Method and device for non-state secret system to access state secret system

Abstract

Embodiments of the present disclosure provide a method and device for non-national secret system to access national secret system, and are applied to the field of computer information security. The method comprises intercepting a first data packet sent by the non-national secret system to the national secret system and converting the first data packet into a second data packet recognizable by the national secret system; the national secret system receives the second data packet and decrypts the second data packet, generates a response data packet according to the decrypted second data packet, encrypts the response data packet to generate a third data packet, and returns the third data packet to the non-national secret system; intercepting the third data packet sent by the national secret system to the non-national secret system and converting the third data packet into a fourth data packet recognizable by the non-national secret system; and the non-national secret system receives the fourth data packet and decrypts the fourth data packet. In this way, the non-national secret system can access data in the national secret system.

Description

Technical Field

[0001] This disclosure relates to the field of computer information security, and in particular to a method and apparatus for accessing a national cryptographic system from a non-national cryptographic system. Background Technology

[0002] With the increasing number of national cryptographic systems, many non-national cryptographic systems do not support the national cryptographic SSL encryption system, leading to increasingly prominent problems in website access. Many government agencies, banks, research institutions, and other organizations are still running applications developed for non-national cryptographic systems. Therefore, how to enable non-national cryptographic systems to access national cryptographic systems has become an urgent problem to be solved. Summary of the Invention

[0003] This disclosure provides a method, apparatus, device, and storage medium for non-national cryptographic systems to access national cryptographic systems.

[0004] According to a first aspect of this disclosure, a method for accessing a national cryptographic system from a non-national cryptographic system is provided. The method includes:

[0005] Call the kernel packet capture program to intercept the first data packet sent from a non-national cryptographic system to a national cryptographic system;

[0006] Call the conversion program to convert the first data packet into a second data packet that can be recognized by the national cryptographic system;

[0007] The second data packet is sent to the national cryptographic system so that the national cryptographic system can decrypt the second data packet and generate a response data packet based on the decrypted second data packet, and encrypt the response data packet to generate a third data packet, and return the third data packet to the non-national cryptographic system;

[0008] Call the kernel packet capture program to intercept third data packets sent from the national cryptographic system to the non-national cryptographic system;

[0009] Call the conversion program to convert the third data packet into a fourth data packet that can be recognized by the non-national cryptographic system;

[0010] The fourth data packet is sent to a non-national cryptographic system so that the non-national cryptographic system can decrypt the fourth data packet.

[0011] In some possible implementations of the first aspect, the kernel packet capture program is developed using EBPF technology.

[0012] In some possible implementations of the first aspect, a conversion program is invoked to convert the first data packet into a second data packet recognizable by the national cryptographic system, including:

[0013] The conversion program is invoked so that it can decrypt the first data packet using the RSA algorithm with a non-national cryptographic private key, and then encrypt the decrypted first data packet using the encryption and decryption algorithm used by the national cryptographic system with the national cryptographic public key to generate the second data packet; wherein...

[0014] The second data packet carries access request data;

[0015] The encryption and decryption algorithms used in the national cryptographic system include, but are not limited to, the SM2, SM3, and SM4 algorithms.

[0016] In some possible implementations of the first aspect, decrypting the second data packet and generating a response data packet based on the decrypted second data packet, and encrypting the response data packet to generate a third data packet, includes:

[0017] The second data packet is decrypted using the private key of the national cryptographic system and the encryption and decryption algorithm used by the national cryptographic system. A response data packet is generated based on the decrypted second data packet. The response data packet is then encrypted using the public key of the national cryptographic system and the encryption and decryption algorithm used by the national cryptographic system to generate the third data packet.

[0018] The response data packet carries the request response data and the data that non-national cryptographic systems need to access.

[0019] In some possible implementations of the first aspect, a conversion procedure is invoked to convert the third data packet into a fourth data packet recognizable by a non-national cryptographic system, including:

[0020] The conversion program is invoked so that it can decrypt the third data packet using the national cryptographic public key and the encryption / decryption algorithm used by the national cryptographic system, and then encrypt the decrypted third data packet using the RSA algorithm with a non-national cryptographic public key to generate the fourth data packet.

[0021] Among the possible implementations of the first aspect, decrypting the fourth data packet includes:

[0022] The fourth data packet is decrypted using a non-national cryptographic private key via the RSA algorithm.

