key needs to be removed and a newly acquired stored pre-shared key needs to be loaded. Furthermore, in the case of removing the pre-shared key, the stored configuration key can also be replaced.

[0123] Specifically, based on the QUIC protocol, configuration parameters (i.e., the pre-shared key and configuration key) are obtained from the configuration center, and these parameters are set for TLS 1.3 and carried in the initial handshake message. The server can deduce the corresponding key from the carried parameters and decrypt the application data. This truly achieves secure and confidential communication from the start, greatly reducing handshake latency and first-frame latency. Furthermore, to address the issue of configuration file expiration, the client side periodically generates new configuration data and pushes it to the configuration center, and periodically retrieves updates from the configuration center to its local configuration for use on subsequent connections.

[0124] For example: Live streaming server A obtains the storage pre-shared key from the configuration center every 2 hours. Based on the storage pre-shared key PSK2 obtained by live streaming server A, it calculates the difference dv1 between the creation time T1 and the current time T2 of PSK, and the difference dv2 between the creation time T1 and the expiration time T3. If dv1 reaches 80% of dv2, it is determined that PSK has expired. Live streaming server A removes PSK and loads PSK2.

[0125] In summary, by periodically obtaining new pre-shared keys from the configuration center by the sending server, and replacing the original pre-shared key with the new one when the pre-shared key obtained by the sending server expires, the timeliness and security of the pre-shared keys in the sending server are ensured.

[0126] It should be noted that the communication establishment method provided in this application is also applicable in scenarios where there are multiple sending servers and multiple receiving servers, wherein any sending server can connect to each receiving server based on the above method.

[0127] In addition to replacing the pre-shared key via the sending server as described above, to ensure the security of the pre-shared key, this embodiment also allows replacement of the pre-shared key at the configuration center, further including:

[0128] The configuration center receives communication pre-shared keys from at least two communication servers.

[0129] If the pre-shared key meets the preset expiration condition, the communication pre-shared key with the latest key creation time is determined as the target pre-shared key based on the key creation time corresponding to each communication pre-shared key.

[0130] Replace the pre-shared key with the target pre-shared key.

[0131] Specifically, "at least two communication servers" refers to any sending server that establishes communication with the receiving server. Correspondingly, the communication pre-shared key refers to the pre-shared key generated by the communication server through establishing a connection with the receiving server. The preset expiration condition refers to the pre-set conditions for determining whether the pre-shared key has expired. This preset expiration condition can be a preset percentage of the pre-shared key's usage time exceeding the expiration time, such as 75% or 85%. The key creation time refers to the creation time of the communication pre-shared key. The target pre-shared key refers to the communication pre-shared key with the latest key creation time selected from the received communication pre-shared keys.

[0132] In practical applications, to avoid receiving expired pre-shared keys from the sending server, the pre-shared keys stored in the configuration center need to be updated promptly if they are about to expire or have already expired. Furthermore, after the configuration center replaces the pre-shared key with the target pre-shared key, that target pre-shared key can be distributed across the entire network.

[0133] For example: The configuration center receives communication pre-shared key PSK3 uploaded by live streaming server C and communication pre-shared key PSK4 uploaded by live streaming server D. If it is determined that the usage duration of the pre-shared key PSK is greater than 75% of its expiration time, and the creation time T4 corresponding to communication pre-shared key PSK3 is later than the creation time T5 corresponding to communication pre-shared key PSK4, then the pre-shared key PSK is replaced based on communication pre-shared key PSK3.

[0134] In summary, by receiving pre-shared keys (i.e., communication pre-shared keys) from multiple communication servers through the configuration center, and replacing the pre-shared keys stored within the configuration center when they are close to expiration, the validity and security of the pre-shared keys in the configuration center are ensured.

[0135] The first communication establishment method provided in this embodiment is applied to a sending server. To reduce the round-trip latency between the sending server and the receiving server, the sending server obtains a pre-shared key and a corresponding configuration key, encrypts the pre-shared key based on the configuration key to obtain an encrypted pre-shared key, adds the encrypted pre-shared key to the handshake initial message, and sends the handshake initial message to the receiving server. This enables the sending server to initiate communication verification with the receiving server based on the pre-obtained pre-shared key. The receiving server decrypts the pre-shared key from the handshake initial message based on the preset configuration key, and uses it to create a communication key for communication with the sending server. This enables direct communication authentication between the sending server and the receiving server based on the pre-stored pre-configured key and the configuration key. Therefore, the sending server can directly transmit application data without waiting for a response from the receiving server, reducing the time consumed by the handshake and key negotiation between the sending server and the receiving server before communication.

[0136] Figure 5 A flowchart of a second communication establishment method according to an embodiment of this application is shown, applied to a receiving server, and specifically includes the following steps:

[0137] Step 502: Receive the handshake initial message sent by the sending server, wherein the handshake initial message carries the encrypted pre-shared key obtained by the sending server based on the configuration key encrypted pre-shared key;

[0138] Step 504: Decrypt the encrypted pre-shared key in the received handshake initial message based on the preset configuration key to obtain the pre-shared key, wherein the pre-shared key is used to create a communication key for communication between the sending server and the receiving server.

[0139] Optionally, the communication establishment method further includes:

[0140] Receive encrypted data sent by the sending server;

[0141] Create a server-side initial transmission key based on the pre-shared key;

[0142] The encrypted data is decrypted based on the server's initial transmission key to obtain the initial application data.

[0143] Optionally, the step of creating a server-side initial transmission key based on the pre-shared key includes:

[0144] The pre-shared key is extracted using a preset key extraction function to obtain the server's initial key;

[0145] The server's initial transmission key is obtained by expanding the server's initial key using a preset key expansion function.

[0146] Optionally, after obtaining the initial application data, the process further includes:

[0147] Obtain the client shared key parameters from the handshake initial message;

[0148] A reconnection pre-shared key is created based on the server key material corresponding to the server initial transmission key and the client shared key parameters.

[0149] The reconnection pre-shared key is encrypted based on the configuration key to obtain an encrypted reconnection pre-shared key, which is then sent to the sending server.

[0150] Optionally, the communication establishment method further includes:

[0151] Send the initial reply message corresponding to the handshake initial message to the sending server;

[0152] Receive encrypted communication data sent by the sending server based on the initial reply message;

[0153] A server-side transmission key is created based on the server-side key material corresponding to the server-side initial transmission key and the client-side shared key parameters.

[0154] The second communication establishment method provided in this embodiment is applied to a receiving server. To reduce the round-trip delay between the sending server and the receiving server, the receiving server receives a handshake initial message sent by the sending server. This handshake initial message carries an encrypted pre-shared key obtained by the sending server based on a configuration key. The receiving server decrypts the encrypted pre-shared key in the received handshake initial message based on a preset configuration key to obtain the pre-shared key. This pre-shared key is used to create a communication key between the sending server and the receiving server. This method enables direct communication authentication between the sending server and the receiving server based on a pre-stored pre-configured key and a configuration key. Therefore, the sending server can directly transmit application data without waiting for a response from the receiving server, reducing the time consumed by handshake and key negotiation before communication between the sending server and the receiving server.

