Communication method, system, apparatus, computer storage medium, and electronic device

Abstract

The application discloses a communication method, system, device, computer storage medium and electronic device, and the method comprises the following steps: after a load balancing device receives an HTTP request sent by a client, the load balancing device acquires a server certificate; the load balancing device verifies the security of the server certificate, forwards the request to the server after obtaining the verification result, receives an HTTP response returned by the server; in the case that the result indicates that the security of the server certificate is normal, the load balancing device sets the validity time of the TLS in the response to be less than or equal to the valid remaining time of the server certificate, and obtains a target HTTP response; in the case that the result indicates that the certificate is abnormal, the load balancing device deletes the protocol header in the response, and obtains a target response; in the case that the target response contains the protocol header, the load balancing device sends the target response to the client, and the application solves the problem that the TLS request fails due to the security abnormality of the server certificate in the related art.

Description

Technical Field

[0001] This application relates to the field of network communication, and more specifically, to a communication method, system, apparatus, computer storage medium, and electronic device. Background Technology

[0002] HTTP Strict Transport Security (HSTS) is a network security policy protocol proposed by the Internet Society of China (ISC). Websites that choose to use HSTS force browsers to use Hypertext Transfer Protocol (HTTPS) to communicate with them, reducing the risk of session hijacking. When a user visits a website using HSTS for the first time, the website's domain is added to the HSTS preload list because the response header contains the HSTS header. Subsequent visits will then force the browser to use HTTPS for all requests.

[0003] However, when a user accesses the server website for the first time through a browser, if there are security issues with the server certificate, such as an expired or revoked certificate, the initiated Hypertext Transfer Protocol (HTTP) request will fail. Because the server's response header will still include the Strict Transport Security (STS) header, the user's browser will still add the server website's domain name to the browser's preload list. The website will still need to use the HTTP request, thus preventing the user from accessing the website during the STS validity period until the certificate issue is resolved.

[0004] There is currently no effective solution to the problem of Strict Transport Security Protocol (STS) requests failing due to security anomalies in server certificates in related technologies. Summary of the Invention

[0005] This application provides a communication method, system, apparatus, computer storage medium, and electronic device to solve the problem in related technologies where strict transmission security protocol requests fail due to security anomalies in server certificates.

[0006] According to one aspect of this application, a communication method is provided. The method includes: after receiving a Hypertext Transfer Protocol (HTTP) request from a client, a load balancer obtains the server certificate of the server targeted by the HTTP request from the load balancer; verifies the security status of the server certificate, obtains a verification result, forwards the HTTP request to the server, and receives an HTTP response returned by the server, wherein the HTTP response includes a Strict Transport Security (STS) header; if the verification result indicates that the server certificate is secure, the STS validity period in the HTTP response is set to be less than or equal to the remaining validity period of the server certificate, resulting in a target HTTP response; if the verification result indicates that the server certificate is unsecured, the STS header in the HTTP response is deleted, resulting in another target HTTP response; if the target HTTP response includes a STS header, the target HTTP response is sent to the client, wherein upon receiving the target HTTP response, the client adds the server's domain name to the browser's preload list.

[0007] Optionally, the security status includes at least one of the following: the validity period of the server certificate, the certificate status, and the server's network security protocol handshake status. The security status of the server certificate is verified, and the verification results include: verifying the validity period of the server certificate to obtain a first verification result; verifying the certificate status of the server certificate to obtain a second verification result; verifying the server's network security protocol handshake status to obtain a third verification result; and obtaining a verification result based on the first verification result, the second verification result, and the third verification result.

[0008] Optionally, verifying the validity period of the server certificate to obtain a first verification result includes: obtaining the request time of the Hypertext Transfer Protocol request and determining whether the request time falls within the validity period of the server certificate; if the request time falls within the validity period of the server certificate, the first verification result is determined to be successful; if the request time does not fall within the validity period of the server certificate, the first verification result is determined to be unsuccessful.

[0009] Optionally, verifying the certificate status of the server certificate to obtain a second verification result includes: obtaining the online certificate status protocol of the server certificate, obtaining the information in the online certificate status protocol, and determining the certificate status of the server certificate based on the information in the online certificate status protocol; if the certificate status of the server certificate is normal, the second verification result is determined to be a successful verification; if the certificate status is revoked, the second verification result is determined to be a failed verification.

[0010] Optionally, the network security protocol handshake of the server is verified to obtain a third verification result, including: obtaining the key pattern and signature hash algorithm of the server certificate, wherein the signature hash algorithm includes a first-level security hash algorithm and a multi-level security hash algorithm; determining whether the key pattern is a preset key pattern to obtain a first sub-verification result, wherein the first sub-verification result is used to characterize whether the server certificate is secure. If the key pattern is a preset key pattern, the first sub-verification result is verification failure; if the key pattern is not a preset key pattern, the first sub-verification result is verification success; determining whether the signature hash algorithm is a first-level security hash algorithm to obtain a second sub-verification result, wherein the signature hash algorithm is a first-level security hash algorithm... In the case of a secure hash algorithm, the second sub-verification result is verification failure; if the signature hash algorithm is not a first-level secure hash algorithm, the second sub-verification result is verification success. The system receives target information from the client and determines the third sub-verification result based on this information. The third sub-verification result is verification failure if the target information indicates that the network security protocol connection and exchange has failed; it is verification success if the target information indicates that the network security protocol connection and exchange has succeeded. Based on the first, second, and third sub-verification results, the third verification result is obtained. The third verification result is considered successful if all three sub-verification results indicate successful verification.

