A multi-task parallel communication method based on TLS SNI field distribution

Abstract

The application realizes a multi-task parallel communication method based on TLS SNI field distribution. Two mechanisms A and B are set as operation parties to perform multiple MPC tasks in parallel, a communication protocol based on TLS and SNI field distribution is applied to the communication of the two mechanisms, in particular, the proxy running in the gateway server is processed by SNI value, and the value of SNI in the dynamically set SNI value scheme is dynamically generated. Each MPC task corresponds to an SNI value, and multiple MPC tasks are sent out in series through a specific limited port in the proxy running in the gateway server, and the receiver distinguishes each MPC task according to the SNI value. In this way, the limitation of the number of MPC concurrency is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network, and particularly relates to a multi-task parallel communication method based on TLS SNI field shunting. BACKGROUND

[0002] When a firewall processes inbound traffic, all inbound traffic will be intercepted by default, and only specially configured TCP communication ports will not be intercepted. Nowadays, many MPC protocols do not consider this when performing network communication, resulting in the use of different communication ports by each task during MPC multi-task parallelism. Therefore, the number of open ports of the firewall limits the number of concurrent MPC tasks.

[0003] In order to solve the problem that the method adopted by the prior art limits the number of MPC concurrent tasks, and only a number of MPC tasks can be executed in parallel according to the number of open ports of the firewall, the present application proposes a multi-task parallel communication method based on TLS SNI field shunting for realizing MPC multi-task parallel communication under the condition of limited communication ports. SUMMARY

[0004] To this end, the present application first proposes a multi-task parallel communication method based on TLS SNI field shunting, sets two mechanisms mechanism A and mechanism B as operation parties to execute multiple MPC tasks in parallel, and applies a communication protocol based on TLS and SNI field shunting to the communication between the two mechanisms. Specifically, the communication method is realized through eight steps.

[0005] Step one, the mechanism A and the mechanism B are set as two parties of communication, and a communication network is formed by a firewall, a gateway server, and an agent running on the gateway server. The agent running on the gateway server forwards multiple MPC tasks of the mechanism A to the mechanism B simultaneously, and both parties dynamically set SNIvalue.

[0006] Step two, data is sent from a computer cluster performing an MPC task to an intranet gateway server of a sending party. The device initiating the MPC communicates with the gateway server through a specific port via a TLS protocol, and these ports are all monitored by the agent for receiving intranet traffic.

[0007] Step three, the agent running in the gateway server processes SNIvalue: the agent running in the gateway server sets the SNIvalue corresponding to the port according to the port, sets the data received by the A port as SNIvalue_1, and sets the data received by the B port as SNIvalue_2.

[0008] Step four, the data is sent from the gateway server to the firewall of the initiating mechanism. The agent running in the gateway server serially sends the data with the set SNIvalue to the firewall.

[0009] Step five, data is sent from the initiating agency firewall to the receiving agency firewall;

[0010] Step six, data is sent from the receiving agency firewall to the receiving party intranet gateway server;

[0011] Step seven, data is analyzed by the proxy running on the receiving party gateway server, the SNIvalue value in the data is analyzed, and the data is sent to the corresponding MPC task;

[0012] Step eight, data is sent from the gateway server to the corresponding MPC task receiving device, the device initiating Task1 in agency B receives the data of Task1 in agency A, and the device initiating Task2 receives the data of Task2 in agency A.

[0013] The specific method of dynamically setting SNIvalue by the two parties is realized through eight steps:

[0014] Step one, the communication passes through the firewalls and gateway servers of agencies A and B, and the proxy running on the gateway server forwards the MPCTask1 and MPCTask2 of agency A to initiate communication to agency B at the same time; MPCTask1 of agency A wants to establish a TLS connection with MPCTask1 of agency B, but at this time MPCTask1 of agency A does not know how to connect agency B;

[0015] Step two, the SNIGenerator in the sending party generates a request from the computer cluster executing the MPC task, that is, MPCTask1 of agency A sends a request to SNIGenerator of agency A, hoping to obtain the SNI used for communication with MPCTask1 of agency B;

