Connection establishment method based on quic protocol

Abstract

The disclosure discloses a connection establishment method based on a QUIC protocol. The method comprises: determining that a current connection is a first connection, then sending a client initialization data packet to a server and receiving a server feedback initialization data packet of the server to complete address verification and key exchange; wherein the client initialization data packet and the server initialization data packet are encrypted and protected based on an initialization key and an international algorithm; in response to the server feedback initialization data packet, a client handshake data packet is sent to the server to complete a handshake and establish a connection; wherein the initialization data packet contains encryption type information, and the encryption type information is used to indicate the national encryption algorithm adopted by the encryption protection. Through the above method, the application of the national encryption algorithm in the QUIC protocol can be realized, and the application range of the QUIC protocol is expanded.

Description

Technical Field

[0001] This disclosure generally relates to the field of data communication technology. More specifically, this disclosure relates to a connection establishment method based on the QUIC protocol. Background Technology

[0002] The TCP / IP protocol suite is the foundation of internet communication. The transport layer protocols include TCP and UDP. TCP is a connection-oriented, reliable, byte-stream-based transport layer communication protocol. It requires a three-way handshake to establish a connection and a four-way handshake to close the connection. It also uses timeout retransmission and acknowledgment mechanisms to ensure data integrity. UDP, on the other hand, is a connectionless transport layer protocol designed for lightweight operation. Because it does not require acknowledgments from the other end or the establishment of a connection, it is very fast but has poor data reliability.

[0003] To address the various needs of the transport and application layers, including handling more connections, improving security, and reducing latency, existing technologies offer a QUIC protocol. When a client first connects to a server, it only needs one round-trip time (RTT) to establish a reliable and secure connection, and in certain cases, a connection can even be established with zero RTT. This is faster than the 1 to 3 RTTs required by TCP+TLS, and more reliable than UDP connections.

[0004] However, current industry standards only explain how to implement the QUIC protocol using international algorithms, while the commercial cryptographic algorithms commonly used in my country are national cryptographic algorithms. The QUIC protocol, which is based on international algorithms, has a very low degree of national cryptographic sophistication, making it difficult to achieve widespread application.

[0005] In view of this, there is an urgent need to provide a connection establishment scheme based on the QUIC protocol, so as to realize the application of Chinese cryptographic algorithms in the QUIC protocol and thus expand the application scope of the QUIC protocol. Summary of the Invention

[0006] In order to at least address one or more of the technical issues mentioned above, this disclosure proposes a connection establishment scheme based on the QUIC protocol in several aspects.

[0007] In a first aspect, this disclosure provides a connection establishment method based on the QUIC protocol, comprising: determining that the current connection is the first connection, sending a client initialization data packet to the server and receiving a server initialization data packet fed back by the server to complete address verification and key exchange; wherein the client initialization data packet and the server initialization data packet are encrypted and protected based on an initialization key and an international algorithm, the initialization key being derived through a first HKDF function, the first HKDF function employing an international algorithm for hashing; responding to a server handshake data packet fed back by the server, sending a client handshake data packet to the server to complete the handshake and establish a connection; wherein the initialization data packet contains encryption type information, the encryption type information being used to indicate the national cryptographic algorithm used for encryption protection; the client handshake data packet and the server handshake data packet are encrypted and protected based on a handshake key and a national cryptographic algorithm, the handshake key being derived through a second HKDF function, the second HKDF function employing a national cryptographic algorithm for hashing; responding to communication requirements, encrypting and protecting a client 1-RTT data packet carrying application data based on a 1-RTT key and a national cryptographic algorithm, and then sending it to the server for communication.

[0008] In some embodiments, the address verification step includes: sending a client initialization data packet to the server and receiving a server retry data packet from the server; wherein the server retry data packet contains a token for address verification, and the server retry data packet is encrypted and protected based on a retry key and an international algorithm; sending a client retry data packet to the server and receiving a server initialization data packet from the server to complete the address verification; wherein the client retry data packet carries a token.

[0009] In some embodiments, the client data packet includes: a client handshake data packet and / or a client 1-RTT data packet; the encryption protection steps for the client data packet include: deriving a packet body protection key and a packet header protection key based on the second HKDF function and the corresponding key of the client data packet; encrypting the packet body portion of the client data packet based on the AEAD algorithm and the packet body protection key to obtain client packet body ciphertext; sampling fields of the client packet body ciphertext to obtain client ciphertext samples; encrypting the client ciphertext samples based on the packet header protection algorithm and the packet header protection key, and then sampling to obtain a client packet header protection mask; encrypting the packet header portion of the client data packet based on the client packet header protection mask; wherein, the packet header protection algorithm is a national cryptographic algorithm.

[0010] In some embodiments, the connection establishment method based on the QUIC protocol further includes: if the current connection is determined to be a non-first connection, then sending a client initialization data packet and a client 0-RTT data packet to the server, and receiving a server initialization data packet, a server handshake data packet, and a server 1-RTT data packet from the server to complete the communication; the client 0-RTT data packet carries application data; the client 0-RTT data packet is encrypted and protected based on the 0-RTT key and the national cryptographic algorithm, and the 0-RTT key is derived through the second HKDF function.

[0011] In a second aspect, this disclosure provides a connection establishment method based on the QUIC protocol, comprising: determining that the current connection is the first connection, then sending a client initialization data packet to the server and receiving a server initialization data packet fed back by the server to complete address verification and key exchange, specifically including: sending a client initialization data packet to the server and receiving a server retry data packet fed back by the server; sending a client retry data packet to the server and receiving a server initialization data packet fed back by the server to complete address verification and key exchange;

[0012] The client-side and server-side initialization data packets are encrypted using an initialization key and a national cryptographic algorithm. The initialization key is derived from a third HKDF function, which uses a national cryptographic algorithm for hashing. The server-side retry data packet contains a token and is encrypted using a retry key and a national cryptographic algorithm. The client-side retry data packet also carries a token. In response to the server's handshake data packet, the client sends a handshake data packet to the server to complete the handshake and establish a connection. The client-side and server-side handshake data packets are encrypted using a handshake key and a national cryptographic algorithm. The handshake key is derived from a third HKDF function. The method involves obtaining and responding to communication needs by encrypting and protecting the client's 1-RTT data packet carrying application data based on the 1-RTT key and the national cryptographic algorithm, and then sending it to the server for communication. The method further includes: determining that the current connection is not the first connection, then sending a client initialization data packet and a client 0-RTT data packet to the server, and receiving the server's feedback server initialization data packet, server handshake data packet, and server 1-RTT data packet to complete communication; the client 0-RTT data packet carries application data; the client 0-RTT data packet is encrypted and protected based on the 0-RTT key and the national cryptographic algorithm, and the 0-RTT key is derived through a third HKDF function.