[0011] Optionally, if the verification result indicates that the server certificate is in a normal security condition, setting the validity period of the Strict Transmission Security Protocol (STP) in the Hypertext Transfer Protocol (HTTP) response to be less than or equal to the remaining validity period of the server certificate to obtain the target HTTP response includes: detecting the relationship between the validity period of the STP and the remaining validity period of the server certificate; if the validity period of the STP is greater than the remaining validity period of the server certificate, setting the validity period of the STP to the remaining validity period of the server certificate to obtain the target HTTP response; if the validity period of the STP is less than or equal to the remaining validity period of the server certificate, determining the HTTP response as the target HTTP response.

[0012] According to another aspect of this application, a communication system is provided. The system includes: a client, configured to send a Hypertext Transfer Protocol (HTTP) request to a server via a load balancer, and further configured to, upon receiving a target HTTP response from the server forwarded by the load balancer, add the server's domain name to the browser's preload list via a browser, wherein the validity period of the Strict Transmission Security Protocol (STP) in the target HTTP response is set to be less than or equal to the remaining validity period of the server's server certificate; a load balancer, configured to verify the security status of the server's server certificate and forward the HTTP request initiated by the client to the server; upon receiving an HTTP response from the server, and if the verification result indicates that the server certificate's security status is normal, setting the validity period of the STP in the HTTP response to be less than or equal to the remaining validity period of the server certificate, obtaining the target HTTP response, and sending the target HTTP response to the client; and a server, configured to send a response to the load balancer upon receiving the target HTTP request sent by the load balancer.

[0013] According to another aspect of this application, a communication apparatus is provided. The apparatus includes: an acquisition unit, configured to, upon receiving a Hypertext Transfer Protocol (HTTP) request from a client via a load balancer, acquire a server certificate for the server targeted by the HTTP request; a verification unit, configured to verify the security status of the server certificate, obtain a verification result, forward the HTTP request to the server, and receive an HTTP response returned by the server, wherein the HTTP response includes a Strict Transport Security (STS) header; a setting unit, configured to, if the verification result indicates that the server certificate's security status is normal, set the STS validity period in the HTTP response to be less than or equal to the remaining validity period of the server certificate, thereby obtaining a target HTTP response; a deletion unit, configured to, if the verification result indicates that the server certificate's security status is abnormal, delete the STS header in the HTTP response, thereby obtaining a target HTTP response; and a sending unit, configured to, if the target HTTP response includes the STS header, send the target HTTP response to the client, wherein the client, upon receiving the target HTTP response, adds the server's domain name to the browser's preload list.

[0014] According to another aspect of the present invention, a computer storage medium is also provided for storing a program, wherein the program, when running, controls the device where the non-volatile storage medium is located to execute a communication method.

[0015] According to another aspect of the present invention, an electronic device is also provided, comprising a processor and a memory; the memory stores computer-readable instructions, and the processor is configured to execute the computer-readable instructions, wherein the computer-readable instructions execute a communication method when executed.

[0016] This application employs the following steps: After receiving a Hypertext Transfer Protocol (HTTP) request from a client, the load balancer retrieves the server certificate of the server targeted by the HTTP request from the load balancer; verifies the security status of the server certificate, obtains the verification result, and forwards the HTTP request to the server, receiving the HTTP response returned by the server, wherein the HTTP response includes a Strict Transport Security (SLS) header; if the verification result indicates that the server certificate's security status is normal, the validity period of the SLS header in the HTTP response is set to be less than or equal to the remaining validity period of the server certificate, thus obtaining the target HTTP response; if the verification result indicates that the server certificate's security status is abnormal, the HTTP request is deleted. The strict transport security header in the transport protocol response yields the target Hypertext Transfer Protocol (HTTP) response. If the target HTTP response includes the strict transport security header, it is sent to the client. Upon receiving the target HTTP response, the client adds the server's domain name to the browser's preload list. This resolves the issue of strict transport security request failures due to server certificate security anomalies in related technologies. By incorporating a load balancer, the device determines whether the strict transport security header can be returned to the browser. If so, it adds the header to the browser's strict transport security header preload list, thus preventing strict transport security request anomalies. Attached Figure Description

[0017] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0018] Figure 1 This is a schematic diagram of a communication system provided according to an embodiment of this application;

[0019] Figure 2 This is a flowchart of a communication method provided according to an embodiment of this application;

[0020] Figure 3 This is a schematic diagram of a communication device provided according to an embodiment of this application. Detailed Implementation

[0021] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0022] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0023] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0024] It should be noted that all information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) involved in this disclosure are information and data authorized by the user or fully authorized by all parties.

[0025] According to an embodiment of this application, a communication system is provided.

[0026] Figure 1 This is a schematic diagram of a communication system provided according to an embodiment of this application, such as... Figure 1 As shown, the system includes:

[0027] Client 101 is used to send a Hypertext Transfer Protocol (HTTP) request to server 103 through load balancer 102, and is also used to add the domain name of server 103 to the browser's preload list when receiving the target HTTP response from server 103 forwarded by load balancer 102, wherein the validity period of the strict transport security protocol in the target HTTP response is set to be less than or equal to the remaining validity period of the server certificate of server 103.