[0023] According to a second aspect of this disclosure, an apparatus for accessing a national cryptographic system from a non-national cryptographic system is provided. The apparatus includes:

[0024] The access request module is used to call the kernel packet capture program in order to intercept the first data packet sent from the non-national cryptographic system to the national cryptographic system;

[0025] Call the conversion program to convert the first data packet into a second data packet that can be recognized by the national cryptographic system;

[0026] The request-response module is used to send the second data packet to the national cryptographic system so that the national cryptographic system can decrypt the second data packet and generate a response data packet based on the decrypted second data packet, and encrypt the response data packet to generate a third data packet, and return the third data packet to the non-national cryptographic system;

[0027] The data access module is used to call the kernel packet capture program in order to intercept third data packets sent from the national cryptographic system to the non-national cryptographic system;

[0028] Call the conversion program to convert the third data packet into a fourth data packet that can be recognized by the non-national cryptographic system;

[0029] The fourth data packet is sent to a non-national cryptographic system so that the non-national cryptographic system can decrypt the fourth data packet.

[0030] According to a third aspect of this disclosure, an electronic device is provided. The electronic device includes: at least one processor; and a memory communicatively connected to the at least one processor; the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the method described above.

[0031] According to a fourth aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions for causing a computer to perform the methods described above.

[0032] In this disclosure, by intercepting a first data packet sent from a non-national cryptographic system to a national cryptographic system and converting it into a second data packet recognizable by the national cryptographic system; the national cryptographic system receives and decrypts the second data packet, generates a response data packet based on the decrypted second data packet, encrypts the response data packet to generate a third data packet, and returns the third data packet to the non-national cryptographic system; the third data packet sent from the national cryptographic system to the non-national cryptographic system is intercepted and converted into a fourth data packet recognizable by the non-national cryptographic system; the non-national cryptographic system receives and decrypts the fourth data packet; thus, the non-national cryptographic system can access data in the national cryptographic system.

[0033] It should be understood that the description in the Summary of the Invention is not intended to limit the key or essential features of the embodiments of this disclosure, nor is it intended to restrict the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0034] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. The drawings are provided for a better understanding of the invention and are not intended to limit the scope of this disclosure. In the drawings, the same or similar reference numerals denote the same or similar elements, wherein:

[0035] Figure 1This disclosure provides a flowchart of a method for a non-national cryptographic system to access a national cryptographic system, according to an embodiment of the present disclosure.

[0036] Figure 2 This illustration shows a structural diagram of a device for accessing a national cryptographic system from a non-national cryptographic system, according to an embodiment of this disclosure.

[0037] Figure 3 A structural diagram of an exemplary electronic device capable of implementing embodiments of the present disclosure is shown. Detailed Implementation

[0038] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0039] Furthermore, the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0040] To address the problems in the background art, this disclosure provides a method and apparatus for a non-national cryptographic system to access a national cryptographic system. Specifically, by intercepting a first data packet sent from a non-national cryptographic system to a national cryptographic system and converting it into a second data packet recognizable by the national cryptographic system; the national cryptographic system receives and decrypts the second data packet, generates a response data packet based on the decrypted second data packet, encrypts the response data packet to generate a third data packet, and returns the third data packet to the non-national cryptographic system; the third data packet sent from the national cryptographic system to the non-national cryptographic system is intercepted and converted into a fourth data packet recognizable by the non-national cryptographic system; the non-national cryptographic system receives and decrypts the fourth data packet; this enables a non-national cryptographic system to access data in the national cryptographic system.

[0041] The method and apparatus for accessing a national cryptographic system from a non-national cryptographic system, provided in this disclosure, will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0042] Figure 1 This disclosure provides a flowchart of a method for a non-national cryptographic system to access a national cryptographic system, according to an embodiment of the present disclosure. The access method 100 includes the following steps:

[0043] S110 invokes the kernel packet capture program to intercept the first data packet sent from the non-national cryptographic system to the national cryptographic system.

[0044] In some embodiments, kernel packet capture programs are developed using EBPF technology.

[0045] In some embodiments, the kernel packet capture program uses the following methods:

[0046] Use the socket API to open a network interface from a non-national cryptographic system to a national cryptographic system in order to read data packets received from that interface;

[0047] Filtering conditions can be set as needed, such as by IP address, port number, protocol type, etc., in order to intercept data packets that meet the conditions, i.e., the first data packet;

[0048] The first data packet is read from the aforementioned network interface using the socket API and stored in memory for subsequent analysis.

[0049] By examining the source address, destination address, protocol type, and data content of the data packet, the intercepted first data packet is analyzed to determine whether it is the first data packet sent from a non-national cryptographic system to a national cryptographic system.

[0050] In some embodiments, the first data packet carries access request data.

[0051] S120, Invoke the conversion program to convert the first data packet into a second data packet that can be recognized by the national cryptographic system.