[0013] In a third aspect, this disclosure provides a connection establishment method based on the QUIC protocol, comprising: responding to a client initialization data packet sent by a client, sending a server initialization data packet to complete address verification and key exchange; wherein the client initialization data packet and the server initialization data packet are encrypted and protected based on an initialization key and an international algorithm, the initialization key being derived through a first HKDF function, the first HKDF function employing an international algorithm for hashing; sending a server handshake data packet and receiving a client handshake data packet sent by the client to complete the handshake and establish a connection; wherein the initialization data packet contains encryption type information, the encryption type information being used to indicate the national cryptographic algorithm used for encryption protection; the client handshake data packet and the server handshake data packet are encrypted and protected based on a handshake key and a national cryptographic algorithm, the handshake key being derived through a second HKDF function, the second HKDF function employing a national cryptographic algorithm for hashing; responding to a client 1-RTT data packet, encrypting and protecting the server 1-RTT data packet carrying application data based on the 1-RTT key and the national cryptographic algorithm, and then sending it to the client for communication.

[0014] In some embodiments, the address verification step includes: in response to a client initialization data packet sent by the client, sending a server retry data packet; wherein the server retry data packet contains a token and is encrypted based on a retry key and an international algorithm; in response to the client retry data packet sent by the client, sending a server initialization data packet to complete the address verification; wherein the client retry data packet carries a token.

[0015] In some embodiments, the server-side data packet includes: a server-side handshake data packet and / or a server-side 1-RTT data packet; the encryption protection steps for the server-side data packet include: deriving a packet body protection key and a packet header protection key based on the second HKDF function and the corresponding key of the server-side data packet; encrypting the packet body portion of the server-side data packet based on the AEAD algorithm and the packet body protection key to obtain server-side packet body ciphertext; sampling fields of the server-side packet body ciphertext to obtain server-side ciphertext samples; encrypting and protecting the server-side ciphertext samples based on the packet header protection algorithm and the packet header protection key, and then sampling to obtain a server-side packet header protection mask; encrypting and protecting the packet header portion of the server-side data packet based on the server-side packet header protection mask; wherein, the packet header protection algorithm is a national cryptographic algorithm.

[0016] In some embodiments, the connection establishment method based on the QUIC protocol further includes: in response to the client initialization data packet and the client 0-RTT data packet sent by the client, sending the server initialization data packet, the server handshake data packet and the server 1-RTT data packet to complete the communication; the client 0-RTT data packet carries application data; the client 0-RTT data packet is encrypted and protected based on the 0-RTT key and the national cryptographic algorithm, and the 0-RTT key is derived through the second HKDF function.

[0017] In the fourth aspect, this disclosure provides a connection establishment method based on the QUIC protocol, including: responding to a client initialization data packet sent by the client and sending a server initialization data packet to complete address verification and key exchange, specifically including: responding to a client initialization data packet sent by the client and sending a server retry data packet; responding to a client retry data packet sent by the client and sending a server initialization data packet to complete address verification and key exchange; wherein, the client initialization data packet and the server initialization data packet are encrypted and protected based on an initialization key and a national cryptographic algorithm, the initialization key is derived through a third HKDF function, and the third HKDF function uses a national cryptographic algorithm for hash operation; the server retry data packet contains a token, and the server retry data packet is encrypted and protected based on a retry key and a national cryptographic algorithm; the client retry data packet carries a token; a server handshake data packet is sent, and then... The method includes: receiving client handshake data packets from the client to complete the handshake and establish a connection; wherein the client handshake data packets and server handshake data packets are encrypted and protected based on a handshake key and a national cryptographic algorithm, and the handshake key is derived through a third HKDF function; in response to the client 1-RTT data packets, the server 1-RTT data packets carrying application data are encrypted and protected based on the 1-RTT key and a national cryptographic algorithm, and then sent to the client to conduct communication; the method further includes: in response to the client initialization data packets and client 0-RTT data packets sent by the client, sending server initialization data packets, server handshake data packets, and server 1-RTT data packets to complete communication; the client 0-RTT data packets carry application data; the client 0-RTT data packets are encrypted and protected based on the 0-RTT key and a national cryptographic algorithm, and the 0-RTT key is derived through a third HKDF function.

[0018] The connection establishment method based on the QUIC protocol provided above enables the use of Chinese cryptographic algorithms for data encryption when establishing a communication connection using the QUIC protocol, thereby expanding the application scope of the QUIC protocol.

[0019] In some embodiments, this disclosure retains the specification for initialization packet encryption, enabling both the server and client to parse the initialization packet regardless of whether data encryption is based on Chinese or international cryptographic algorithms. This allows them to obtain the encryption key for the handshake packet, thereby completing the handshake phase packet parsing and handshake negotiation. Furthermore, by configuring encryption type information in the initialization packet—that is, the cipher suite negotiated during the handshake—the peer can identify the encryption algorithm used in subsequent communication phases and, combined with the key information, complete the application data parsing for the communication phase, improving the compatibility of the QUIC protocol. Attached Figure Description

[0020] The above and other objects, features, and advantages of exemplary embodiments of this disclosure will become readily apparent upon reading the following detailed description with reference to the accompanying drawings. In the drawings, several embodiments of this disclosure are illustrated by way of example and not limitation, and like or corresponding reference numerals denote like or corresponding parts, wherein:

[0021] Figure 1 A flowchart illustrating a connection establishment method based on the QUIC protocol according to some embodiments of this disclosure is shown.

[0022] Figure 2 The diagram illustrates communication interactions based on the QUIC protocol in some embodiments of this disclosure;

[0023] Figure 3 The diagram illustrates communication interactions based on the QUIC protocol in some other embodiments of this disclosure;

[0024] Figure 4 The diagram illustrates communication interactions based on the QUIC protocol according to some other embodiments of this disclosure;

[0025] Figure 5 A flowchart illustrating the data packet protection method based on national cryptographic algorithms according to an embodiment of this disclosure is shown.

[0026] Figure 6 A flowchart illustrating a connection establishment method based on the QUIC protocol according to other embodiments of this disclosure is shown.

[0027] Figure 7 An exemplary structural block diagram of an electronic device according to an embodiment of the present invention is shown. Detailed Implementation

[0028] The technical solutions in the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this disclosure, not all of them. Based on the embodiments in this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0029] It should be understood that the terms “comprising” and “including” used in this disclosure and claims indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0030] It should also be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this disclosure. As used in this disclosure and claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this disclosure and claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes such combinations.

[0031] As used in this specification and claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if [described condition or event] is detected" may be interpreted, depending on the context, as "once determined," "in response to determination," "once [described condition or event] is detected," or "in response to detection of [described condition or event]."

[0032] The specific embodiments disclosed herein will now be described in detail with reference to the accompanying drawings.