[0028] Specifically, client 101 communicates with load balancer 102. After client 101 sends a Hypertext Transfer Protocol request, it receives the response from server 103 forwarded by load balancer 102 and adds the domain name of server 103 to the browser's strict transfer protocol preload list.

[0029] Load balancer 102 is used to verify the security status of the server certificate of the server and forward the Hypertext Transfer Protocol (HTTP) request initiated by client 101 to server 103. After receiving the HTTP response from server 103, if the verification result indicates that the security status of the server certificate is normal, the valid time of the strict transmission security protocol in the HTTP response is set to be less than or equal to the remaining valid time of the server certificate, thus obtaining the target HTTP response, and the target HTTP response is sent to client 101.

[0030] Specifically, the load balancer 102 is communicatively connected to both the client 101 and the server 103. As an "intermediate device," it performs transmission while verifying the security of the server certificate. It then determines whether the strict transport security protocol header in the response header can be transmitted to the client 101. If all verification results are successful, the validity period of the strict transport security protocol in the request is set to be less than or equal to the expiration date of the server certificate. The strict transport security protocol header in the response header is then transmitted to the client 101, and the domain name of the server 103 is added to the strict transport security protocol preload list in the browser of the client 101. If one or more verification results fail, the strict transport security protocol header in the response header is deleted, and the deleted response is sent to the client 101.

[0031] Server 103 is configured to send a response to load balancer 102 upon receiving a target Hypertext Transfer Protocol request from load balancer 102.

[0032] Specifically, server 103 can receive Hypertext Transfer Protocol requests from load balancer 102 with modified strict transport security protocol validity periods, and return corresponding responses based on the requests.

[0033] The communication method provided in this application embodiment, through client 101, is used to send a Hypertext Transfer Protocol (HTTP) request to server 103 via load balancer 102. It is also used to, upon receiving a target HTTP response from server 103 forwarded by load balancer 102, add the domain name of server 103 to the browser's preload list. The effective time of the Strict Transmission Security Protocol (SSP) in the target HTTP response is set to be less than or equal to the remaining effective time of server certificate of server 103. Load balancer 102 is used to verify the security status of server certificate and forward the HTTP request initiated by client 101 to server 103. Upon receiving the HTTP response from server 103, it verifies the security status of the server certificate based on the verification result. Under normal circumstances, the validity period of the Strict Transmission Security Protocol (STP) in the Hypertext Transfer Protocol (HTTP) response is set to be less than or equal to the remaining validity period of the server certificate, thus obtaining the target HTTP response, which is then sent to client 101. Server 103, upon receiving a target HTTP request from load balancer 102, sends a response to load balancer 102. This solves the problem in related technologies where STP requests fail due to security anomalies in the server certificate. By adding a load balancer, the device determines whether the STP request can be returned to the browser. If the STP request is returned to the browser, it is added to the browser's STP preload list, thereby avoiding STP request anomalies.

[0034] According to an embodiment of this application, a communication method is provided.

[0035] Figure 2 This is a flowchart of a communication method provided according to an embodiment of this application, applied in the communication system of the above embodiments, such as... Figure 2 As shown, the method includes the following steps:

[0036] In step S202, after receiving the Hypertext Transfer Protocol (HTTP) request from the client, the load balancing device obtains the server certificate of the server to which the HTTP request is directed from the load balancing device. The HTTP response includes a strict transport security header.

[0037] Specifically, after the client sends a Hypertext Transfer Protocol request, also known as an HTTPS request, the load balancer that has established a communication connection with the client receives the request. Hypertext Transfer Protocol (HTTPS) is an application layer protocol that allows servers and browsers to send and receive data over the internet. HTTPS adds an extra layer of SSL (Secure Socket Layer) to HTTP, ensuring security during transmission through both encryption and authentication, making it more secure than HTTP.

[0038] Furthermore, the load balancer obtains the server's server certificate, which is in the form of an SSL certificate. This certificate can provide authentication for different sites and ensure that the site has high-strength encryption security. It contains detailed verification information, such as certificate version, unique authentication file serial number, signature algorithm, key, validity period, and user details. The security of the server certificate affects the security of communication access; therefore, it is necessary to verify the security of the server certificate.

[0039] Step S204: Verify the security status of the server certificate, obtain the verification result, forward the Hypertext Transfer Protocol (HTTP) request to the server, and receive the HTTP response returned by the server, wherein the HTTP response includes a strict transport security protocol header.

[0040] Load balancing devices verify the security of server certificates to determine whether the strict transport protocol headers included in the response headers returned by the server to the client need to be removed. In other words, after obtaining the server certificate, in order to verify whether the server certificate is abnormal, the three security conditions of the server certificate can be verified separately to obtain the verification results, namely, verifying the validity period of the server certificate, the certificate status, and the handshake status of the server certificate.

[0041] Furthermore, after obtaining the verification result, the Hypertext Transfer Protocol request is forwarded to the server side, which is connected to the load balancer, and then the Hypertext Transfer Protocol response transmitted by the server is received.