[0155] The above is an illustrative scheme of the second communication establishment method in this embodiment. It should be noted that the technical solution of the second communication establishment method belongs to the same concept as the technical solution of the first communication establishment method described above. For details not described in detail in the technical solution of the second communication establishment method, please refer to the description of the technical solution of the first communication establishment method described above.

[0156] Figure 6 A flowchart of a third communication establishment method according to an embodiment of this application is shown. This communication establishment method is applied to a communication establishment system, which includes a client and a server, and specifically includes the following steps:

[0157] Step 602: Obtain the pre-shared key and the configuration key corresponding to the pre-shared key through the client.

[0158] Specifically, the client refers to a program that provides local services to the user and needs to cooperate with the server to run. The server is a program that provides targeted services to the client, including providing resources to the client and storing client data. Furthermore, in this application, the client and server can also be understood as different servers. For example, in a live video streaming scenario, the streamer is located in Heilongjiang and therefore uploads the live video to a server in Heilongjiang. The user is in Shanghai and therefore requests to watch the live video from a server in Shanghai. The Shanghai server, acting as the client, needs to establish a communication connection with the server (the server in Heilongjiang) to achieve communication between the two servers. The Shanghai server can be understood as the sending server in the above method embodiment, and the Heilongjiang server can be understood as the receiving server in the above method embodiment.

[0159] A pre-shared key is a key created in advance to enable communication between the client and the server. A configuration key is a key pre-configured to encrypt or decrypt the pre-shared key on both the client and the server. This configuration key is typically an additional key pre-configured at the application layer for the pre-shared key; it can be a symmetric key or an asymmetric key, without restriction.

[0160] It should be noted that the communication establishment method provided in this application can establish communication between any client and server. For ease of description, this embodiment uses a live streaming client as the client and a live streaming server as the server for illustration. The process of establishing communication between other clients and servers can refer to the same or corresponding description in this embodiment, and will not be elaborated on in detail here.

[0161] Since communication between the server and client requires a pre-defined communication protocol, the transport layer protocols used in previous network transmission architectures to ensure the reliability and security of data between the client and server typically consumed a significant amount of time during the handshake and key negotiation phases.

[0162] In existing technologies, network transmission architectures using the QUIC protocol and TLS 1.3 compatibility can control the time consumed by the transport layer handshake and TLS key negotiation to within one RTT. If the client and server have established a connection beforehand, application data can be sent directly under secure conditions, thus saving the time consumed by the client and server handshake and key negotiation. However, 0 RTT requires prior connection between the client and server. Therefore, this application provides a solution that allows the client and server to send application data directly even if they have never connected before and the connection is secure.

[0163] Based on this, this application directly obtains the pre-shared key used for communication authentication with the server from the client, sends the encrypted pre-shared key to the server, and the server verifies the pre-shared key by correctly decrypting the encrypted pre-shared key, thus achieving communication authentication between the client and the server. This pre-shared key can be called a PSK (Pre-Shared Key) in a QUIC protocol-compatible TLS 1.3 network transmission architecture.

[0164] Considering that there may be multiple clients and servers, and multiple pre-shared keys may also exist, it is necessary to manage the pre-shared keys. In this embodiment, in order to facilitate the management of pre-shared keys and ensure their security, the communication establishment system includes a configuration center; the client obtains the pre-shared key and the configuration key corresponding to the pre-shared key from the configuration center.

[0165] Specifically, the configuration center can be a functional module installed in a communication system, or it can be a smart device with storage and management functions; there are no restrictions here. This configuration center is used to store, update, and manage pre-shared keys and configuration keys.

[0166] Therefore, since the configuration center stores the pre-shared key and the configuration key, to ensure the security of the pre-shared key during transmission, it can be encrypted in the configuration center based on the configuration key. After the client obtains the encrypted pre-shared key and configuration key, it can then be decrypted based on the configuration key. Furthermore, to avoid the time-consuming process of temporarily retrieving the pre-shared key and configuration key from the configuration center before communication is required, the pre-shared key and configuration key can be retrieved from the configuration center immediately after the client starts, and the retrieved pre-shared key can be loaded.

[0167] Furthermore, to ensure the security of the pre-shared key and configuration key, the configuration center typically stores the creation time (i.e., the time the pre-shared key was created) and expiration time (i.e., the time the pre-shared key expires) of the pre-shared key, and updates the pre-shared key and / or configuration key based on the creation and expiration times. Additionally, the configuration key can also be updated based on the creation and expiration times.

[0168] For example: obtain the PSK and the corresponding configuration key K from the configuration center through the live streaming client c1.

[0169] In summary, by having the client obtain the pre-shared key and configuration key from the configuration center in advance, and then using both to authenticate with the server, the client and server avoid pre-establishing a connection and reduce the time spent on handshake and key negotiation between them.

[0170] Since there are various ways to create a pre-shared key, in order to ensure that the creation of the pre-shared key complies with communication rules, in this embodiment, the communication establishment system includes a virtual client and a virtual server. Before obtaining the pre-shared key and the configuration key corresponding to the pre-shared key from the configuration center through the client, the following steps are also included:

[0171] The virtual client and the virtual server create the pre-shared key based on the preset shared key parameters and the preset configuration key, and send the pre-shared key and the configuration key to the configuration center.

[0172] Specifically, a virtual client is a client pre-built according to the client protocol rules included in the required communication protocol. Similarly, a virtual server is a server pre-built according to the server protocol rules included in the required communication protocol. Pre-set shared key parameters refer to the key parameters that the virtual client and virtual server can use during key derivation. When the communication protocol used is QUIC compatible with TLS 1.3, these pre-set shared key parameters can be the pre-set ECDHE algorithm parameters, which include the elliptic curve function corresponding to the ECDHE algorithm and the base point G.

[0173] Based on this, the two can achieve key derivation and key exchange involved in handshake and key negotiation processes offline, using pre-set shared key parameters and configuration keys. That is, they can create a pre-shared key without an actual connection using the key algorithm included in the communication protocol. In practical applications, during or after the creation of the pre-shared key, the creation time and expiration time of the pre-shared key can also be set. Then, the configuration key, the pre-shared key, and the corresponding creation and expiration times are uploaded to the configuration center.

[0174] Using the previous example: In offline mode, a virtual live streaming client and a virtual live streaming server are built. Both create a PSK based on the pre-set ECDHE algorithm parameters and configuration key K, and upload the created PSK and configuration key K to the configuration center.

[0175] In summary, by pre-creating the pre-shared keys required for communication through virtual clients and virtual servers, the standardization of the created pre-shared keys is ensured. Then, the configuration key and the created pre-shared keys are uploaded to the configuration center so that the client can obtain this information from the configuration center in advance before communication.

[0176] Step 604: Encrypt the pre-shared key based on the configuration key to obtain the encrypted pre-shared key, add the encrypted pre-shared key to the handshake initial message, and send the handshake initial message to the server.