[0033] Exemplary application scenarios

[0034] The QUIC protocol requires only one round-trip time (RTT) to establish a reliable and secure connection, and in certain cases, even zero RTT. This is significantly faster than the one to three RTTs required by TCP+TLS, and more reliable than UDP. For example, in application-layer functionalities such as packet loss recovery, congestion control, encryption / decryption, and multiplexing, QUIC optimizes handshake latency while completely eliminating kernel protocol update lag.

[0035] However, current industry standards only explain how to implement the QUIC protocol using international algorithms, while the commercial cryptographic algorithms commonly used in my country are national cryptographic algorithms. The QUIC protocol, which is based on international algorithms, has a very low degree of national cryptographic sophistication, making it difficult to achieve widespread application.

[0036] Exemplary solution

[0037] In view of this, the present disclosure provides a connection establishment scheme based on the QUIC protocol, which realizes the application of the national cryptographic algorithm in the QUIC protocol by modifying the handshake data packet in the QUIC protocol to be Chinese cryptographic, which is conducive to expanding the application scope of the QUIC protocol.

[0038] The connection establishment method based on the QUIC protocol provided in this disclosure is described below.

[0039] Figure 1 A flowchart illustrating a connection establishment method based on the QUIC protocol according to some embodiments of this disclosure is shown. Figure 2 The diagram illustrates communication interactions based on the QUIC protocol in some embodiments of this disclosure.

[0040] like Figure 1 and Figure 2 As shown, in step 101, the current connection is determined to be the first connection.

[0041] The communication process of the QUIC protocol can be divided into two types: one is the first connection, and the other is the non-first connection.

[0042] Next, in step 102, a client initialization data packet is sent to the server and a server initialization data packet is received in response from the server to complete address verification and key exchange.

[0043] One address verification method provided in this disclosure is as follows.

[0044] In the QUIC protocol, a data packet consists of two parts: a header and a data body. The header contains four fields: Flags, Connection ID, QUIC Version, and Packet Number. The data body is the data frame, and the Stream frame is used to transmit application data.

[0045] When establishing a connection, the client randomly generates a target connection ID and fills it into the ConnectionID field of the initialization data packet to identify the current connection between the client and the server. Assuming the client initially sent a data packet using IP1, and after switching networks, the IP address changes to IP2, and the client sends a data packet again, the server can determine from the Connection ID field in the packet header that the two data packets originated from the same client, completing address verification and ensuring the connection remains open.

[0046] During communication between the server and the client, the Connection ID field of the data packet consistently uses the target connection ID to ensure that the connection is not broken. Therefore, the server initialization data packet returned by the server also uses the target connection ID.

[0047] In addition to the address verification method using the target connection ID described above, this disclosure also provides another address verification method. Figure 3 The diagram illustrates communication interactions based on the QUIC protocol, representing other embodiments of this disclosure. For example... Figure 3 As shown, the client sends a client initialization data packet to the server and receives a server retry data packet from the server. The server retry data packet contains a token for address verification. Then, the client sends a client retry data packet to the server and receives a server initialization data packet from the server to complete the address verification. The client retry data packet carries a token, and the server determines the client's consistency based on the token, thereby responding to the client retry data packet by sending a server initialization data packet back to the client.

[0048] It should be noted that the client retry data packets and the server retry data packets are encrypted and protected based on the retry key and international algorithms.

[0049] Retry packets are protected by encryption using a fixed retry key and the AEAD algorithm.

[0050] For example, the retry packet format is as follows:

[0051] Retry Packet{

[0052] Header Form(1) = 1,

[0053] Fixed Bit(1) = 1,

[0054] Long Packet Type(2) = 3,

[0055] Unused(4),

[0056] Version(32),

[0057] Destination Connection ID Length(8),

[0058] Destination Connection ID(0..160),

[0059] Source Connection ID Length(8),

[0060] Source Connection ID(0..160),

[0061] Retry Token(..),

[0062] Retry Integrity Tag(128)

[0063] }

[0064] The retry packet does not contain any protected fields. The Unused field is filled arbitrarily by the server, and the client must ignore the Unused field.

[0065] The retry integrity label is calculated using AEAD_SM4_GCM or AEAD_SM4_CCM.

[0066] The pseudo-retry data packet format is as follows:

[0067] Retry Pseudo-Packet{

[0068] ODCID Length(8),

[0069] Original Destination Connection ID(0..160),

[0070] Header Form(1) = 1,

[0071] Fixed Bit(1) = 1,

[0072] Long Packet Type(2) = 3,

[0073] Unused(4),

[0074] Version(32),

[0075] DCID Len(8),

[0076] Destination Connection ID(0..160),

[0077] SCID Len(8),

[0078] Source Connection ID(0..160),

[0079] Retry Token(..),

[0080] }

[0081] It should be noted that pseudo-retry packets are not actually sent; they are only used to calculate the TAG field of retry packets. Compared to the actual retry packets, pseudo-retry packets remove the Retry Tag field and add the ODCIDLength and ODCID fields.

[0082] The ODCID Length field indicates the length of the original target connection ID.

[0083] The original target connection ID refers to the target connection ID in the initialization packet of the retry packet response. The presence of the ODCIDLength field ensures that a valid retry packet can only be sent by the entity that received the initialization packet.

[0084] Furthermore, the retry key and random number used for retry packet encryption protection can be calculated using the HKDF-Expand-Label function, with a random string as the Secret and "quic key" and "quic iv" as the Label.

[0085] For example, the HKDF-Expand-Label function is defined as follows:

[0086] HKDF-Expand-Label(Secret,Label,Context,Length)=

[0087] HKDF-Expand(Secret,HkdfLabel,Length)

[0088] HkdfLabel is defined as follows:

[0089] struct{

[0090] uint16 length = Length;

[0091] opaque label<7..255>="tls13"+Label;

[0092] opaque context<0..255>=Context;

[0093] HkdfLabel;

[0094] The hash operation uses the SM3 hash function, and the HKDF-Expand-Label function uses a 0-length Context parameter.

[0095] Packet Number is used to represent the context of data packets. The client and server maintain their own Packet Number system, which is divided into three independent context spaces: initialization space, handshake space, and application data space. The Packet Number in each space is monotonically increasing.

[0096] This can be understood as follows: data packets are processed within their respective spaces. For example, initialization packets can only use a dedicated initialization key and can only be used to confirm initialization packets; similarly, handshake packets can only use a dedicated handshake key and can only be used to confirm handshake packets. After communication transitions from the initialization phase to the handshake phase, the initialization key used in the initialization phase can be discarded, and the packet number is reset to start from 0.

[0097] In this disclosed embodiment, the client initialization data packet and the server initialization data packet are encrypted and protected based on the initialization key and the international algorithm. The initialization key is derived through the first HKDF function, which uses the international algorithm for hash operation.