[0042] Step S206: If the verification result indicates that the security status of the server certificate is normal, set the validity period of the strict transmission security protocol in the Hypertext Transfer Protocol response to be less than or equal to the remaining validity period of the server certificate, and send a first request to the server to receive the target Hypertext Transfer Protocol response sent by the server.

[0043] Specifically, the target Hypertext Transfer Protocol (HTTP) response, also known as the modified HTTP response, checks whether the validity period of the strict transfer protocol header in the response returned by the server to the client exceeds the remaining validity period of the server certificate. If it does, the validity period of the strict transfer protocol header needs to be set to be less than or equal to the remaining validity period of the server certificate, resulting in the modified strict transfer protocol. The strict transfer protocol header in the response returned by the server to the client is then replaced accordingly. The response is then sent from the device to the server, allowing the user to successfully access the website within the validity period of the strict transfer protocol.

[0044] Step S208: If the verification result indicates that the security status of the server certificate is abnormal, delete the Strict Transport Security header in the Hypertext Transfer Protocol (HTTP) response, send a second request to the server, and receive the target HTTP response sent by the server.

[0045] Specifically, when the verification result obtained after verifying the server certificate shows that the certificate's security status is abnormal, the strict transport security header in the Hypertext Transfer Protocol (HTTP) response is removed, and a receive request needs to be sent to the server to obtain the target HTTP response.

[0046] Step S210: If the target Hypertext Transfer Protocol (HTTP) response contains a strict transport security header, the target HTTP response is sent to the client. Upon receiving the target HTTP response, the client adds the server's domain name to the browser's preload list.

[0047] Specifically, after receiving the response from the load balancer, the client checks if the response contains a Strict Transport Security (SHS) header. If it does, the client adds the domain name of the server that sent the response to the SHS preload list. When the browser sends another request to the server, without specifying https: / / , it directly sends an HTTPS request to the load balancer.

[0048] The communication method provided in this application embodiment involves a load balancer receiving a Hypertext Transfer Protocol (HTTP) request from a client, retrieving the server certificate of the server targeted by the HTTP request from the load balancer, verifying the security of the server certificate, obtaining a verification result, forwarding the HTTP request to the server, and receiving an HTTP response from the server. The HTTP response includes a Strict Transport Security (STS) header. If the verification result indicates that the server certificate is secure, the STS header in the HTTP response is set to be less than or equal to the remaining validity period of the server certificate, resulting in a target HTTP response. If the verification result indicates that the server certificate is unsecured, the HTTP request is deleted. The strict transport security header in the HFTP response is used to obtain the target HFTP response. If the target HFTP response contains the strict transport security header, the target HFTP response is sent to the client. Upon receiving the target HFTP response, the client adds the server's domain name to the browser's preload list. This solves the problem of strict transport security request failure caused by server certificate security anomalies in related technologies. By adding a load balancer, the device determines whether the strict transport security header can be returned to the browser. If it is, it is added to the browser's strict transport security header preload list, thus avoiding strict transport security request anomalies.

[0049] Optionally, in the communication method provided in this application embodiment, the security situation includes at least one of the following: the validity period of the server certificate, the certificate status, and the network security protocol handshake status of the server. The security situation of the server certificate is verified to obtain the verification result, which includes: verifying the validity period of the server certificate to obtain a first verification result; verifying the certificate status of the server certificate to obtain a second verification result; verifying the network security protocol handshake status of the server to obtain a third verification result; and obtaining a verification result based on the first verification result, the second verification result, and the third verification result.

[0050] The validity period of a server certificate refers to the time span including both a valid start date and a valid end date. Since server certificates encompass both data encryption and authentication functions, an excessively long validity period cannot guarantee secure data exchange between websites. Therefore, it's crucial to periodically verify the website's updated identity information to ensure its authenticity and security, and to prevent data leaks due to expiration. Thus, to assess the security of a server certificate, its validity period must be verified to obtain the initial verification result.

[0051] Among these features, the Online Certificate Status Protocol (OCS) can improve website access speed. When it is necessary to check the OCS, the relevant status information obtained from the server certificate needs to be queried from an online certificate status query website. The certificate status can include two states: normal and revoked. This information is used to determine the certificate status and obtain a second verification result.

[0052] Among them, the server's network security protocol handshake refers to the process of establishing a secure connection and exchanging parameters before communication. The transmission between the server and the client must go through a handshake process to complete identity authentication and key exchange to establish a secure connection. Therefore, the security status of the server certificate also includes verifying whether the client fails to check the server certificate, and then obtaining a third verification result.

[0053] After verifying the three cases separately and obtaining the first verification result, the second verification result, and the third verification result, perform an AND operation to obtain the final verification result.

[0054] Optionally, in the communication method provided in this application embodiment, verifying the validity period of the server certificate to obtain a first verification result includes: obtaining the request time point of the Hypertext Transfer Protocol request and determining whether the request time point falls within the validity period of the server certificate; if the request time point falls within the validity period of the server certificate, the first verification result is determined to be successful; if the request time point does not fall within the validity period of the server certificate, the first verification result is determined to be unsuccessful.