[0052] In some embodiments, the conversion program uses a non-national cryptographic private key to decrypt the first data packet using the RSA algorithm, and then uses the national cryptographic public key to encrypt the decrypted first data packet using the encryption and decryption algorithm used by the national cryptographic system to generate a second data packet; wherein...

[0053] The second data packet carries access request data;

[0054] The encryption and decryption algorithms used in the national cryptographic system include, but are not limited to, the SM2, SM3, and SM4 algorithms.

[0055] S130, the second data packet is sent to the national cryptographic system so that the national cryptographic system can decrypt the second data packet and generate a response data packet based on the decrypted second data packet, encrypt the response data packet to generate a third data packet, and return the third data packet to the non-national cryptographic system.

[0056] In some embodiments, the second data packet is decrypted using the private key of the national cryptographic standard and the encryption / decryption algorithm used by the national cryptographic system, and a response data packet is generated based on the decrypted second data packet. The response data packet is then encrypted using the public key of the national cryptographic standard and the encryption / decryption algorithm used by the national cryptographic system to generate a third data packet.

[0057] The response data packet carries the request response data and the data that non-national cryptographic systems need to access.

[0058] S140 invokes the kernel packet capture program to intercept third data packets sent from the national cryptographic system to the non-national cryptographic system.

[0059] In some embodiments, the method of the kernel packet capture program here is the same in principle as the kernel packet capture program method in method S110, and will not be described again here.

[0060] S150, Invoke the conversion program to convert the third data packet into a fourth data packet that can be recognized by the non-national cryptographic system.

[0061] In some embodiments, the conversion program uses the national cryptographic public key to decrypt the third data packet using the encryption and decryption algorithm used by the national cryptographic system, and uses a non-national cryptographic public key to encrypt the decrypted third data packet using the RSA algorithm to generate the fourth data packet.

[0062] In some embodiments, using the national cryptographic public key to encrypt the response data packet using the encryption and decryption algorithm used by the national cryptographic system to generate a third data packet, and using the national cryptographic public key to decrypt the third data packet using the encryption and decryption algorithm used by the national cryptographic system, are symmetric encryption methods.

[0063] S160, the fourth data packet is sent to a non-national cryptographic system so that the non-national cryptographic system can decrypt the fourth data packet.

[0064] In some embodiments, the fourth data packet is decrypted using a non-national cryptographic private key via the RSA algorithm.

[0065] In some embodiments, the encryption and decryption process of the RSA algorithm is as follows:

[0066] Choose two prime numbers p and q, and calculate their product n, i.e., n = p * q;

[0067] Choose an integer e such that e is coprime to ((p-1)*(q-1)), and calculate the modular inverse element d of e with respect to ((p-1)*(q-1)) such that d*e = 1 (mod((p-1)*(q-1)));

[0068] Obtain the public key (e,n) and private key (d,n);

[0069] When encrypting using the RSA algorithm, the plaintext m is encrypted using a non-national cryptographic public key to obtain the ciphertext c, where c = m^e (mod n), and m^e (mod n) represents the remainder of m raised to the power of e divided by n;

[0070] When decrypting using the RSA algorithm, the ciphertext is decrypted using a non-national cryptographic private key to obtain the plaintext m, i.e., m = c^d (mod n), where c^d (mod n) represents the remainder when c raised to the power of d is divided by n.

[0071] The above is an introduction to the method embodiments. The following specific embodiments using the method will further illustrate the solution described in this disclosure.

[0072] Taking the SM2 algorithm, which is used in the national cryptographic system, as an example, the encryption and decryption process of the SM2 algorithm is explained:

[0073] Choose an elliptic curve as the function, and take the point G on the elliptic curve as the base point;

[0074] Select a random number K as the private key, calculate the public key P, i.e., P = kG, and use the X coordinate of the public key P as the encryption key;

[0075] The plaintext is converted into a point M on an elliptic curve. A random number r is selected as the parameter of the encryption algorithm. The ciphertexts C1 = rG and C2 = M + rP are calculated to obtain the encrypted ciphertexts C1 and C2.

[0076] When decrypting the ciphertext, calculate S = KC1 and use the X coordinate of S as the decryption key;

[0077] Calculate M = C² - S to obtain the point M on the elliptic curve where the decrypted plaintext is located;

[0078] Convert point M to plaintext.