[0098] The HKDF function is a key derivation function based on HMAC. It takes an initial key as input and generates one or more enhanced keys to improve the security strength of the keys. The HKDF function first uses the HKDF-Extract function to convert the input initial key into a fixed-length pseudo-random key, and then uses the HKDF-Expand function to expand the fixed-length pseudo-random key into several pseudo-random keys.

[0099] In this disclosed embodiment, the first HKDF function used for initializing the key can perform hash operations using an international algorithm. The specific types of international algorithms that can be used can be referred to the RFC9001 standard.

[0100] The initialization data packet is encrypted using a key derived from the target connection ID of the client. This initialization key is then used to derive client-side and server-side initialization keys. The client-side initialization key is the same as the client-side write key, and the server-side initialization key is the same as the client-side read key; conversely, the server-side initialization key is the same as the server-side write key, and the client-side initialization key is the same as the server-side read key.

[0101] For example, a random string is taken as the salt, the target connection ID is taken as the input initial key, the HKDF-Extract function is called, and the initialization key is output; then the initialization key is taken as the Secret and "client in" is taken as the Label, the HKDF-Expand-Label function is called, and the client initialization key is output; the initialization key is taken as the Secret and "server in" is taken as the Label, the HKDF-Expand-Label function is called, and the server initialization key is output; the hash operation involved is performed using an international algorithm.

[0102] Because the encryption uses industry-standard international algorithms, the encryption algorithm type and initialization key of the aforementioned initialization data packet are public. Therefore, both communicating parties can parse the initialization data packet to obtain the encryption key for the next stage of the data packet.

[0103] In step 103, in response to the server handshake data packet fed back by the server, a client handshake data packet is sent to the server to complete the handshake and establish a connection.

[0104] The initialization data packet contains encryption type information, which indicates the national cryptographic algorithm used for encryption protection.

[0105] Specifically, this encryption type information can be understood as a cryptographic suite negotiated through a handshake, and this cryptographic suite is a national standard cryptographic suite.

[0106] Furthermore, a national cryptographic suite is negotiated in the server-side initialization data packet. This national cryptographic suite corresponds to the encryption type information in the aforementioned initialization data packet, and the client and server subsequently use this national cryptographic suite for information encryption protection.

[0107] The aforementioned client handshake data packets and server handshake data packets are encrypted and protected based on the handshake key and the national cryptographic algorithm. The handshake key is derived through the second HKDF function, which uses the national cryptographic algorithm for hash operation.

[0108] Similarly, the second HKDF function first uses the HKDF-Extract function to convert the input initial key into a fixed-length pseudo-random key, and then uses the HKDF-Expand function to expand the fixed-length pseudo-random key into several pseudo-random keys through a series of hash operations. The difference is that the hash operations in the second HKDF function use Chinese cryptographic algorithms, such as the SM3 hash function.

[0109] For example, the client and the server negotiate a shared key, which is used as the initial key input. After processing by the HKDF-Extract function in the second HKDF function, the Handshake Secret is obtained. Then, the handshake key is derived from the Handshake Secret by the HKDF-Expand function. The second HKDF function uses the SM3 hash function.

[0110] Furthermore, the connection establishment process also includes a non-first-time connection scenario. Figure 4 The following diagram illustrates communication interactions based on the QUIC protocol according to some embodiments of this disclosure, such as... Figure 4 As shown, if the client determines that the current connection is not the first connection, it sends a client initialization data packet and a client 0-RTT data packet to the server, and receives the server initialization data packet, server handshake data packet and server 1-RTT data packet from the server to complete the communication.

[0111] The client 0-RTT data packet contains application data; the client 0-RTT data packet is encrypted and protected based on the 0-RTT key and the national cryptographic algorithm, and the 0-RTT key is derived through the second HKDF function.

[0112] For the server, after sending the server initialization data packet, the server handshake data packet, and the server 1-RTT data packet, the handshake negotiation is completed, and the 1-RTT key has been generated.

[0113] It is understandable that if the current connection is not the first connection, the client has cached the session information of the previous successful connection locally. Therefore, the client and the server can determine the encryption type used for communication based on the cached data, and can use the cached data to calculate the encryption key. Thus, the client can directly send a client 0-RTT data packet to the server, which may include a Client Hello message and application data.

[0114] It should be noted that the encryption type information refers to the cryptographic suite negotiated by the two communicating parties during the handshake. In this disclosed embodiment, the cryptographic suite is a national cryptographic suite.

[0115] Furthermore, in response to the server's handshake data packet, the client sends a client handshake data packet to the server to complete the client's handshake negotiation.

[0116] The above describes the process of a client establishing a connection with a server. Correspondingly, this disclosure also provides a method for establishing a connection based on the QUIC protocol by the server, including: responding to a client initialization data packet sent by the client, sending a server initialization data packet to complete address verification and key exchange; sending a server handshake data packet and receiving a client handshake data packet sent by the client to complete the handshake and establish a connection.

[0117] The client initialization data packet and the server initialization data packet are encrypted and protected based on an initialization key and an international algorithm. The initialization key is derived from the first HKDF function, which uses an international algorithm for hashing. The initialization data packet contains encryption type information, which indicates the national cryptographic algorithm used for encryption protection. The client handshake data packet and the server handshake data packet are encrypted and protected based on a handshake key and a national cryptographic algorithm. The handshake key is derived from the second HKDF function, which uses a national cryptographic algorithm for hashing.

[0118] The encryption protection process for the initialization data packet and handshake data packet, as well as the derivation process for the initialization key and handshake key, have been described in detail in the previous embodiments and will not be repeated here.

[0119] Corresponding to the process of establishing a connection between the client and the server, during the server's connection establishment process, address verification can be performed based on the target connection ID. The method of address verification based on the target connection ID has been described in detail in the previous embodiments and will not be repeated here. Address verification can also be performed as follows: Figure 3 As shown, this is based on the token in the retry packet.

[0120] Specifically, in response to the client's initialization data packet, the server sends a server retry data packet. Then, in response to the client's retry data packet, the server sends a server initialization data packet to complete the address verification.

[0121] The server-side retry data packet contains a token, which is encrypted using a retry key and an international algorithm. The client-side retry data packet carries this token. The server uses this token to verify the client's consistency, and after completing address verification, sends a server initialization data packet to the client.

[0122] Furthermore, the server-side connection establishment method based on the QUIC protocol provided in this disclosure also includes: responding to the client initialization data packet and the client 0-RTT data packet sent by the client, sending the server initialization data packet, the server handshake data packet and the server 1-RTT data packet to complete the communication.

[0123] The client 0-RTT data packet carries application data; the client 0-RTT data packet is encrypted and protected based on the 0-RTT key and the national cryptographic algorithm, and the 0-RTT key is derived through the second HKDF function.