[0055] Specifically, after obtaining the time of the Hypertext Transfer Protocol (HTTP) request, the system determines whether this time falls within the validity period of the server certificate. That is, the load balancer compares the obtained time with both the effective start and end dates of the server certificate. If the request time is less than the effective start date of the server certificate, the server certificate is not yet valid; if the request time is greater than the effective end date of the server certificate, the server certificate has expired, and the first verification result is a verification failure. If the time falls between the effective start and end dates of the server certificate, the server certificate is valid when the request is sent, and the first verification result is a successful verification.

[0056] Optionally, in the communication method provided in this application embodiment, verifying the certificate status of the server certificate to obtain a second verification result includes: obtaining the online certificate status protocol of the server certificate, obtaining the information in the online certificate status protocol, and determining the certificate status of the server certificate based on the information in the online certificate status protocol; if the certificate status of the server certificate is normal, determining the second verification result as verification successful; if the certificate status is revoked, determining the second verification result as verification failed.

[0057] Specifically, after obtaining the server certificate, it is necessary to identify and extract the authentication file related to the certificate status, i.e., the certificate serial number. This serial number is then entered into an online certificate status query website to check the certificate status. When the query result shows the certificate status as "normal," it means the second verification result is successful; when the query result shows the certificate status as "revoked," the second verification result is unsuccessful.

[0058] Optionally, in the communication method provided in this application embodiment, verifying the network security protocol handshake of the server to obtain a third verification result includes: obtaining the key mode and signature hash algorithm of the server certificate, wherein the signature hash algorithm includes a first-level security hash algorithm and a multi-level security hash algorithm; determining whether the key mode is a preset key mode to obtain a first sub-verification result, wherein the first sub-verification result is used to characterize whether the server certificate is secure; if the key mode belongs to the preset key mode, the first sub-verification result is verification failure; if the key mode does not belong to the preset key mode, the first sub-verification result is verification success; determining whether the signature hash algorithm belongs to a first-level security hash algorithm to obtain a second sub-verification result, wherein the signature hash algorithm... If the hash algorithm is a Level 1 secure hash algorithm, the second sub-verification result is verification failure; if the signature hash algorithm is not a Level 1 secure hash algorithm, the second sub-verification result is verification success. The system receives target information from the client and determines the third sub-verification result based on this information. The third sub-verification result is verification failure if the target information indicates that the network security protocol connection and exchange has failed, and verification success if the target information indicates that the network security protocol connection and exchange has succeeded. Based on the first, second, and third sub-verification results, the third verification result is obtained. The third verification result is considered successful if all three sub-verification results indicate successful verification.

[0059] It should be noted that the third verification result includes the first sub-verification result, the second sub-verification result, and the third sub-verification result. The third verification result is obtained by performing an AND operation on the three sub-verification results. That is, the third verification is successful when all three sub-verification results are successful.

[0060] The first sub-verification result verifies the key mode of the server certificate. Specifically, it obtains the key mode of the server certificate, which can include multiple modes such as 512 mode, 1024 mode, and 2048 mode. When the key mode of the server certificate belongs to the preset key mode, that is, the key mode is 512 mode, the first sub-verification result is verification failure. When the key mode does not belong to the preset key mode, that is, when the key mode is any other key mode besides 512 mode, the first sub-verification result is verification success.

[0061] The second sub-verification result verifies the signature algorithm of the server certificate. Specifically, it obtains the hash algorithm of the server certificate signature. The hash algorithm for the signature includes a first-level security hash algorithm (SHA-1) and a multi-level security hash algorithm (e.g., SHA-256). It determines whether the hash algorithm of the server certificate signature belongs to the first-level security hash algorithm. If the hash algorithm of the signature belongs to the first-level security hash algorithm, the second sub-verification result is verification failure; if the hash algorithm of the signature does not belong to the first-level security hash algorithm, the second sub-verification result is verification success.

[0062] The third sub-verification result verifies whether the client successfully verified the server certificate, that is, whether the handshake was successful. Specifically, the load balancer receives information about the SSL certificate handshake from the client and determines the third sub-verification result based on this information. If the information indicates that the client and server have not completed authentication and key exchange, i.e., the SSL certificate handshake has failed, the third sub-verification result is verification failure; if the information indicates that the client and server have completed authentication and key exchange, i.e., the SSL certificate handshake has succeeded, the third sub-verification result is verification success.

[0063] Optionally, in the communication method provided in this application embodiment, when the verification result indicates that the security status of the server certificate is normal, setting the validity period of the Strict Transmission Security Protocol (STP) in the Hypertext Transfer Protocol (HTTP) response to be less than or equal to the remaining validity period of the server certificate to obtain the target HTTP response includes: detecting the relationship between the validity period of the STP and the remaining validity period of the server certificate; if the validity period of the STP is greater than the remaining validity period of the server certificate, setting the validity period of the STP to the remaining validity period of the server certificate to obtain the target HTTP response; if the validity period of the STP is less than or equal to the remaining validity period of the server certificate, determining the HTTP response as the target HTTP response.

[0064] Specifically, based on the verification results calculated from the first, second, and third verification results, different operations are performed on the response returned by the server received by the load balancer. When all three verification results indicate successful verification, the relationship between the effective expiration time of the Strict Transmission Security Protocol (STP) in the returned response header and the remaining validity period of the server certificate needs to be checked. If the effective expiration time of the STP is greater than the remaining validity period (i.e., greater than the server certificate's expiration date), the effective expiration time of the STP is set to the server certificate's expiration date. This ensures that users cannot continue to access the website after the server certificate expires; conversely, if the effective expiration time of the STP is less than or equal to the expiration date, no processing is performed on the protocol time. Finally, the updated STP is added to the response header.