[0177] Specifically, based on the client obtaining the pre-shared key and configuration key, considering the need to encrypt and decrypt the pre-shared key to achieve communication authentication between the client and the server, the pre-shared key is encrypted using the configuration key. The encrypted pre-shared key is then added to the corresponding field in the handshake initial message. The handshake initial message with the encrypted pre-shared key is then sent to the server so that the server can correctly decrypt the encrypted pre-shared key based on the pre-set configuration key, thereby achieving communication authentication between the two.

[0178] The encrypted pre-shared key refers to the encryption key obtained by encrypting the pre-shared key. The handshake initiation message can be understood as the Client Hello message sent by the client. This handshake initiation message contains a field for storing the encrypted pre-shared key. Therefore, after generating the encrypted pre-shared key, it is added to this field in the handshake initiation message.

[0179] In practical applications, to ensure the security of the initial handshake message transmission, the initial handshake message can be encrypted before being sent to the server. The key used to encrypt the initial handshake message can be any key provided with the communication protocol; there are no restrictions on its use.

[0180] Based on the above process of obtaining the PSK and the corresponding configuration key K from the configuration center through the live streaming client c1, the live streaming client c1 encrypts the PSK using the configuration key K to obtain the encrypted PSK, adds the encrypted PSK to the pre_shared_key field of ClientHello, and then sends the Client Hello message carrying the encrypted PSK to the live streaming server.

[0181] Step 606: On the server side, the encrypted pre-shared key in the received handshake initial message is decrypted based on the preset configuration key to obtain the pre-shared key, wherein the pre-shared key is used to create a communication key for communication between the client and the server.

[0182] Specifically, after the client sends the handshake initial message carrying the encrypted pre-shared key to the server, in order for the server to verify the pre-shared key, a configuration key pre-set or stored on the server needs to decrypt the encrypted pre-shared key. If the configuration key can correctly decrypt the encrypted pre-shared key, the verification is considered successful. The configuration key preset on the server can either be obtained by the server from a configuration center or pre-distributed by the configuration center to ensure the compatibility of the pre-shared key and the configuration key between the client and server.

[0183] Furthermore, by creating a communication key based on the shared pre-shared key to encrypt or decrypt the application data to be transmitted, zero-RTT data communication between the client and the server can be achieved.

[0184] Following the previous example, after the live streaming client c1 sends the Client Hello message carrying the encrypted PSK to the live streaming server, the live streaming server can decrypt the encrypted PSK in the Client Hello message based on the pre-configured configuration key K to obtain the PSK.

[0185] Since the client and server directly complete communication authentication based on the encryption and decryption of the pre-shared key, after the client sends the initial handshake message, it can directly send application data without waiting for the server's reply. In this embodiment, after sending the initial handshake message to the server, the process further includes:

[0186] The client obtains initial application data and creates an initial transmission key for the client based on the pre-shared key.

[0187] The initial application data is encrypted based on the client's initial transmission key to obtain encrypted data, and the encrypted data is sent to the server.

[0188] Accordingly, after decrypting the encrypted pre-shared key in the received handshake initial message on the server side based on the preset configuration key to obtain the pre-shared key, the process further includes:

[0189] The server receives the encrypted data and creates an initial server transmission key based on the pre-shared key.

[0190] The encrypted data is decrypted based on the server's initial transmission key to obtain the initial application data.

[0191] Specifically, the initial application data refers to the first application data packet sent by the client. Correspondingly, the client's initial transmission key is the key used to encrypt the initial application data. The server's initial transmission key is the key used to decrypt the encrypted data to obtain the initial application data.

[0192] Since the client can obtain the pre-shared encryption key by correctly decrypting it after sending it to the server, both the client and server can use the same key creation algorithm to create keys based on this pre-shared key. Therefore, the client's initial transmission key and the server's initial transmission key will also be the same. Subsequently, the client encrypts the initial application data based on its initial transmission key. After obtaining the encrypted data, the client can decrypt it on the server based on its initial transmission key to restore the initial application data.

[0193] Continuing with the previous example, after the live streaming client c1 sends a Client Hello message carrying an encrypted PSK, and if the live streaming client c1 does not receive a reply from the live streaming server for the Client Hello message, it creates a client initial transmission key 0RTT-key based on the PSK, and encrypts the initial application data d1 based on the 0RTT-key to obtain encrypted data ed1. Similarly, after the live streaming server obtains the PSK, it also creates a server transmission key 0RTT-key based on the PSK, and decrypts the encrypted data ed1 based on the 0RTT-key to obtain the initial application data d1.

[0194] In summary, without receiving a response from the server to the initial handshake message, the client encrypts the initial application data using the client-side initial transport key created from the pre-shared key, obtains the encrypted data, and directly sends it to the server. Correspondingly, the server decrypts the encrypted data using the server-side initial transport key created from the pre-shared key, restoring the initial application data. This means that the two do not need to negotiate or interact based on keys before communication, achieving 0RTT communication between the client and server.

[0195] Furthermore, the creation of the client's initial transmission key based on the pre-shared key is specifically implemented as follows:

[0196] The pre-shared key is extracted using a preset key extraction function to obtain the client's initial key;

[0197] The client's initial transmission key is obtained by expanding the client's initial key using a preset key expansion function;

[0198] Accordingly, the step of creating the server-side initial transmission key based on the pre-shared key includes:

[0199] The server-side initial key is obtained by extracting the key from the pre-shared key using the key extraction function.

[0200] The server's initial transmission key is obtained by expanding the server's initial key using the key expansion function.

[0201] Specifically, the key extraction function is the function that extracts the key from the key. This function is used to pseudo-randomize the user-input key as much as possible. In the TLS 1.3 protocol, the key extraction function is the HKDF-Extract function. The client's initial key can be understood as the key material extracted by the client from the pre-shared key. The server's initial key can be understood as the key material extracted by the server from the pre-shared key. The key expansion function is the function that expands the key to the required length through a series of hash operations. In the TLS 1.3 protocol, the key extraction function is the HKDF-Expand function.

[0202] Since both the server and the client derive their initial transmission keys based on the pre-shared key and using the same key extraction and key expansion functions, they are essentially the same key.

[0203] Taking QUIC-compatible TLS 1.3 as an example, the client and server connection key derivation process is as follows: Figure 3 As shown: First, the PSK and 0 are used as input. The HKDF extraction function HKDF-Extract extracts the input material to obtain the Early Secret. Based on the Early Secret, the client's initial transmission key (client_early_traffic_secret), i.e., the 0RTT-key, is derived. The application data is then processed using the 0RTT-key. Here, the Early Secret can be understood as either the client's initial key or the server's initial key; the 0RTT-key is either the client's initial transmission key or the server's initial transmission key.

[0204] In summary, by extracting and expanding the key based on the pre-shared key, and then generating the initial transmission key (i.e., the server-side initial transmission key and the client-side initial transmission key) for encrypting and decrypting the initial application data, the security of the initial transmission key is ensured, and the security of data transmission is potentially guaranteed.