[0124] It should be noted that the encryption type information refers to the cryptographic suite negotiated by the two communicating parties during the handshake. In this disclosed embodiment, the cryptographic suite is a national cryptographic suite, and the 0-RTT data packet is encrypted and protected based on the 0-RTT key and the national cryptographic suite.

[0125] Optionally, after the connection is established, the client and the server can also communicate based on the QUIC protocol.

[0126] like Figure 1 As shown, in step 104, in response to communication requirements, the client 1-RTT data packet carrying application data is encrypted and protected based on the 1-RTT key and the national cryptographic algorithm, and then sent to the server for communication.

[0127] The above describes the process of establishing communication between the client and the server. Correspondingly, this disclosure also provides a communication method for the server, including: after establishing a connection, in response to the client's 1-RTT data packet, encrypting and protecting the server's 1-RTT data packet carrying application data based on the 1-RTT key and the national cryptographic algorithm, and then sending it to the client to conduct communication.

[0128] Furthermore, this disclosure provides a data packet protection method based on national cryptographic algorithms, applicable to the encryption protection of client 1-RTT data packets in step 104 above. Figure 5 A flowchart illustrating the data packet protection method based on national cryptographic algorithms according to an embodiment of this disclosure is shown.

[0129] It should be noted that the data packet protection method based on the national cryptographic algorithm described above is also applicable to encrypting and protecting the client handshake data packets and client 0-RTT data packets in the previous embodiments. Therefore, it can be understood that the above methods, combined with... Figures 1 to 4 The described features can be applied similarly here.

[0130] like Figure 5 As shown, in step 501, the packet body protection key and the packet header protection key are derived based on the second HKDF function and the corresponding key of the client data packet.

[0131] The client data packets include: client handshake data packets and / or client 1-RTT data packets.

[0132] For example, the derivation process for the packet body protection key and the packet header protection key can be as follows:

[0133] HKDF-Expand-Label(Secret,Label,Context,Length)=

[0134] HKDF-Expand(Secret,HkdfLabel,Length)

[0135] HkdfLabel is defined as follows:

[0136] struct{

[0137] uint16 length = Length;

[0138] opaque label<7..255>="tls13"+Label;

[0139] opaque context<0..255>=Context;

[0140] HkdfLabel;

[0141] It should be noted that the HKDF-Expand-Label function uses a 0-length Context parameter and the key corresponding to the encryption level of the current data packet as the Secret. For example: 0-RTT data packets use client_early_traffic_secret as the Secret; handshake data packets use client_handshake_traffic_secret and server_handshake_traffic_secret as Secrets; 1-RTT data packets use client_application_traffic_secret and server_application_traffic_secret as Secrets. The label uses "quic key" to generate the packet body protection key, "quic iv" to generate the initialization vector, and "quic hp" to generate the packet header protection key. The key lengths generated using "quic key" and "quic hp" are determined based on the negotiated AEAD algorithm and packet header protection algorithm.

[0142] It should be further noted that the formation process of the aforementioned client_early_traffic_secret, client_handshake_traffic_secret, server_handshake_traffic_secret, client_application_traffic_secret, and server_application_traffic_secret can be referred to the key derivation process defined in the TLS 1.3 protocol, and will not be elaborated here.

[0143] The HKDF function involved in the derivation process of the packet body protection key and the packet header protection key uses the HKDF-Expand-Label function in the TLS 1.3 protocol to perform hash operations using the hash algorithm in the cipher suite negotiated during the handshake. Specifically, it uses the SM3 hash function for hash operations.

[0144] In step 502, the packet body of the client data packet is encrypted and protected based on the AEAD algorithm and the packet body protection key to obtain the client packet body ciphertext.

[0145] The AEAD algorithm can be any of the AEAD_SM4 algorithms, such as AEAD_SM4_GCM or AEAD_SM4_CCM, and is not limited to a single one.

[0146] In the QUIC protocol, the header fields also need to be protected. After the packet body is encrypted using the AEAD algorithm, the header is protected. Header protection mainly protects the least significant bit of the first byte and the packet number field. For example, for a long header, the four least significant bits of the first byte are significant bits; for a short header, the five least significant bits of the first byte are significant bits.

[0147] In step 503, the client packet body ciphertext is sampled to obtain a client ciphertext sample.

[0148] For example, the client-side encrypted sample is sampled starting from 4 bytes after the packet number, and the sampling offset is calculated as follows:

[0149] #pn_offset is the start of the Packet Number field.

[0150] sample_offset = pn_offset + 4

[0151] sample=packet[sample_offset..sample_offset+sample_length]

[0152] In step 504, based on the header protection algorithm and header protection key, the client ciphertext sample is encrypted and protected before sampling to obtain the client header protection mask.

[0153] Specifically, the client ciphertext sample and the header protection key are used as input values ​​for the header protection algorithm. After being encrypted by the header protection algorithm, the first 5 bytes are used as the header protection mask.

[0154] The packet header protection algorithm is a national cryptographic algorithm. For example, the packet header protection algorithm uses the SM4-ECB algorithm.

[0155] In step 505, the header portion of the client data packet is encrypted and protected based on the client header protection mask.

[0156] Specifically, the least significant bit of the first byte of the client header protection mask is XORed with the least significant bit of the first byte of the header, and the remaining four bytes of the client header protection mask are XORed with the Packet Number. If the Packet Number is less than four bytes, the extra mask can be discarded.

[0157] Correspondingly, the aforementioned data packet protection method based on national cryptographic algorithms is also applicable to encrypting and protecting server-side 1-RTT data packets and server-side handshake data packets.

[0158] Specifically, assuming the server-side data packet includes: a server-side handshake data packet and / or a server-side 1-RTT data packet; then the encryption protection steps for the server-side data packet include:

[0159] Based on the second HKDF function and the corresponding key of the server data packet, the packet body protection key and the packet header protection key are derived.

[0160] The packet body of the server data packet is encrypted and protected using the AEAD algorithm and the packet body protection key to obtain the server packet body ciphertext.

[0161] Field sampling is performed on the encrypted data body of the server to obtain the encrypted data sample of the server;

[0162] Based on the header protection algorithm and header protection key, the server-side ciphertext sample is encrypted and protected before sampling to obtain the server-side header protection mask.

[0163] Based on the server-side header protection mask, the header portion of the server-side data packets is encrypted and protected; the header protection algorithm is a national cryptographic algorithm.

[0164] The AEAD algorithm and header protection algorithm used in the encryption protection steps of the server-side data packets can refer to the encryption protection steps of the client-side data packets in the previous embodiment, and will not be elaborated here.