[0065] It should be noted that if one or more of the first, second, and third verification results are verification failures, the load balancing device needs to remove the Strict Transport Security header from the response header returned by the server and send the removed response to the client.

[0066] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0067] This application also provides a communication device. It should be noted that the communication device of this application can be used to execute the communication method provided in this application. The communication device provided in this application is described below.

[0068] Figure 3 This is a schematic diagram of a communication device provided according to an embodiment of this application, such as... Figure 3 As shown, the device includes: an acquisition unit 30, a verification unit 31, a setting unit 32, a deletion unit 33, and a sending unit 34.

[0069] The acquisition unit 30 is used to obtain the server certificate of the server to which the Hypertext Transfer Protocol request is targeted from the load balancer after receiving the Hypertext Transfer Protocol request sent by the client.

[0070] Verification unit 31 is used to verify the security status of the server certificate, obtain the verification result, forward the Hypertext Transfer Protocol request to the server, and receive the Hypertext Transfer Protocol response returned by the server, wherein the Hypertext Transfer Protocol response includes a strict transport security protocol header.

[0071] Setting unit 32 is used to set the validity period of the strict transmission security protocol in the Hypertext Transfer Protocol response to be less than or equal to the remaining validity period of the server certificate when the verification result indicates that the security status of the server certificate is normal, and to send a first request to the server and receive the target Hypertext Transfer Protocol response sent by the server.

[0072] Deletion unit 33 is used to delete the Strict Transport Security header in the Hypertext Transfer Protocol response when the verification result indicates that the security status of the server certificate is abnormal, and to send a second request to the server and receive the target Hypertext Transfer Protocol response sent by the server.

[0073] Sending unit 34 is used to send the target Hypertext Transfer Protocol response to the client if the target Hypertext Transfer Protocol response contains a strict transport security protocol header, wherein the client adds the server's domain name to the browser's preload list upon receiving the target Hypertext Transfer Protocol response.

[0074] Optionally, in the communication device provided in this application embodiment, the verification unit 31 includes: a first verification module, used to verify the validity period of the server certificate and obtain a first verification result; a second verification module, used to verify the certificate status of the server certificate and obtain a second verification result; a third verification module, used to verify the network security protocol handshake status of the server and obtain a third verification result; and a obtaining module, used to obtain a verification result based on the first verification result, the second verification result, and the third verification result.

[0075] Optionally, in the communication device provided in this application embodiment, the verification unit 31 includes: a first acquisition module, used to acquire the request time point of the Hypertext Transfer Protocol request and determine whether the request time point falls within the valid period of the server certificate; and a first determination module, used to determine that the first verification result is successful if the request time point falls within the valid period of the server certificate, and to determine that the first verification result is unsuccessful if the request time point does not fall within the valid period of the server certificate.

[0076] Optionally, in the communication device provided in this application embodiment, the verification unit 31 includes: a second acquisition module, used to acquire the online certificate status protocol of the server certificate, acquire information in the online certificate status protocol, and determine the certificate status of the server certificate based on the information in the online certificate status protocol; and a second determination module, used to determine that the second verification result indicates successful verification when the certificate status of the server certificate is displayed as normal, and to determine that the second verification result indicates failed verification when the certificate status is displayed as revoked.

[0077] Optionally, in the communication device provided in this application embodiment, the verification unit 31 includes: a third acquisition module, used to acquire the key mode and signature hash algorithm of the server certificate, wherein the signature hash algorithm includes a first-level security hash algorithm and a multi-level security hash algorithm; a first judgment module, used to determine whether the key mode is a preset key mode and obtain a first sub-verification result, wherein the first sub-verification result is used to characterize whether the server certificate is secure, and if the key mode belongs to the preset key mode, the first sub-verification result is verification failure, and if the key mode does not belong to the preset key mode, the first sub-verification result is verification success; and a second judgment module, used to determine whether the signature hash algorithm belongs to a first-level security hash algorithm and obtain a second sub-verification result, wherein if the signature hash algorithm belongs to a first-level security hash algorithm, the first sub-verification result is verification failure. In the case of a high-strength secure hash algorithm, the second sub-verification result is verification failure; if the signature hash algorithm is not a high-strength secure hash algorithm, the second sub-verification result is verification success. The receiving module receives the target information fed back by the client and determines the third sub-verification result based on the target information. Specifically, if the target information indicates that the connection and exchange of the network security protocol has failed, the third sub-verification result is verification failure; if the target information indicates that the connection and exchange of the network security protocol has succeeded, the third sub-verification result is verification success. The obtaining module obtains the third verification result based on the first, second, and third sub-verification results. If all three sub-verification results show verification success, the third verification result is considered successful.

[0078] Optionally, in the communication device provided in this application embodiment, the setting unit 32 includes: a detection module, used to detect the relationship between the validity period of the Strict Transmission Security Protocol (STP) and the remaining validity period of the server certificate; a first setting module, used to set the validity period of the STP to the remaining validity period of the server certificate when the validity period of the STP is greater than the remaining validity period of the server certificate, thereby obtaining a target Hypertext Transfer Protocol (HTTP) response; and a second setting module, used to determine the HTTP response as the target HTTP response when the validity period of the STP is less than or equal to the remaining validity period of the server certificate.