[0079] According to the embodiments of this disclosure, the following technical effects are achieved:

[0080] By intercepting the first data packet sent from a non-national cryptographic system to a national cryptographic system and converting it into a second data packet recognizable by the national cryptographic system; the national cryptographic system receives and decrypts the second data packet, generates a response data packet based on the decrypted second data packet, encrypts the response data packet to generate a third data packet, and returns the third data packet to the non-national cryptographic system; by intercepting the third data packet sent from the national cryptographic system to the non-national cryptographic system and converting it into a fourth data packet recognizable by the non-national cryptographic system; and the non-national cryptographic system receives and decrypts the fourth data packet, it is possible for a non-national cryptographic system to access data in a national cryptographic system.

[0081] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this disclosure is not limited to the described order of actions, because according to this disclosure, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this disclosure.

[0082] The above is an introduction to the method embodiments. The following describes the solution described in this disclosure further through device embodiments.

[0083] Figure 2 This disclosure illustrates a structural diagram of a device 200 for accessing a national cryptographic system from a non-national cryptographic system, according to an embodiment of the present disclosure. The device 200 includes:

[0084] Access request module 210 is used to call the kernel packet capture program in order to intercept the first data packet sent from the non-national cryptographic system to the national cryptographic system;

[0085] Call the conversion program to convert the first data packet into a second data packet that can be recognized by the national cryptographic system.

[0086] The request-response module 220 is used to send the second data packet to the national cryptographic system so that the national cryptographic system can decrypt the second data packet and generate a response data packet based on the decrypted second data packet, and encrypt the response data packet to generate a third data packet, and return the third data packet to the non-national cryptographic system.

[0087] The data access module 230 is used to call the kernel packet capture program in order to intercept the third data packet sent by the national cryptographic system to the non-national cryptographic system;

[0088] Call the conversion program to convert the third data packet into a fourth data packet that can be recognized by the non-national cryptographic system;

[0089] The fourth data packet is sent to a non-national cryptographic system so that the non-national cryptographic system can decrypt the fourth data packet.

[0090] In some embodiments, the access request module 210 is specifically used for:

[0091] The kernel packet capture program was developed using EBPF technology;

[0092] The conversion program is invoked so that it can decrypt the first data packet using the RSA algorithm with a non-national cryptographic private key, and then encrypt the decrypted first data packet using the encryption and decryption algorithm used by the national cryptographic system with the national cryptographic public key to generate the second data packet; wherein...

[0093] The second data packet carries access request data;

[0094] The encryption and decryption algorithms used in the national cryptographic system include, but are not limited to, the SM2, SM3, and SM4 algorithms.

[0095] In some embodiments, the request-response module 220 is specifically used for:

[0096] The second data packet is decrypted using the private key of the national cryptographic system and the encryption and decryption algorithm used by the national cryptographic system. A response data packet is generated based on the decrypted second data packet. The response data packet is then encrypted using the public key of the national cryptographic system and the encryption and decryption algorithm used by the national cryptographic system to generate the third data packet.

[0097] The response data packet carries the request response data and the data that non-national cryptographic systems need to access.

[0098] In some embodiments, the data access module 230 is specifically used for:

[0099] The conversion program is invoked so that it can decrypt the third data packet using the national cryptographic public key and the encryption and decryption algorithm used by the national cryptographic system, and encrypt the decrypted third data packet using the RSA algorithm with the non-national cryptographic public key to generate the fourth data packet;

[0100] The fourth data packet is decrypted using a non-national cryptographic private key via the RSA algorithm.

[0101] Understandable, Figure 2 Each module / unit in the apparatus 200 shown has the function of implementing each step in the access method 100 provided in the embodiments of this disclosure, and can achieve its corresponding technical effect. For the sake of brevity, it will not be described in detail here.

[0102] Figure 3 A structural diagram of an exemplary electronic device capable of implementing embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0103] like Figure 3 As shown, the electronic device 300 includes a computing unit 301, which can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) 302 or a computer program loaded from a storage unit 308 into a random access memory (RAM) 303. The RAM 303 may also store various programs and data required for the operation of the electronic device 300. The computing unit 301, ROM 302, and RAM 303 are interconnected via a bus 304. An I / O interface 305 is also connected to the bus 304.

[0104] Multiple components in electronic device 300 are connected to I / O interface 305, including: input unit 306, such as keyboard, mouse, etc.; output unit 307, such as various types of displays, speakers, etc.; storage unit 308, such as disk, optical disk, etc.; and communication unit 309, such as network card, modem, wireless transceiver, etc. Communication unit 309 allows electronic device 300 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0105] The computing unit 301 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 301 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 301 performs the various methods and processes described above, such as method 100. For example, in some embodiments, method 100 may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 308. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 300 via ROM 302 and / or communication unit 309. When the computer program is loaded into RAM 303 and executed by the computing unit 301, one or more steps of method 100 described above may be performed. Alternatively, in other embodiments, the computing unit 301 may be configured to perform method 100 by any other suitable means (e.g., by means of firmware).