[0165] The preceding section presented a connection establishment method based on the QUIC protocol. By preserving the standard for encryption of the initialization data packet, it allows both the server and client to parse the initialization data packet, regardless of whether they use Chinese or international cryptographic algorithms for data encryption. This allows them to obtain the encryption key for the handshake data packet, thereby completing the data packet parsing during the handshake phase and ultimately concluding the handshake negotiation. Furthermore, by configuring encryption type information in the initialization data packet—specifically, the cipher suite negotiated during the handshake—the other end can identify the encryption algorithm used in subsequent communication phases, thus enabling the parsing of application data during the communication phase and improving the compatibility of the QUIC protocol.

[0166] Corresponding to the connection establishment method based on the QUIC protocol shown above, this disclosure also provides another connection establishment method based on the QUIC protocol, which implements a highly encrypted transformation of the QUIC protocol.

[0167] Figure 6 A flowchart illustrating a connection establishment method based on the QUIC protocol according to other embodiments of this disclosure is shown.

[0168] like Figure 6 As shown, in step 601, the current connection is determined to be the first connection.

[0169] In step 602, a client initialization data packet is sent to the server and a server initialization data packet is received from the server to complete address verification and key exchange.

[0170] Referring to the previous embodiments, address verification in this embodiment can be performed based on the target connection ID. Alternatively, it can be as follows: Figure 3 As shown, verification is performed using retry packets, specifically including: sending a client initialization packet to the server and receiving a server retry packet from the server; sending a client retry packet to the server and receiving a server initialization packet from the server to complete address verification.

[0171] It should be noted that the client-side and server-side initialization data packets are encrypted and protected using an initialization key and a national cryptographic algorithm. The initialization key is derived from the third HKDF function, which uses the national cryptographic algorithm for hash calculation. Specifically, the initialization data packets are encrypted using the AEAD_SM4_CCM or AEAD_SM4_GCM algorithm, and the third HKDF function uses the SM3 hash function for hash calculation.

[0172] For example, the derivation process for the initialization key is as follows:

[0173] Take a random string, say "0x38762cf7f55934b34d179ae6a4c80cadccbb7f0a" as the salt, use the target connection ID as the initial key, call the HKDF-Extract function to output the initialization key; then use the initialization key as the Secret and "client in" as the Label, call the HKDF-Expand-Label function to output the client initialization key; use the initialization key as the Secret and "server in" as the Label, call the HKDF-Expand-Label function to output the server initialization key.

[0174] The third HKDF function mentioned above uses the SM3 hash function, and the process can be represented as follows:

[0175] initial_salt=0x38762cf7f55934b34d179ae6a4c80cadccbb7f0a,

[0176] initial_secret=HKDF-Extract(initial_salt,client_dst_connection_id)

[0177] client_initial_secret=HKDF-Expand-Label(initial_secret,"client in","",Hash.length)

[0178] server_initial_secret=HKDF-Expand-Label(initial_secret,"server in","",Hash.length)

[0179] The third HKDF function used can be found in RFC5869 standard, and will not be elaborated here.

[0180] In step 603, in response to the server handshake data packet fed back by the server, a client handshake data packet is sent to the server to complete the handshake and establish a connection.

[0181] The client handshake data packet and the server handshake data packet are encrypted and protected based on the handshake key and the national cryptographic algorithm. The handshake key is derived through the third HKDF function.

[0182] In this disclosed embodiment, the content of step 603 is the same as that of step 103 in the previous embodiment, and will not be repeated here.

[0183] In step 604, in response to communication requirements, the client 1-RTT data packet carrying application data is encrypted and protected based on the 1-RTT key and the national cryptographic algorithm, and then sent to the server for communication.

[0184] In this disclosed embodiment, the content of step 604 is the same as that of step 104 in the previous embodiment, and will not be repeated here.

[0185] Furthermore, in this embodiment, the 1-RTT data packet and the handshake data packet are also subject to the foregoing. Figure 5 The data packet protection method based on national cryptographic algorithms shown in this disclosure embodiment is, in conjunction with the foregoing... Figure 5 The described features can be applied similarly here.

[0186] Furthermore, the connection establishment process also includes a non-first-time connection scenario. If the client determines that the current connection is not the first-time connection, it sends a client initialization data packet and a client 0-RTT data packet to the server, and receives the server initialization data packet, server handshake data packet and server 1-RTT data packet from the server to complete the communication.

[0187] The client 0-RTT data packet carries application data; the client 0-RTT data packet is encrypted and protected based on the 0-RTT key and the national cryptographic algorithm, and the 0-RTT key is derived through the third HKDF function.

[0188] The encryption protection process for the client 0-RTT data packets described above can be referred to the encryption protection process for the client 0-RTT data packets in the previous embodiment, and will not be repeated here.

[0189] The above-mentioned client 0-RTT data packets also apply to the above. Figure 5 This disclosure illustrates a data packet protection method based on national cryptographic algorithms, namely, the method described above in conjunction with... Figure 5 The described features can be applied similarly here.

[0190] The above describes the process of establishing a connection between the client and the server. Correspondingly, this disclosure also provides a connection establishment method for the server based on the QUIC protocol, including: responding to a client initialization data packet sent by the client, sending a server initialization data packet to complete address verification and key exchange; sending a server handshake data packet and receiving a client handshake data packet sent by the client to complete the handshake and establish a connection.

[0191] The client initialization data packet and the server initialization data packet are encrypted and protected based on the initialization key and the national cryptographic algorithm. The initialization key is derived from the third HKDF function, which uses the national cryptographic algorithm for hash operation. The client handshake data packet and the server handshake data packet are encrypted and protected based on the handshake key and the national cryptographic algorithm. The handshake key is derived from the third HKDF function.

[0192] Furthermore, corresponding to the process of establishing a connection with the client, during the connection establishment process on the server side, address verification can be based on the target connection ID, or it can use methods such as... Figure 3 The process is as shown, specifically including: responding to the client initialization data packet sent by the client, sending a server retry data packet; then, responding to the client retry data packet sent by the client, sending a server initialization data packet to complete address verification.

[0193] The server-side retry data packet contains a token, which is encrypted and protected based on the retry key and the national cryptographic algorithm. The server determines the client's consistency based on the token carried in the client's retry data packet.

[0194] Furthermore, the connection establishment process also includes a non-first-time connection scenario. If the client determines that the current connection is not the first-time connection, it will send a client initialization data packet and a client 0-RTT data packet to the server. In response to the client initialization data packet and client 0-RTT data packet sent by the client, the server sends a server initialization data packet, a server handshake data packet, and a server 1-RTT data packet to complete the communication.

[0195] The client 0-RTT data packet contains application data. The client 0-RTT data packet is encrypted and protected based on the 0-RTT key and the national cryptographic algorithm. The 0-RTT key is derived through the third HKDF function.

[0196] An introduction to the third HKDF function has already been provided. Figure 6 The methods shown are explained in detail and will not be repeated here.