[0079] The communication device provided in this application embodiment, through the acquisition unit 30, obtains the server certificate of the server targeted by the Hypertext Transfer Protocol (HTTP) request from the load balancing device after receiving the HTTP request from the client; the verification unit 31 verifies the security status of the server certificate, obtains the verification result, forwards the HTTP request to the server, and receives the HTTP response returned by the server, wherein the HTTP response includes a Strict Transport Security (STS) header; the setting unit 32, when the verification result indicates that the security status of the server certificate is normal, sets the validity period of the STS header in the HTTP response to be less than or equal to the remaining validity period of the server certificate, thereby obtaining the target HTTP response; the deletion unit 33, when the verification result indicates that the security status of the server certificate is abnormal, deletes the HTTP response. The system removes the Strict Transport Security (STS) header from the Hypertext Transfer Protocol (HTTP) response to obtain the target HTTP response. If the target HTTP response contains the STS header, the sending unit 34 sends the target HTTP response to the client. Upon receiving the target HTTP response, the client adds the server's domain name to the browser's preload list. This solves the problem in related technologies where STS requests fail due to security anomalies in the server certificate. By adding a load balancer, the device determines whether the STS request can be returned to the browser. If it is, the STS request is added to the browser's STS preload list, thus avoiding STS request anomalies.

[0080] The aforementioned communication device includes a processor and a memory. The aforementioned acquisition unit 30, verification unit 31, setting unit 32, deletion unit 33, and sending unit 34 are all stored in the memory as program units. The processor executes the aforementioned program units stored in the memory to realize the corresponding functions.

[0081] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and adjusting kernel parameters can resolve issues in related technologies where security anomalies in server certificates cause strict transport security protocol requests to fail.

[0082] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0083] This application also provides a computer storage medium for storing a program, wherein the program, when running, controls the device where the non-volatile storage medium is located to execute a communication method.

[0084] This application also provides an electronic device comprising a processor and a memory; the memory stores computer-readable instructions, and the processor executes the computer-readable instructions, wherein the computer-readable instructions, when executed, perform a communication method. The electronic device described herein may be a server, PC, PAD, mobile phone, etc.

[0085] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0086] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0087] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0088] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0089] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0090] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0091] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0092] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0093] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A communication method, characterized in that, include: After receiving a Hypertext Transfer Protocol (HTTP) request from a client, the load balancer obtains the server certificate of the server to which the HTTP request is directed from the load balancer. The security status of the server certificate is verified, the verification result is obtained, and the Hypertext Transfer Protocol request is forwarded to the server. The Hypertext Transfer Protocol response returned by the server is received, wherein the Hypertext Transfer Protocol response includes a strict transport security header. The security status includes at least one of the following: the validity period of the server certificate, the certificate status, and the network security protocol handshake status of the server; verifying the security status of the server certificate to obtain a verification result includes: verifying the validity period of the server certificate to obtain a first verification result; verifying the certificate status of the server certificate to obtain a second verification result; verifying the network security protocol handshake status of the server to obtain a third verification result; and obtaining the verification result based on the first verification result, the second verification result, and the third verification result. If the verification result indicates that the security status of the server certificate is normal, the validity period of the strict transport security protocol in the hypertext transfer protocol response is set to be less than or equal to the remaining validity period of the server certificate, thus obtaining the target hypertext transfer protocol response. If the verification result indicates that the security status of the server certificate is abnormal, the strict transport security header in the hypertext transfer protocol response is deleted to obtain the target hypertext transfer protocol response. If the target HMRC response includes the Strict Transport Security header, the target HMRC response is sent to the client, wherein the client, upon receiving the target HMRC response, adds the server's domain name to the browser's preload list.

2. The method according to claim 1, characterized in that, The validity period of the server certificate is verified, and the first verification result includes: Obtain the request time of the Hypertext Transfer Protocol request and determine whether the request time falls within the validity period of the server certificate; If the request time falls within the validity period of the server certificate, the first verification result is determined to be successful; if the request time does not fall within the validity period of the server certificate, the first verification result is determined to be unsuccessful.

3. The method according to claim 1, characterized in that, The certificate status of the server certificate is verified to obtain a second verification result, including: Obtain the online certificate status protocol of the server certificate, obtain the information in the online certificate status protocol, and determine the certificate status of the server certificate based on the information in the online certificate status protocol; If the certificate status of the server certificate is normal, the second verification result is determined to be a successful verification; if the certificate status is revoked, the second verification result is determined to be a failed verification.