[0016] Step three, the SNIGenerator of the sending party sends a request to the SNIGenerator of the receiving party: the SNIGenerator of agency A sends a request to the SNIGenerator of agency B, hoping to obtain the SNI used for communication with MPCTask1 of agency B;

[0017] Step four, the SNIGenerator of agency B interacts with MPCTask1 of agency B, and MPCTask1 generates a new SNI_A and sends it to the SNIGenerator, and tells itself to listen to the communication port A;

[0018] Step five, the SNIGenerator of agency B issues a configuration to the proxy, and if the received TLS flow contains SNI as SNI_A, the flow is forwarded to the communication port A listened to by MPCTask1;

[0019] Step six, the SNIGenerator of the agency B sends the value of the new SNIA (SNI_A) to the SNIGenerator of the agency A.

[0020] Step seven, after receiving, the SNIGenerator of the agency A issues a configuration to the proxy, and the configuration content is: set SNI_A when forwarding the TLS traffic from port B;

[0021] Step eight, the SNIGenerator of the agency A replies to the MPC task 1, and if you want to connect the MPC task 1 of the agency B, connect the B port of the proxy.

[0022] In the dynamic SNI value setting scheme, the value of the SNI can be dynamically generated instead of being configured in advance. The method for generating a new SNI includes:

[0023] 1. The MPC task uses a cryptographically secure pseudo-random number generator to generate two random numbers, one as an AES encryption key (referred to as key A), and the other as a seed for generating other random numbers (referred to as seed A). When generating the SNI, first generate a random number using the seed A, and combine the random number with the task ID of the MPC task, and use the key A to perform AES encryption, and use the AES encryption result as the new SNI value.

[0024] 2. The MPC task sets the value of the SNI as the task ID and a self-grown counter. Each time a new SNI value is generated, the counter is incremented by one.

[0025] The technical effects to be achieved by the present application are:

[0026] The present application uses a TLS communication protocol with SNI configuration. Each MPC task corresponds to an SNI value. Multiple MPC tasks are serially transmitted through the proxy running in the gateway server from a specific limited port, and the receiver distinguishes each MPC task according to the SNI value. In this way, the problem of limiting the number of concurrent MPCs, executing a number of MPC tasks in parallel according to the number of ports opened by the firewall, is solved. BRIEF DESCRIPTION OF DRAWINGS

[0027] Figure 1 Multi-task parallel communication flow architecture based on TLS SNI field shunting;

[0028] Figure 2 SNI value setting process between the two communication parties. DETAILED DESCRIPTION

[0029] The following is a preferred embodiment of the present application and further describes the technical solutions of the present application in conjunction with the drawings, but the present application is not limited to this embodiment.

[0030] The present application provides a multi-task parallel communication method based on TLS SNI field shunting.

[0031] Two institutions perform multiple MPC tasks in parallel as operation parties, and apply SNI in the MPC scene (take two MPC tasks in parallel as an example to illustrate the scheme) The communication protocol steps are as follows Steps 1-8, as shown in Figure 1

[0032] 1. Data from a computer cluster performing MPC tasks from a certain party -> sender intranet gateway server: The device initiating MPC communicates with the gateway server through a specific port via the TLS protocol, and these ports are all monitored by proxy for receiving intranet traffic. Task1 communicates with proxy B port;

[0033] 2. Data running in the proxy of the gateway server for SNI value processing: The proxy running in the gateway server sets the SNI value corresponding to the port according to the port, and sets the data received by B port as SNI_value_A;

[0034] 3. Data from the gateway server -> initiating institution firewall: The proxy running in the gateway server serially sends the data with SNI value to the firewall;

[0035] 4. Data from the initiating institution firewall -> receiving institution firewall: The firewall of institution A sends the data outbound to the communication port used by the business of institution B;

[0036] 5. Data from the receiving institution firewall -> receiving party intranet gateway server: The firewall of institution B sends the data to the gateway server;

[0037] 6. SNI value analysis of data running in the proxy of the gateway server: The proxy running in the gateway server analyzes the SNI value in the data, and according to the configuration in step 4, sends the data to the corresponding communication port. If the SNI value is SNI_valueA, it is forwarded to communication port A;

[0038] 7. Data from the gateway server -> corresponding MPC task receiving device: The device initiating Task1 in institution B receives the data of Task1 in institution A, and the device initiating Task2 receives the data of Task2 in institution A.