[0205] Considering the possibility of connection interruptions between the client and server, and the security risks associated with the pre-shared key in the configuration center remaining unchanged for an extended period, this embodiment, after obtaining the initial application data, further includes:

[0206] The server retrieves the client shared key parameter from the handshake initial message.

[0207] A reconnection pre-shared key is created based on the server key material corresponding to the server initial transmission key and the client shared key parameters.

[0208] The reconnection pre-shared key is encrypted based on the configuration key to obtain an encrypted reconnection pre-shared key, and the encrypted reconnection pre-shared key is sent to the client.

[0209] The client sends the encrypted reconnection pre-shared key to the configuration center.

[0210] Specifically, the client-side shared key parameters refer to the key parameters issued by the client that can be shared with the server. These parameters may include the client's public key and other parameters used by the server to create the reconnection shared key. When the communication protocol is QUIC and TLS 1.3 compatible, these parameters may include the client's public key, the elliptic curve function involved in the ECDHE algorithm, and the base point G. The reconnection pre-shared key refers to another pre-shared key created based on the connection between the client and server. This pre-shared key is used for authentication during reconnection between the client and server. The server-side key material corresponding to the server's initial transmission key is specifically the intermediate key generated during the creation of the server's initial transmission key based on the pre-shared key.

[0211] Furthermore, since the reconnection pre-shared key is itself a pre-shared key, it is sent to the configuration center after creation. Similarly, during the creation of the reconnection pre-shared key, a creation time and expiration time can also be created, and these, along with the key itself, are sent to the configuration center. To ensure the security of the reconnection pre-shared key, an encrypted version is sent directly to the configuration center.

[0212] In practical applications, clients can create a JSON-formatted configuration file based on the encrypted reconnection pre-shared key, its corresponding creation time, and expiration time, and then upload the configuration file to the configuration center. Similarly, when clients retrieve the pre-shared key and configuration key from the configuration center, they can also retrieve a JSON-formatted configuration file containing this information.

[0213] Specifically, such as Figure 4As shown, the configuration center stores configuration files containing a pre-shared key and its corresponding timestamps (creation time and / or expiration time). Clients can request or push configuration files from the configuration center. Upon receiving a client request, the configuration center sends the configuration file to the client. If the client requires communication with the server, it directly sends a handshake initiation message carrying the pre-shared key to the server. Without requiring a server response, it directly sends the initial application data packet, achieving zero-RTT application data transmission. Based on the pre-shared key, it derives the encryption and decryption keys needed for subsequent application data packets for transmission.

[0214] Following the previous example, after the live streaming client c1 sends a Client Hello message, the live streaming server receives the Client Hello message and obtains the client shared key parameters p1 and p2 from the message. Based on these parameters and the server's key, the server creates a reconnection pre-shared key PSK1 and encrypts it using the configuration key K to obtain an encrypted PSK1. The encrypted PSK1 is then sent to the live streaming client c1, which in turn sends it to the configuration center.

[0215] In summary, the server creates a reconnection pre-shared key and sends the encrypted reconnection pre-shared key to the client, enabling the client to reconnect to the server based on this key. The client then sends the encrypted reconnection pre-shared key to the configuration center, allowing the configuration center to update its stored pre-shared key based on the received key.

[0216] Based on the completion of the first application data packet transmission, and considering the low security of continuously using the client's initial transmission key and the server's initial transmission key to encrypt and decrypt application data, this embodiment, to enhance the security of subsequent application data transmission, includes the following after the server receives the handshake initial message:

[0217] The server sends an initial reply message corresponding to the handshake initial message to the client, wherein the initial reply message includes server shared key parameters;

[0218] In the client, a client transmission key is created based on the client key material corresponding to the client's initial transmission key and the server-side shared key parameters;

[0219] Based on the client's transmission key, encrypted communication application data is obtained, and the encrypted communication data is sent to the server.

[0220] In the server, a server-side transmission key is created based on the server-side key material corresponding to the server-side initial transmission key and the client-side shared key parameters;

[0221] The encrypted communication data is decrypted based on the server-side transmission key to obtain the communication application data.

[0222] Specifically, the initial reply message refers to the server's response message to the initial handshake message. This initial reply message can be understood as a Server Hello message sent by the server. The server-side shared key parameters refer to the key parameters sent by the server that can be shared with the client. These parameters may include the server's public key and the parameters used by the client to create the client's transmission key. The client's transmission key is the key used by the client to encrypt communication application data. Correspondingly, the server's transmission key is the key used by the server to decrypt encrypted communication data. The communication application data can be the second application data packet following the first application data packet, or it can be other application data besides the initial application data; there are no restrictions here. The client's transmission key and the server's transmission key are mutually encrypting and decrypting keys; that is, the client's transmission key and the server's transmission key can be exactly the same key.

[0223] Corresponding to the server-side key materials mentioned above, the client-side key materials for the client's initial transmission key refer to the key used to create the client's initial transmission key. Specifically, this server-side key material is the intermediate key generated during the process of creating the client's initial transmission key based on the pre-shared key.

[0224] like Figure 3As shown, the Early Secret and ECDHE key are taken as input and extracted using the HKDF extraction function HKDF-Extract to obtain the Handshake Secret. If the connection is not established using the ORRT-key, the Handshake Secret needs to be further expanded using the HKDF expansion function HKDF-Expand to derive the server_handshake_traffic_secret and client_handshake_traffic_secret. These two secrets are used to expand the write_key and write_IV for the handshake phase. Finally, the Handshake Secret and 0 are input, and the HKDF extraction function HKDF-Extract extracts the Master Secret. The Master Secret is then expanded by the HKDF expansion function HKDF-Expand to obtain the server_application_traffic_secret, client_application_traffic_secret, and reuse_master_secret. The server and client application transport keys are used to expand the write_key and write_IV for the data transmission phase. The write_key for the data transmission phase can be understood as either the server or client transport key mentioned above; the reuse master key can be understood as the reconnection pre-shared key mentioned above; the initial key, handshake key, and ECDHE key can all be understood as part of the server or client key materials mentioned above.

[0225] In summary, after the initial application data transmission is completed, subsequent application data is encrypted or decrypted by creating new transmission keys (i.e., client transmission key and server transmission key) on the client and server sides respectively, which further enhances the security of data transmission.

[0226] Considering that the client uses a pre-shared key to communicate with the server for an extended period, and this pre-shared key is at risk of being cracked, this embodiment also includes:

[0227] The client obtains the storage pre-shared key from the configuration center according to a preset time period;

[0228] If the pre-shared key expires based on its creation and expiration times, the pre-shared key is removed, and the stored pre-shared key is loaded.

[0229] Specifically, the preset time period refers to a pre-set time interval, which can be 1 hour, 5 hours, or 1 day, etc., without restriction. The stored pre-shared key refers to the pre-shared key stored in the configuration center, which can be an updated version of the aforementioned pre-shared key.