4. The method according to claim 1, characterized in that, The network security protocol handshake of the server is verified, and the third verification result includes: Obtain the key mode and signature hash algorithm of the server certificate, wherein the signature hash algorithm includes a first-level security hash algorithm and a multi-level security hash algorithm, the first-level security hash algorithm is the SHA-1 algorithm, and the multi-level security hash algorithm is the SHA-256 algorithm; Determine whether the key mode is a preset key mode to obtain a first sub-verification result, wherein the preset key mode is 512 mode. The first sub-verification result is used to characterize whether the server certificate is secure. If the key mode belongs to the preset key mode, the first sub-verification result is verification failure; if the key mode does not belong to the preset key mode, the first sub-verification result is verification success. Determine whether the signature hash algorithm belongs to the first-level security hash algorithm to obtain a second sub-verification result. If the signature hash algorithm belongs to the first-level security hash algorithm, the second sub-verification result is a verification failure. If the signature hash algorithm does not belong to the first-level security hash algorithm, the second sub-verification result is a verification success. The system receives target information fed back by the client and determines a third sub-verification result based on the target information. The third sub-verification result is a verification failure when the target information indicates that the connection and exchange of the network security protocol has failed, and a verification success when the target information indicates that the connection and exchange of the network security protocol has succeeded. The third verification result is obtained based on the first sub-verification result, the second sub-verification result, and the third sub-verification result. The third verification result is considered successful if the first sub-verification result, the second sub-verification result, and the third sub-verification result all show successful verification.

5. The method according to claim 1, characterized in that, If the verification result indicates that the server certificate is secure, the validity period of the Strict Transport Security Protocol (SLP) in the Hypertext Transfer Protocol (HTTP) response is set to be less than or equal to the remaining validity period of the server certificate. The resulting target HTTP response includes: Detect the relationship between the validity period of the strict transmission security protocol and the remaining validity period of the server certificate; If the validity period of the strict transport security protocol is greater than the remaining validity period of the server certificate, then the validity period of the strict transport security protocol is set to the remaining validity period of the server certificate, and the target hypertext transfer protocol response is obtained. If the validity period of the strict transport security protocol is less than or equal to the remaining validity period of the server certificate, the Hypertext Transfer Protocol response is determined to be the target Hypertext Transfer Protocol response.

6. A communication system, characterized in that, include: The client is used to send a Hypertext Transfer Protocol (HTTP) request to the server through a load balancer, and is also used to add the server's domain name to the browser's preload list when it receives the target HTTP response from the server forwarded by the load balancer, wherein the validity period of the Strict Transmission Security Protocol (STP) in the target HTTP response is set to be less than or equal to the remaining validity period of the server's server certificate. The load balancing device is used to verify the security status of the server certificate of the server and forward the Hypertext Transfer Protocol (HTTP) request initiated by the client to the server. After receiving the HTTP response from the server, if the verification result indicates that the security status of the server certificate is normal, the device sets the validity period of the Strict Transmission Security Protocol (STP) in the HTTP response to be less than or equal to the remaining validity period of the server certificate, thereby obtaining the target HTTP response, and sends the target HTTP response to the client. The security status includes at least one of the following: the validity period of the server certificate, the certificate status, and the network security protocol handshake status of the server. Verification of the security status of the server certificate includes: verifying the validity period of the server certificate to obtain a first verification result; verifying the certificate status of the server certificate to obtain a second verification result; verifying the network security protocol handshake status of the server to obtain a third verification result; and obtaining the verification result based on the first verification result, the second verification result, and the third verification result. The server is configured to send a response to the load balancing device upon receiving the target Hypertext Transfer Protocol request from the load balancing device.

7. A communication device, characterized in that, include: The acquisition unit is used to obtain the server certificate of the server to which the Hypertext Transfer Protocol request is targeted from the load balancing device after receiving the Hypertext Transfer Protocol request sent by the client. The verification unit is used to verify the security status of the server certificate, obtain the verification result, forward the Hypertext Transfer Protocol request to the server, and receive the Hypertext Transfer Protocol response returned by the server, wherein the Hypertext Transfer Protocol response includes a strict transport security protocol header. The security conditions include at least one of the following: the validity period of the server certificate, the certificate status, and the network security protocol handshake status of the server; the verification unit includes: a first verification module for verifying the validity period of the server certificate to obtain a first verification result; a second verification module for verifying the certificate status of the server certificate to obtain a second verification result; a third verification module for verifying the network security protocol handshake status of the server to obtain a third verification result; and a obtaining module for obtaining the verification result based on the first verification result, the second verification result, and the third verification result. The setting unit is configured to, when the verification result indicates that the security status of the server certificate is normal, set the validity period of the strict transport security protocol in the hypertext transfer protocol response to be less than or equal to the remaining validity period of the server certificate, thereby obtaining the target hypertext transfer protocol response. The deletion unit is used to delete the Strict Transport Security Protocol header in the Hypertext Transfer Protocol response when the verification result indicates that the security status of the server certificate is abnormal, so as to obtain the target Hypertext Transfer Protocol response. The sending unit is configured to send the target Hypertext Transfer Protocol response to the client if the target Hypertext Transfer Protocol response includes the Strict Transport Security header, wherein the client, upon receiving the target Hypertext Transfer Protocol response, adds the domain name of the server to the browser's preload list.

8. A computer storage medium, characterized in that, The computer storage medium is used to store a program, wherein the program, when running, controls the device where the computer storage medium is located to execute the communication method according to any one of claims 1 to 5.

9. An electronic device, characterized in that, The device includes a processor and a memory, the memory storing computer-readable instructions, and the processor being configured to execute the computer-readable instructions, wherein the computer-readable instructions, when executed, perform the communication method according to any one of claims 1 to 5.

Images