[0197] It should be noted that after the server sends the server initialization data packet, the server handshake data packet, and the server 1-RTT data packet, the server has completed the handshake negotiation with the client and obtained the 1-RTT key.

[0198] It should be noted that the data packet protection method based on the national cryptographic algorithm provided above is also applicable to this embodiment. That is, one or more of the above-mentioned server handshake data packets and server 1-RTT data packets can be protected by the AEAD algorithm and the packet body protection key, and / or protected by the packet header protection algorithm and the packet header protection key. The packet header protection algorithm is a national cryptographic algorithm. In the HKDF function used to derive the packet body protection key and the packet header protection key, the SM3 hash function is used for hash operation.

[0199] In summary, this disclosure provides a connection establishment method based on the QUIC protocol. Its initialization data packet and / or retry data packet are still encrypted and protected based on international algorithms, so that both communicating parties can complete the parsing of the initialization data packet regardless of whether the encryption algorithm used has been negotiated in advance, thereby ensuring the smooth progress of the handshake negotiation. By configuring encryption type information in the initialization data packet, the other end can identify the encryption algorithm used in subsequent communication stages, thereby completing the parsing of application data in the communication stage and improving the compatibility of the QUIC protocol.

[0200] This disclosure also provides a connection establishment method based on the QUIC protocol, which modifies the five types of data packets in the QUIC protocol, including initialization data packets, handshake data packets, 1-RTT data packets, 0-RTT data packets and retry data packets, to achieve a high degree of national cryptographic modification of the QUIC protocol and expand the application scope of the QUIC protocol.

[0201] This disclosure also provides a connection establishment apparatus based on the QUIC protocol, comprising: a server and a client, wherein the server executes any of the above methods to establish a connection with the client, and the client executes any of the above methods to establish a connection with the server.

[0202] Corresponding to the aforementioned functional embodiments, this invention also provides a method such as... Figure 7 The electronic device shown. Figure 7 An exemplary structural block diagram of an electronic device according to an embodiment of the present invention is shown.

[0203] Figure 7 The illustrated electronic device 700 includes: a processor 710; and a memory 720 storing executable program instructions that, when executed by the processor 710, cause the electronic device to perform any of the methods described above.

[0204] exist Figure 7 In the electronic device 700, only the components relevant to this embodiment are shown. Therefore, it will be apparent to those skilled in the art that the electronic device 700 may also include components related to... Figure 7 The following are common constituent elements with different constituent elements.

[0205] Processor 710 can control the operation of electronic device 700. For example, processor 710 controls the operation of electronic device 700 by executing a program stored in memory 720 on electronic device 700. Processor 710 can be implemented by a central processing unit (CPU), application processor (AP), artificial intelligence processor chip (IPU), etc., provided in electronic device 700. However, this disclosure is not limited thereto. In this embodiment, processor 710 can be implemented in any suitable manner. For example, processor 710 can take the form of, for example, a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers, etc.

[0206] The memory 720 can be used to store various data and instructions processed in the electronic device 700. For example, the memory 720 can store processed data and data to be processed in the electronic device 700. The memory 720 can store datasets that have been processed or are to be processed by the processor 710. In addition, the memory 720 can store applications, drivers, etc. to be driven by the electronic device 700. The memory 720 can be DRAM, but this disclosure is not limited thereto. The memory 720 can include at least one of volatile memory or non-volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, phase-change RAM (PRAM), magnetic RAM (MRAM), resistive RAM (RRAM), ferroelectric RAM (FRAM), etc. Volatile memory can include dynamic RAM (DRAM), static RAM (SRAM), synchronous DRAM (SDRAM), PRAM, MRAM, RRAM, ferroelectric RAM (FeRAM), etc. In an embodiment, the memory 720 may include at least one of a hard disk drive (HDD), a solid-state drive (SSD), a high-density flash memory (CF), a secure digital card (SD), a micro-secure digital card (Micro-SD), a mini-secure digital card (Mini-SD), an extreme digital card (xD), caches, or a memory stick.

[0207] In summary, the specific functions implemented by the memory 720 and processor 710 of the electronic device 700 provided in this specification can be explained in comparison with the aforementioned embodiments in this specification, and can achieve the technical effects of the aforementioned embodiments. Therefore, they will not be repeated here.

[0208] Alternatively, this disclosure may be implemented as a non-transitory machine-readable storage medium (or computer-readable storage medium, or machine-readable storage medium) storing computer program instructions (or computer program, or computer instruction code) that, when executed by a processor of an electronic device (or electronic device, server, etc.), cause the processor to perform some or all of the steps of the methods described above according to this disclosure.

[0209] While numerous embodiments of this disclosure have been shown and described herein, it will be apparent to those skilled in the art that such embodiments are provided by way of example only. Many modifications, alterations, and alternatives will occur to those skilled in the art without departing from the spirit and intent of this disclosure. It should be understood that various alternatives to the embodiments of this disclosure described herein may be employed in the practice of this disclosure. The appended claims are intended to define the scope of this disclosure and therefore cover equivalents or alternatives within the scope of these claims.

Claims

1. A connection establishment method based on the QUIC protocol, characterized in that, include: If the current connection is determined to be the first connection, then Send a client initialization data packet to the server and receive a server initialization data packet from the server to complete address verification and key exchange; The client initialization data packet and the server initialization data packet are encrypted and protected based on an initialization key and an international algorithm. The initialization key is derived from a first HKDF function, in which an international algorithm is used for hashing. In response to the server handshake data packet fed back by the server, the client sends a client handshake data packet to the server to complete the handshake and establish a connection; The initialization data packet contains encryption type information, which refers to the national cryptographic suite negotiated during the handshake phase. The client handshake data packet and the server handshake data packet are encrypted and protected based on the handshake key and the national cryptographic algorithm. The handshake key is derived through the second HKDF function, and the national cryptographic algorithm is used for hash operation in the second HKDF function. In response to communication needs, based on the 1-RTT key and national cryptographic algorithm, the client's 1-RTT data packets carrying application data are encrypted and protected before being sent to the server for communication.

2. The connection establishment method based on the QUIC protocol according to claim 1, characterized in that, The address verification steps include: The client sends a client initialization data packet to the server and receives a server retry data packet from the server; wherein the server retry data packet contains a token for address verification and is encrypted based on a retry key and an international algorithm. The client sends a retry data packet to the server and receives a server initialization data packet from the server to complete the address verification; wherein the client retry data packet carries the token.

3. The connection establishment method based on the QUIC protocol according to claim 1, characterized in that, The client data packet includes: the client handshake data packet and / or the client 1-RTT data packet; The encryption protection steps for the client data packets include: Based on the second HKDF function and the corresponding key of the client data packet, the packet body protection key and the packet header protection key are derived; The packet body portion of the client data packet is encrypted and protected based on the AEAD algorithm and the packet body protection key to obtain the client packet body ciphertext; Field sampling is performed on the client packet body ciphertext to obtain the client ciphertext sample; Based on the packet header protection algorithm and the packet header protection key, the client ciphertext sample is encrypted and protected before sampling to obtain the client packet header protection mask; Based on the client header protection mask, the header portion of the client data packet is encrypted and protected; wherein, the header protection algorithm is a national cryptographic algorithm.