[0230] Based on this, after the client obtains the storage pre-shared key from the configuration center, the expiration time of the pre-shared key can be used to determine whether it has expired. If the ratio of the time between the current time and the creation time to the time between the creation time and the expiration time does not reach a threshold, the pre-shared key is considered not expired. If the ratio reaches the threshold, the pre-shared key meets the expiration condition, which can also be interpreted as the pre-shared key expiring. If the pre-shared key is determined to be expired, it needs to be replaced in the client promptly, i.e., the expired pre-shared key needs to be removed and the newly obtained storage pre-shared key needs to be loaded. Furthermore, if the pre-shared key is removed, the storage configuration key can also be replaced.

[0231] Specifically, based on the QUIC protocol, configuration parameters (i.e., the pre-shared key and configuration key) are obtained from the configuration center, and these parameters are set for TLS 1.3 and carried in the initial handshake message. The server can deduce the corresponding key from the carried parameters and decrypt the application data. This truly achieves secure and confidential communication from the start, greatly reducing handshake latency and first-frame latency. Furthermore, to address the issue of configuration file expiration, the client side periodically generates new configuration data and pushes it to the configuration center, and periodically retrieves updates from the configuration center to its local configuration for use on subsequent connections.

[0232] For example, live streaming client c1 retrieves the storage pre-shared key from the configuration center every 2 hours. Based on the storage pre-shared key PSK2 obtained by live streaming client c1, it calculates the difference dv1 between the creation time T1 and the current time T2 of PSK, and the difference dv2 between the creation time T1 and the expiration time T3. If dv1 reaches 80% of dv2, it is determined that PSK has expired. The live streaming client c1 then removes PSK and loads PSK2.

[0233] In summary, by having the client periodically obtain a new pre-shared key from the configuration center, and by replacing the original pre-shared key with the new one when the client's pre-shared key expires, the timeliness and security of the client's pre-shared key are ensured.

[0234] In addition to changing the pre-shared key via the client as described above, to ensure the security of the pre-shared key, this embodiment also allows changing the pre-shared key in the configuration center, and further includes:

[0235] The configuration center receives communication pre-shared keys sent by at least two communication clients.

[0236] If the pre-shared key meets the preset expiration condition, the communication pre-shared key with the latest key creation time is determined as the target pre-shared key based on the key creation time corresponding to each communication pre-shared key.

[0237] Replace the pre-shared key with the target pre-shared key.

[0238] Specifically, "at least two communication clients" refers to any client that communicates with the server. Correspondingly, the communication pre-shared key refers to the pre-shared key generated by the communication client when establishing a connection with the server. The preset expiration condition refers to the pre-set conditions for determining whether the pre-shared key has expired. This preset expiration condition can be a preset percentage of the pre-shared key's usage time exceeding the expiration time, such as 75% or 85%. The key creation time refers to the creation time of the communication pre-shared key. The target pre-shared key refers to the communication pre-shared key with the latest key creation time selected from the received communication pre-shared keys.

[0239] In practical applications, to prevent clients from obtaining expired pre-shared keys, it is necessary to update the pre-shared keys stored in the configuration center promptly if they are about to expire or have already expired. Furthermore, after the configuration center replaces the pre-shared key with the target pre-shared key, the target pre-shared key can be distributed across the entire network.

[0240] For example, the configuration center receives communication pre-shared key PSK3 uploaded by live streaming client c2 and communication pre-shared key PSK4 uploaded by live streaming client c3. If it is determined that the usage duration of the pre-shared key PSK is greater than 75% of its expiration time, and the creation time T4 corresponding to communication pre-shared key PSK3 is later than the creation time T5 corresponding to communication pre-shared key PSK4, then the pre-shared key PSK is replaced based on communication pre-shared key PSK3.

[0241] In summary, by receiving pre-shared keys (i.e., communication pre-shared keys) from multiple communication servers through the configuration center, and replacing the pre-shared keys stored within the configuration center when they are close to expiration, the validity and security of the pre-shared keys in the configuration center are ensured.

[0242] It should be noted that the communication establishment method provided in this application is also applicable in scenarios with multiple clients and multiple servers, where any client can connect to each server based on the above method.

[0243] The communication establishment method provided in this embodiment is applied to a communication establishment system, which includes a client and a server. To reduce the round-trip latency between the client and server, the client obtains a pre-shared key and its corresponding configuration key. The pre-shared key is then encrypted using the configuration key to obtain an encrypted pre-shared key. This encrypted pre-shared key is added to the handshake initial message, which is then sent to the server. This enables the client to initiate communication verification with the server based on the pre-obtained pre-shared key. The server then obtains the configuration key and decrypts the encrypted pre-shared key in the received handshake initial message to obtain the pre-shared key. This pre-shared key is used to create the communication key between the client and server. This method enables direct communication authentication between the server and client based on the pre-stored pre-configured key and the configuration key. Therefore, application data transmission can proceed directly without waiting for a server response, reducing the time consumed by the client and server during handshake and key negotiation before communication.

[0244] Corresponding to the above method embodiments, this application also provides communication method embodiments. Figure 7 A flowchart illustrating a communication method provided in one embodiment of this application is shown. Figure 7 As shown, the communication method is applied to a communication system, which includes a client and a server, and specifically includes the following steps:

[0245] Step 702: Obtain initial application data through the client and create an initial transmission key for the client based on the pre-shared key;

[0246] Step 704: Encrypt the initial application data based on the client's initial transmission key to obtain encrypted data, and send the encrypted data to the server.

[0247] Step 706: Receive the encrypted data through the server and create a server initial transmission key based on the pre-shared key sent by the client;

[0248] Step 708: Decrypt the encrypted data based on the server's initial transmission key to obtain the initial application data.

[0249] It should be noted that this embodiment is based on the above-mentioned communication establishment method, that is, a communication method in which data communication is carried out between the client and the server after a communication connection is established.

[0250] The communication method provided in this embodiment is applied to a communication system including a server and a client. The client obtains initial application data and creates a client-side initial transmission key based on a pre-shared key. The initial application data is encrypted using the client-side initial transmission key to obtain encrypted data, which is then sent to the server. The server receives the encrypted data and creates a server-side initial transmission key based on the pre-shared key sent by the client. The encrypted data is then decrypted using the server-side initial transmission key to obtain the initial application data. This method enables application data transmission even without receiving a response from the server to the initial handshake message, reducing the time consumed by the client and server during handshake and key negotiation before communication.

[0251] The above is an illustrative scheme of a communication method according to this embodiment. It should be noted that the technical solution of this communication method belongs to the same concept as the technical solution of the communication authentication method described above. For details not described in detail in the technical solution of the communication method, please refer to the description of the technical solution of the communication authentication method described above.

[0252] The following is in conjunction with the appendix Figure 8 Taking the application of the communication establishment method provided in this application in an interactive scenario as an example, the communication establishment method will be further explained. Among them, Figure 8 The diagram illustrates an interactive schematic of a communication establishment method according to an embodiment of this application. The communication establishment method is applied to a communication establishment system, which includes a configuration center, a client, and a server. Based on this, the communication establishment process includes the following steps.