[0039] Note: 1. The communication is bidirectional, and the MPC execution party is both the sender and the receiver;​

[0040] 2、Different MPC tasks, SNIvalue is different;

[0041] 3、proxy is a self-developed software that can replace SNI in TLS traffic

[0042] The value of the field, and complete the TLS traffic forwarding according to the configuration;

[0043] 4、Although the scheme is described in the scenario of two MPC tasks in parallel, this scheme can be extended to the scenario of multiple MPC tasks in parallel, as long as the SNI field value and port configured for each MPC task do not conflict with other MPC tasks;

[0044] And the process of setting SNIvalue by both parties, as Figure 2 shown:

[0045] 1、Two-way communication through the firewall and gateway server of both parties, proxy running on the gateway server performs forwarding mechanism A's MPCTask1 and MPCTask2 simultaneously initiate communication to mechanism B, mechanism A's MPCTask1 wants to establish a TLS connection with mechanism B's MPCTask1, at this time mechanism A's MPCTask1 does not know how to connect mechanism B;

[0046] 2、Request from a computer cluster performing MPC tasks from one party -> sender SNIGenerator: mechanism A's MPCTask1 sends a request to mechanism A's SNIGenerator, hoping to obtain the SNI used for communication with mechanism B's MPCTask1;

[0047] 3、Request from sender's SNIGenerator-> receiver's SNIGenerator: mechanism A's SNIGenerator sends a request to mechanism B's SNIGenerator, hoping to obtain the SNI used for communication with mechanism B's MPCTask1;

[0048] 4、Mechanism B's SNIGenerator interacts with mechanism B's MPCTask1, MPCTask1 generates a new SNI (SNI_A) and sends it to SNIGenerator, and tells itself to listen to the communication port A;

[0049] 5、Mechanism B's SNIGenerator issues a configuration to proxy, if it receives TLS traffic containing SNI as SNI_A, it will forward the traffic to the communication port A listened by MPCTask1;

[0050] 6、SNIGenerator of organization B sends the value of new SNI (SNI_A) to SNIGenerator of organization A;

[0051] 7、SNIGenerator of organization A receives the value of new SNI (SNI_A) and then sends configuration to proxy, the configuration content is: set SNI_A when forwarding the TLS traffic from port B;

[0052] 8、SNIGenerator of organization A replies to MPC Task 1 and connects the B port of proxy if it wants to connect the MPC Task 1 of organization B;

[0053] In the dynamic SNI value setting scheme, the value of SNI can be dynamically generated instead of being configured in advance. The method for generating new SNI includes:

[0054] 3. MPC Task uses a cryptographically secure pseudo-random number generator to generate two random numbers, one as an AES encryption key (referred to as key A), and the other as a seed for generating other random numbers (referred to as seed A). When generating SNI, first generate a random number using seed A, and then combine the random number with the TaskID of the MPC Task, and use key A to perform AES encryption. The AES encryption result is used as the value of the new SNI;

[0055] 4. MPC Task sets the value of SNI as taskid and a self-generating counter. Each time a new SNI value is generated, the counter is incremented by one;

[0056] The following takes the parallel execution of Task1 and Task2 of organization A and organization B as an example to illustrate:

[0057] 1. The computer of organization A executing Task1 communicates with gateway server 8000 port, and the computer of organization A executing Task2 communicates with gateway server 9000 port, and proxy listens to 8000 and 9000 ports;

[0058] 2. Gateway server runs proxy to set the corresponding SNIvalue according to the port, and sets the data received by 8000 port as SNIvalue_1 and the data received by 9000 port as SNIvalue_2; 3. The proxy running in the gateway server serially sends the data with SNIvalue to the firewall; 4. The firewall of organization A sends the data out to the communication port used by the business of organization B;

[0059] 5. The firewall of organization B sends the data to the gateway server;

[0060] 6、Gateway server runs proxy analysis data in the SNI value, the data is sent to the corresponding MPC task, analysis value_1 corresponding to Task1, value_2 corresponding to Task2;

[0061] 7、Institution B in the device to initiate Task1 received in the Task1 data, Task2 in the device to initiate Task2 received in the Task2 data.