4. The connection establishment method based on the QUIC protocol according to claim 1, characterized in that, Also includes: If the current connection is determined to be a non-first connection, a client initialization data packet and a client 0-RTT data packet are sent to the server, and the server initialization data packet, server handshake data packet, and server 1-RTT data packet are received from the server to complete the communication. The client 0-RTT data packet carries application data. The client 0-RTT data packet is encrypted and protected based on the 0-RTT key and the national cryptographic algorithm. The 0-RTT key is derived through the second HKDF function.

5. A connection establishment method based on the QUIC protocol, characterized in that, include: If the current connection is determined to be the first connection, then Sending a client initialization data packet to the server and receiving a server initialization data packet from the server to complete address verification and key exchange, specifically includes: sending a client initialization data packet to the server and receiving a server retry data packet from the server; sending a client retry data packet to the server and receiving a server initialization data packet from the server to complete address verification and key exchange. Specifically, the client initialization data packet, the server initialization data packet, the server retry data packet, and the client retry data packet are all encrypted and protected based on the national cryptographic algorithm. The initialization key is derived through a third HKDF function, which uses the national cryptographic algorithm for hashing. The server retry data packet contains a token and is encrypted and protected based on the retry key and the national cryptographic algorithm. The client retry data packet carries the token. In response to the server handshake data packet fed back by the server, the client sends a client handshake data packet to the server to complete the handshake and establish a connection; The client handshake data packet and the server handshake data packet are encrypted and protected based on the handshake key and the national cryptographic algorithm. The handshake key is derived from the third HKDF function. In response to communication needs, the client's 1-RTT data packets carrying application data are encrypted and protected based on the 1-RTT key and the national cryptographic algorithm before being sent to the server for communication. The method further includes: If the current connection is determined to be a non-first connection, a client initialization data packet and a client 0-RTT data packet are sent to the server, and the server initialization data packet, server handshake data packet, and server 1-RTT data packet are received from the server to complete the communication. The client 0-RTT data packet carries application data. The client 0-RTT data packet is encrypted and protected based on the 0-RTT key and the national cryptographic algorithm. The 0-RTT key is derived through the third HKDF function.

6. A connection establishment method based on the QUIC protocol, characterized in that, include: In response to the client initialization packet sent by the client, a server initialization packet is sent to complete address verification and key exchange; The client initialization data packet and the server initialization data packet are encrypted and protected based on an initialization key and an international algorithm. The initialization key is derived from a first HKDF function, in which an international algorithm is used for hashing. Send a server handshake data packet and receive a client handshake data packet sent by the client to complete the handshake and establish a connection; The initialization data packet contains encryption type information, which refers to the national cryptographic suite negotiated during the handshake phase. The client handshake data packet and the server handshake data packet are encrypted and protected based on the handshake key and the national cryptographic algorithm. The handshake key is derived through the second HKDF function, and the national cryptographic algorithm is used for hash operation in the second HKDF function. In response to a client's 1-RTT data packet, the server encrypts and protects the 1-RTT data packet carrying application data based on the 1-RTT key and the national cryptographic algorithm, and then sends it to the client to conduct communication.

7. The connection establishment method based on the QUIC protocol according to claim 6, characterized in that, The address verification steps include: In response to a client initialization data packet sent by the client, a server retry data packet is sent; wherein, the server retry data packet contains a token, and the server retry data packet is encrypted and protected based on a retry key and an international algorithm; In response to a client retry data packet sent by the client, a server initialization data packet is sent to complete address verification; wherein the client retry data packet carries the token.

8. The connection establishment method based on the QUIC protocol according to claim 6, characterized in that, The server-side data packet includes: the server-side handshake data packet and / or the server-side 1-RTT data packet; The encryption protection steps for the server-side data packets include: Based on the second HKDF function and the corresponding key of the server data packet, the packet body protection key and the packet header protection key are derived. The packet body portion of the server-side data packet is encrypted and protected based on the AEAD algorithm and the packet body protection key to obtain the server-side packet body ciphertext. Field sampling is performed on the encrypted server-side packet body to obtain a server-side encrypted sample. Based on the header protection algorithm and the header protection key, the server-side ciphertext sample is encrypted and protected before sampling to obtain the server-side header protection mask. Based on the server header protection mask, the header portion of the server data packet is encrypted and protected; wherein, the header protection algorithm is a national cryptographic algorithm.

9. The connection establishment method based on the QUIC protocol according to claim 6, characterized in that, Also includes: In response to the client initialization data packet and the client 0-RTT data packet sent by the client, the server initialization data packet, the server handshake data packet and the server 1-RTT data packet are sent to complete the communication; the client 0-RTT data packet carries application data; the client 0-RTT data packet is encrypted and protected based on the 0-RTT key and the national cryptographic algorithm, and the 0-RTT key is derived through the second HKDF function.

10. A connection establishment method based on the QUIC protocol, characterized in that, include: If the current connection is determined to be the first connection, then in response to the client initialization data packet sent by the client, a server initialization data packet is sent to complete address verification and key exchange. Specifically, this includes: in response to the client initialization data packet sent by the client, a server retry data packet is sent; in response to the client retry data packet sent by the client, a server initialization data packet is sent to complete address verification and key exchange. Specifically, the client initialization data packet, the server initialization data packet, the server retry data packet, and the client retry data packet are all encrypted and protected based on the national cryptographic algorithm. The initialization key is derived through a third HKDF function, which uses the national cryptographic algorithm for hashing. The server retry data packet contains a token and is encrypted and protected based on the retry key and the national cryptographic algorithm. The client retry data packet carries the token. Send a server handshake data packet and receive a client handshake data packet sent by the client to complete the handshake and establish a connection; The client handshake data packet and the server handshake data packet are encrypted and protected based on the handshake key and the national cryptographic algorithm. The handshake key is derived from the third HKDF function. In response to a client's 1-RTT data packet, the server encrypts and protects the 1-RTT data packet carrying application data based on the 1-RTT key and the national cryptographic algorithm, and then sends it to the client to conduct communication. The method further includes: If the current connection is determined to be a non-first connection, then in response to the client's client initialization data packet and client 0-RTT data packet, the server initialization data packet, server handshake data packet, and server 1-RTT data packet are sent to complete the communication; the client 0-RTT data packet carries application data; the client 0-RTT data packet is encrypted and protected based on the 0-RTT key and the national cryptographic algorithm, and the 0-RTT key is derived through the third HKDF function.

Images