[0253] Step 802: Obtain the pre-shared key PSK and the configuration key corresponding to the pre-shared key PSK from the configuration center through the client.

[0254] Specifically, the pre-shared key is generated in the following way:

[0255] A pre-shared key (PSK) is created using a virtual client and a virtual server based on preset shared key parameters and a pre-set configuration key, and then the pre-shared key (PSK) and the configuration key are sent to the configuration center.

[0256] Step 804: Encrypt the pre-shared key PSK based on the configuration key to obtain the encrypted pre-shared key.

[0257] Step 806: Add the encrypted pre-shared key to the Client Hello message and send the Client Hello message carrying the encrypted pre-shared key to the server.

[0258] Step 808: Obtain initial application data through the client and create an initial client transport key 0RTT-key based on the pre-shared key PSK.

[0259] Step 810: Encrypt the initial application data based on the client's initial transmission key 0RTT-key to obtain encrypted data, and send the encrypted data to the server.

[0260] Step 812: On the server side, the encrypted pre-shared key in the received Client Hello message is decrypted based on the preset configuration key to obtain the pre-shared key PSK.

[0261] The pre-shared key is used to create a communication key for communication between the client and the server.

[0262] Step 814: Receive encrypted data from the server and create a server-side initial transport key 0RTT-key based on the pre-shared key PSK.

[0263] Step 816: Decrypt the encrypted data based on the server's initial transmission key 0RTT-key to obtain the initial application data.

[0264] Step 818: Obtain the client shared key parameter from the Client Hello message on the server side, and create a reconnection pre-shared key PSK-N based on the server key material corresponding to the server's initial transmission key and the client shared key parameter.

[0265] Step 820: Encrypt the reconnection pre-shared key PSK-N based on the configuration key to obtain the encrypted reconnection pre-shared key, and send the encrypted reconnection pre-shared key to the client.

[0266] Step 822: Send the encrypted reconnection pre-shared key to the configuration center via the client.

[0267] The communication establishment method provided in this embodiment is applied to a communication establishment system, which includes a client and a server. To reduce the round-trip latency between the client and server, the client obtains a pre-shared key and its corresponding configuration key. The pre-shared key is then encrypted using the configuration key to obtain an encrypted pre-shared key. This encrypted pre-shared key is added to the handshake initial message, which is then sent to the server, enabling the client to initiate communication verification to the server. The server then obtains the configuration key and decrypts the encrypted pre-shared key in the received handshake initial message to obtain the pre-shared key. This pre-shared key is used to create the communication key between the client and server. This method enables direct communication authentication between the server and client based on a pre-stored pre-configured key and the configuration key. Application data can be transmitted directly without waiting for a server response, reducing the time consumed by the client and server during handshake and key negotiation before communication.

[0268] Corresponding to the above method embodiments, this application also provides a communication establishment system embodiment. Figure 9 This application provides a schematic diagram of the structure of a communication establishment system according to an embodiment of the present application; as shown. Figure 9 As shown, the communication establishment system 900 includes: a client 902 and a server 904;

[0269] The client 902 obtains a pre-shared key and a configuration key corresponding to the pre-shared key, encrypts the pre-shared key based on the configuration key to obtain an encrypted pre-shared key, adds the encrypted pre-shared key to the handshake initial message, and sends the handshake initial message to the server 904.

[0270] The server 904 decrypts the encrypted pre-shared key in the received handshake initial message based on the preset configuration key to obtain the pre-shared key, wherein the pre-shared key is used to create a communication key for communication between the client 902 and the server 904.

[0271] Optionally, the communication establishment system includes a configuration center;

[0272] Accordingly, the communication establishment system includes:

[0273] The client 902 obtains the pre-shared key and the configuration key corresponding to the pre-shared key from the configuration center.

[0274] Optionally, the communication establishment system includes a virtual client and a virtual server; correspondingly, the communication establishment system further includes:

[0275] The virtual client and the virtual server create the pre-shared key based on the preset shared key parameters and the pre-set configuration key, and send the pre-shared key and the configuration key to the configuration center.

[0276] Optionally, the communication establishment system further includes:

[0277] The client 902 obtains initial application data and creates a client initial transmission key based on the pre-shared key; it encrypts the initial application data based on the client initial transmission key to obtain encrypted data and sends the encrypted data to the server 904.

[0278] Accordingly, the communication establishment system further includes:

[0279] The server 904 receives the encrypted data and creates a server initial transmission key based on the pre-shared key; it then decrypts the encrypted data based on the server initial transmission key to obtain the initial application data.

[0280] Optionally, the communication establishment system further includes:

[0281] The server 904 obtains the client shared key parameters from the handshake initial message; creates a reconnection pre-shared key based on the server key material corresponding to the server initial transmission key and the client shared key parameters; encrypts the reconnection pre-shared key based on the configuration key to obtain an encrypted reconnection pre-shared key, and sends the encrypted reconnection pre-shared key to the client 902.

[0282] The client 902 sends the encrypted reconnection pre-shared key to the configuration center.

[0283] Optionally, the communication establishment system further includes:

[0284] The client 902 obtains the storage pre-shared key from the configuration center according to a preset time period; if the pre-shared key expires based on the creation time and expiration time corresponding to the pre-shared key, the client removes the pre-shared key and loads the storage pre-shared key.

[0285] Optionally, the communication establishment system further includes:

[0286] The configuration center receives communication pre-shared keys sent by at least two communication clients; if the pre-shared keys meet the preset expiration conditions, it determines the communication pre-shared key with the latest key creation time as the target pre-shared key based on the key creation time corresponding to each communication pre-shared key; and replaces the pre-shared key based on the target pre-shared key.

[0287] Optionally, creating the client initial transport key based on the pre-shared key includes:

[0288] The client 902 extracts the pre-shared key using a preset key extraction function to obtain the client initial key; and expands the client initial key using a preset key expansion function to obtain the client initial transmission key.

[0289] Accordingly, the step of creating the server-side initial transmission key based on the pre-shared key includes:

[0290] The server 904 extracts the pre-shared key using the key extraction function to obtain the server initial key; and expands the server initial key using the key expansion function to obtain the server initial transmission key.

[0291] Optionally, the communication establishment system further includes:

[0292] The server 904 sends an initial reply message corresponding to the handshake initial message to the client 902, wherein the initial reply message includes server shared key parameters;

[0293] The client 902 creates a client transmission key based on the client key material corresponding to the client initial transmission key and the server shared key parameters; it encrypts communication application data based on the client transmission key to obtain encrypted communication data, and sends the encrypted communication data to the server 904.

[0294] The server 904 creates a server transmission key based on the server key material corresponding to the server initial transmission key and the client shared key parameters; it then decrypts the encrypted communication data based on the server transmission key to obtain the communication application data.