Claims

1. A multi-task parallel communication method based on TLS SNI field distribution, characterized in that: Two institutions, institution A and institution B, are set as operation parties to perform multiple MPC tasks in parallel, and a communication protocol based on TLS SNI field splitting is applied to the communication between the two institutions. Specifically, the communication method is implemented through eight steps: Step one, the institution A and institution B are two parties of communication, and a communication network is formed by a firewall, a gateway server, and a proxy running on the gateway server. The proxy running on the gateway server forwards multiple MPC tasks of the institution A to the institution B simultaneously, and the two parties dynamically set SNIvalue; Step two, data is sent from a computer cluster of one party performing MPC tasks to the sending party's intranet gateway server. The device initiating MPC communicates with the gateway server through a specific port via the TLS protocol, and these ports are all monitored by the proxy for receiving intranet traffic; Step three, the data is processed by the proxy running in the gateway server: the proxy running in the gateway server sets the SNIvalue corresponding to the port according to the port. The data received by the A port is set as SNIvalue_1, and the data received by the B port is set as SNIvalue_2; Step four, the data is sent from the gateway server to the initiating institution firewall, wherein the proxy running in the gateway server serially sends the data with the set SNIvalue to the firewall; Step five, the data is sent from the initiating institution firewall to the receiving institution firewall; Step six, the data is sent from the receiving institution firewall to the receiving party's intranet gateway server; Step seven, the data is analyzed by the proxy running in the receiving party's gateway server, and the SNIvalue in the data is analyzed to send the data to the corresponding MPC task; Step eight, the data is sent from the gateway server to the corresponding MPC task receiving device. The device initiating Task1 in the institution B receives the data of Task1 in the institution A, and the device initiating Task2 receives the data of Task2 in the institution A.

2. The parallel communication method based on TLS SNI field distribution of claim 1, wherein: The specific method of dynamically setting SNIvalue by the two parties is implemented through eight steps: Step one, the communication passes through the firewalls and gateway servers of the institution A and institution B, and the proxy running on the gateway server forwards the MPC task 1 and MPC task 2 of the institution A to the institution B simultaneously; The MPC task 1 of the institution A wants to establish a TLS connection with the MPC task 1 of the institution B. At this time, the MPC task 1 of the institution A does not know how to connect the institution B; Step two, the SNIGenerator in the sending party's intranet generates a request from a computer cluster of one party performing MPC tasks, i.e., the MPC task 1 of the institution A sends a request to the SNIGenerator of the institution A, hoping to obtain the SNI used for communication with the MPC task 1 of the institution B; Step three, request from the sender's SNIGenerator to the receiver's SNIGenerator: SNIGenerator of agency A sends a request to SNIGenerator of agency B, hoping to obtain SNI used by agency B's MPCTask1 for communication; Step four, SNIGenerator of agency B interacts with agency B's MPCTask1, and MPCTask1 generates a new SNI_A and tells itself to listen to communication port A; Step five, SNIGenerator of agency B issues a configuration to proxy, if the received TLS traffic contains SNI as SNI_A, forward the traffic to the communication port A listened by MPCTask1; Step six, SNIGenerator of agency B sends the value of new SNIA (SNI_A) to SNIGenerator of agency A; Step seven, after receiving, SNIGenerator of agency A issues a configuration to proxy, the configuration content: set SNI_A when forwarding the incoming TLS traffic from port B; Step eight, SNIGenerator of agency A replies to MPCTask1, if you want to connect to MPCTask1 of agency B, connect to the B port of proxy.

3. The method of claim 2, wherein the method comprises: In the dynamic SNI value setting scheme, the value of SNI is dynamically generated instead of being configured in advance. The method for generating a new SNI includes: MPCTask uses a cryptographically secure pseudo-random number generator to generate two random numbers, one as an AES encryption key A, and the other as a seed A for generating other random numbers. When generating SNI, first generate a random number using seed A, combine the random number with the TaskID of the MPCTask, and use key A to perform AES encryption. The AES encryption result is used as the value of the new SNI. MPCTask sets the value of SNI as taskid and a self-grown counter. Each time a new SNI value is generated, the counter is incremented by one.

Images