[0295] The communication establishment system provided in this embodiment includes a client and a server. To reduce round-trip latency between the client and server, the client obtains a pre-shared key and its corresponding configuration key. The pre-shared key is then encrypted using the configuration key to obtain an encrypted pre-shared key. This encrypted pre-shared key is added to the handshake initiation message, which is then sent to the server. This enables the client to initiate communication verification with the server based on the pre-obtained pre-shared key. The server then obtains the configuration key and decrypts the encrypted pre-shared key in the received handshake initiation message to obtain the pre-shared key. This pre-shared key is used to create the communication key between the client and server. This system enables direct communication authentication between the server and client based on the pre-stored pre-configuration key and the configuration key. Therefore, application data transmission can proceed directly without waiting for a server response, reducing the time consumed by the client and server during handshake and key negotiation before communication.

[0296] The above is an illustrative scheme of a communication establishment system according to this embodiment. It should be noted that the technical solution of this communication establishment system and the technical solution of the above-described communication establishment method belong to the same concept. For details not described in detail in the technical solution of the communication establishment system, please refer to the description of the technical solution of the above-described communication establishment method.

[0297] Figure 10 A structural block diagram of a computing device 1000 according to one embodiment of this specification is shown. The components of the computing device 1000 include, but are not limited to, a memory 1010 and a processor 1020. The processor 1020 is connected to the memory 1010 via a bus 1030, and a database 1050 is used to store data.

[0298] The computing device 1000 also includes an access device 1040, which enables the computing device 1000 to communicate via one or more networks 1060. Examples of these networks include Public Switched Telephone Network (PSTN), Local Area Network (LAN), Wide Area Network (WAN), Personal Area Network (PAN), or combinations of communication networks such as the Internet. The access device 1040 may include one or more of any type of wired or wireless network interface (e.g., a network interface controller (NIC)), such as an IEEE 802.11 Wireless Local Area Network (WLAN) wireless interface, a Wi-MAX (Worldwide Interoperability for Microwave Access) interface, an Ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a Bluetooth interface, a Near Field Communication (NFC) interface, and so on.

[0299] In one embodiment of this application, the aforementioned components of the computing device 1000 and Figure 10 Other components, not shown, can also be connected to each other, for example, via a bus. It should be understood that... Figure 10 The block diagram of the computing device shown is for illustrative purposes only and is not intended to limit the scope of this application. Those skilled in the art can add or replace other components as needed.

[0300] The computing device 1000 can be any type of stationary or mobile computing device, including mobile computers or mobile computing devices (e.g., tablet computers, personal digital assistants, laptop computers, notebook computers, netbooks, etc.), mobile phones (e.g., smartphones), wearable computing devices (e.g., smartwatches, smart glasses, etc.) or other types of mobile devices, or stationary computing devices such as desktop computers or personal computers (PCs). The computing device 1000 can also be a mobile or stationary server.

[0301] The processor 1020 is configured to execute the following computer-executable instructions, which, when executed by the processor, implement the steps of the above-described communication establishment method or communication method.

[0302] The above is an illustrative scheme of a computing device according to this embodiment. It should be noted that the technical solution of this computing device belongs to the same concept as the technical solution of the communication establishment method or communication method described above. For details not described in detail in the technical solution of the computing device, please refer to the description of the technical solution of the communication establishment method or communication method described above.

[0303] An embodiment of this application also provides a computer-readable storage medium storing computer instructions that, when executed by a processor, implement the steps of the communication establishment method or communication method as described above.

[0304] The above is an illustrative scheme of a computer-readable storage medium according to this embodiment. It should be noted that the technical solution of this storage medium belongs to the same concept as the technical solution of the communication establishment method or communication method described above. For details not described in detail in the technical solution of the storage medium, please refer to the description of the technical solution of the communication establishment method or communication method described above.

[0305] The foregoing has described specific embodiments of this application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired results. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0306] The computer instructions include computer program code, which may be in the form of source code, object code, executable file, or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium may be appropriately added to or subtracted according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media may not include electrical carrier signals and telecommunication signals.

[0307] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0308] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0309] The preferred embodiments disclosed above are merely illustrative of this application. The optional embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this application. These embodiments are selected and specifically described in this application to better explain the principles and practical applications of this application, thereby enabling those skilled in the art to better understand and utilize this application. This application is limited only by the claims and their full scope and equivalents.

Claims

1. A communication establishment method, characterized in that, Applied to the sending server, including: Obtain the pre-shared key and the configuration key corresponding to the pre-shared key; The pre-shared key is encrypted based on the configuration key to obtain the encrypted pre-shared key; The encrypted pre-shared key is added to the handshake initial message, and the handshake initial message is sent to the receiving server. The receiving server decrypts the pre-shared key from the handshake initial message based on the preset configuration key, and uses it to create a communication key for communication with the sending server. The step of obtaining the pre-shared key and the configuration key corresponding to the pre-shared key includes: Obtain the pre-shared key and the configuration key corresponding to the pre-shared key from the configuration center; The step of sending the initial handshake message to the receiving server further includes: Obtain initial application data and create a client initial transmission key based on the pre-shared key; The initial application data is encrypted based on the client's initial transmission key to obtain encrypted data, and the encrypted data is sent to the receiving server. The method further includes: Receive the encrypted reconnection pre-shared key sent by the receiving server; Send the encrypted reconnection pre-shared key to the configuration center; This also includes: The storage pre-shared key is obtained from the configuration center according to a preset time period; If the pre-shared key expires based on its creation and expiration times, the pre-shared key is removed, and the stored pre-shared key is loaded.

2. The communication establishment method according to claim 1, characterized in that, The step of creating a client initial transmission key based on the pre-shared key includes: The pre-shared key is extracted using a preset key extraction function to obtain the client's initial key; The client's initial transmission key is obtained by expanding the client's initial key using a preset key expansion function.

3. The communication establishment method according to claim 1, characterized in that, Also includes: Receive an initial reply message corresponding to the handshake initial message sent by the receiving server, wherein the initial reply message includes server shared key parameters; A client transmission key is created based on the client key material corresponding to the client initial transmission key and the server shared key parameters obtained in the handshake initial message. Based on the client's transmission key, encrypted communication application data is obtained, and the encrypted communication data is sent to the receiving server.

4. A communication establishment method, characterized in that, Applied to the receiving server, including: Receive a handshake initiation message sent by the sending server, wherein the handshake initiation message carries an encrypted pre-shared key obtained by the sending server based on the configuration key encrypted pre-shared key; Based on the preset configuration key, the encrypted pre-shared key in the received handshake initial message is decrypted to obtain the pre-shared key, wherein the pre-shared key is used to create a communication key for communication between the sending server and the receiving server; Specifically, the pre-shared key and the configuration key corresponding to the pre-shared key are obtained from the configuration center; The method of receiving and sending the handshake initial message from the server further includes: Obtain initial application data and create a client initial transmission key based on the pre-shared key; The initial application data is encrypted based on the client's initial transmission key to obtain encrypted data, and the encrypted data is sent to the receiving server. The method further includes: Receive the encrypted reconnection pre-shared key sent by the receiving server; Send the encrypted reconnection pre-shared key to the configuration center; This also includes: The storage pre-shared key is obtained from the configuration center according to a preset time period; If the pre-shared key expires based on its creation and expiration times, the pre-shared key is removed, and the stored pre-shared key is loaded.

5. A communication establishment method, characterized in that, This is applied to a communication establishment system, which includes a client and a server, and includes: The client obtains the pre-shared key and the configuration key corresponding to the pre-shared key. The pre-shared key is encrypted based on the configuration key to obtain an encrypted pre-shared key. The encrypted pre-shared key is added to the handshake initial message, and the handshake initial message is sent to the server. On the server side, the encrypted pre-shared key in the received handshake initial message is decrypted based on the preset configuration key to obtain the pre-shared key, wherein the pre-shared key is used to create a communication key for communication between the client and the server. The step of obtaining the pre-shared key and the configuration key corresponding to the pre-shared key includes: Obtain the pre-shared key and the configuration key corresponding to the pre-shared key from the configuration center; After sending the initial handshake message to the server, the method further includes: Obtain initial application data and create a client initial transmission key based on the pre-shared key; The initial application data is encrypted based on the client's initial transmission key to obtain encrypted data, and the encrypted data is sent to the receiving server. After obtaining the initial application data, the process further includes: The server retrieves the client shared key parameter from the handshake initial message. A reconnection pre-shared key is created based on the server key material corresponding to the server initial transmission key and the client shared key parameters. The reconnection pre-shared key is encrypted based on the configuration key to obtain an encrypted reconnection pre-shared key, and the encrypted reconnection pre-shared key is sent to the client. The client sends the encrypted reconnection pre-shared key to the configuration center. This also includes: The storage pre-shared key is obtained from the configuration center according to a preset time period; If the pre-shared key expires based on its creation and expiration times, the pre-shared key is removed, and the stored pre-shared key is loaded.

6. The communication establishment method according to claim 5, characterized in that, The communication establishment system includes a configuration center; Accordingly, obtaining the pre-shared key and the configuration key corresponding to the pre-shared key through the client includes: The client obtains the pre-shared key and the corresponding configuration key from the configuration center.

7. The communication establishment method according to claim 6, characterized in that, The communication establishment system includes a virtual client and a virtual server. Before obtaining the pre-shared key and the corresponding configuration key from the configuration center through the client, the system further includes: The virtual client and the virtual server create the pre-shared key based on the preset shared key parameters and the preset configuration key, and send the pre-shared key and the configuration key to the configuration center.

8. The communication establishment method according to claim 6, characterized in that, After sending the initial handshake message to the server, the process further includes: The client obtains initial application data and creates an initial transmission key for the client based on the pre-shared key. The initial application data is encrypted based on the client's initial transmission key to obtain encrypted data, and the encrypted data is sent to the server. Accordingly, after decrypting the encrypted pre-shared key in the received handshake initial message on the server side based on the preset configuration key to obtain the pre-shared key, the process further includes: The server receives the encrypted data and creates an initial server transmission key based on the pre-shared key. The encrypted data is decrypted based on the server's initial transmission key to obtain the initial application data.

9. The communication establishment method according to claim 6, characterized in that, Also includes: The configuration center receives communication pre-shared keys sent by at least two communication clients. If the pre-shared key meets the preset expiration condition, the communication pre-shared key with the latest key creation time is determined as the target pre-shared key based on the key creation time corresponding to each communication pre-shared key. Replace the pre-shared key with the target pre-shared key.

10. The communication establishment method according to claim 8, characterized in that, The step of creating a client initial transmission key based on the pre-shared key includes: The client's initial transmission key is obtained by expanding the client's initial key using a preset key expansion function; Accordingly, the step of creating the server-side initial transmission key based on the pre-shared key includes: The server's initial key is obtained by extracting the key from the pre-shared key using a key extraction function; The server's initial transmission key is obtained by expanding the server's initial key using the key expansion function.

11. The communication establishment method according to claim 10, characterized in that, Also includes: The server sends an initial reply message corresponding to the handshake initial message to the client, wherein the initial reply message includes server shared key parameters; In the client, a client transmission key is created based on the client key material corresponding to the client's initial transmission key and the server-side shared key parameters; Based on the client's transmission key, encrypted communication application data is obtained, and the encrypted communication data is sent to the server. In the server, a server-side transmission key is created based on the server-side key material corresponding to the server-side initial transmission key and the client-side shared key parameters; The encrypted communication data is decrypted based on the server-side transmission key to obtain the communication application data.

12. A communication method applied to a communication system, the communication system comprising a client and a server, including: The client obtains initial application data and creates an initial transmission key for the client based on the pre-shared key. The server receives encrypted data and creates an initial transmission key based on the pre-shared key sent by the client. Accordingly, the step of creating the server-side initial transmission key based on the pre-shared key includes: The server's initial key is obtained by extracting the key from the pre-shared key using a key extraction function; The server's initial transmission key is obtained by expanding the server's initial key using a key expansion function. This involves obtaining the pre-shared key and the corresponding configuration key from the configuration center; After sending the initial handshake message to the receiving server, the process also includes: Obtain initial application data and create a client initial transmission key based on the pre-shared key; The initial application data is encrypted based on the client's initial transmission key to obtain encrypted data, and the encrypted data is sent to the receiving server. The method further includes: Receive the encrypted reconnection pre-shared key sent by the receiving server; Send the encrypted reconnection pre-shared key to the configuration center; This also includes: The storage pre-shared key is obtained from the configuration center according to a preset time period; If the pre-shared key expires based on its creation and expiration times, the pre-shared key is removed, and the stored pre-shared key is loaded.

13. A communication establishment system, comprising: Client and server; The client obtains a pre-shared key and a configuration key corresponding to the pre-shared key, encrypts the pre-shared key based on the configuration key to obtain an encrypted pre-shared key, adds the encrypted pre-shared key to the handshake initial message, and sends the handshake initial message to the server. The server decrypts the encrypted pre-shared key in the received handshake initial message based on the preset configuration key to obtain the pre-shared key, wherein the pre-shared key is used to create a communication key for communication between the client and the server. The step of obtaining the pre-shared key and the configuration key corresponding to the pre-shared key includes: Obtain the pre-shared key and the configuration key corresponding to the pre-shared key from the configuration center; After sending the initial handshake message to the server, the method further includes: Obtain initial application data and create a client initial transmission key based on the pre-shared key; The initial application data is encrypted based on the client's initial transmission key to obtain encrypted data, and the encrypted data is sent to the receiving server. This also includes: Receive the encrypted reconnection pre-shared key sent by the receiving server; Send the encrypted reconnection pre-shared key to the configuration center; This also includes: The storage pre-shared key is obtained from the configuration center according to a preset time period; If the pre-shared key expires based on its creation and expiration times, the pre-shared key is removed, and the stored pre-shared key is loaded.

14. A computing device, comprising a memory, a processor, and computer instructions stored in the memory and executable on the processor, characterized in that, When the processor executes the instructions, it implements the steps of the method according to any one of claims 1-12.

15. A computer-readable storage medium storing computer instructions, characterized in that, When executed by the processor, this instruction implements the steps of the method according to any one of claims 1-12.

Images