[0106] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0107] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0108] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0109] It should be noted that this disclosure also provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to execute method 100 and achieve the corresponding technical effects achieved by executing the method in the embodiments of this disclosure. For the sake of brevity, they will not be described in detail here.

[0110] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including voice input, speech input, or tactile input).

[0111] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0112] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0113] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0114] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for accessing a national cryptographic system from a non-national cryptographic system, characterized in that, include: The kernel packet capture program is invoked to intercept the first data packet sent from a non-national cryptographic system to a national cryptographic system; the method of the kernel packet capture program is as follows: Use the socket API to open the network interface from the non-national cryptographic system to the national cryptographic system in order to read the data packets received from the interface; set the filtering conditions as needed to intercept data packets that meet the conditions, i.e., the first data packet; use the socket API to read the first data packet from the above network interface and store it in memory for subsequent analysis; examine the source address, destination address, protocol type, and data content of the data packet to analyze the intercepted first data packet to determine whether the data packet is the first data packet sent from the non-national cryptographic system to the national cryptographic system; The conversion program is invoked so that it decrypts the first data packet using a non-national cryptographic private key via RSA algorithm, and then encrypts the decrypted first data packet using a national cryptographic public key via the encryption / decryption algorithm used by the national cryptographic system to generate a second data packet; wherein... The second data packet carries access request data; The encryption and decryption algorithms used in the national cryptographic system include the SM2 algorithm, the SM3 algorithm, and the SM4 algorithm. The second data packet is sent to the national cryptographic system so that the national cryptographic system can decrypt the second data packet and generate a response data packet based on the decrypted second data packet, encrypt the response data packet to generate a third data packet, and return the third data packet to the non-national cryptographic system; Call the kernel packet capture program to intercept third data packets sent from the national cryptographic system to the non-national cryptographic system; Invoke the conversion program to convert the third data packet into a fourth data packet that can be recognized by the non-national cryptographic system; The fourth data packet is sent to a non-national cryptographic system so that the non-national cryptographic system can decrypt the fourth data packet.

2. The method according to claim 1, characterized in that, The kernel packet capture program was developed using EBPF technology.

3. The method according to claim 1, characterized in that, The process includes decrypting the second data packet and generating a response data packet based on the decrypted second data packet, and encrypting the response data packet to generate a third data packet, comprising: The second data packet is decrypted using the private key of the national cryptographic system and the encryption and decryption algorithm used by the national cryptographic system. A response data packet is generated based on the decrypted second data packet. The response data packet is then encrypted using the public key of the national cryptographic system and the encryption and decryption algorithm used by the national cryptographic system to generate a third data packet. The response data packet carries request response data and data that non-national cryptographic systems need to access.

4. The method according to claim 1, characterized in that, The invocation of the conversion program to convert the third data packet into a fourth data packet recognizable by a non-national cryptographic system includes: The conversion program is invoked so that it can decrypt the third data packet using the national cryptographic private key and the encryption / decryption algorithm used by the national cryptographic system, and encrypt the decrypted third data packet using the RSA algorithm with the non-national cryptographic public key to generate the fourth data packet.

5. The method according to claim 1, characterized in that, Decrypting the fourth data packet includes: The fourth data packet is decrypted using a non-national cryptographic private key via the RSA algorithm.

6. A device for accessing a national cryptographic system from a non-national cryptographic system, characterized in that, include: The access request module is used to invoke the kernel packet capture program to intercept the first data packet sent from a non-national cryptographic system to a national cryptographic system; the kernel packet capture program's method is as follows: Use the socket API to open the network interface from the non-national cryptographic system to the national cryptographic system in order to read the data packets received from the interface; set the filtering conditions as needed to intercept data packets that meet the conditions, i.e., the first data packet; use the socket API to read the first data packet from the above network interface and store it in memory for subsequent analysis; examine the source address, destination address, protocol type, and data content of the data packet to analyze the intercepted first data packet to determine whether the data packet is the first data packet sent from the non-national cryptographic system to the national cryptographic system; The conversion program is invoked so that it decrypts the first data packet using a non-national cryptographic private key via RSA algorithm, and then encrypts the decrypted first data packet using a national cryptographic public key via the encryption / decryption algorithm used by the national cryptographic system to generate a second data packet; wherein... The second data packet carries access request data; The encryption and decryption algorithms used in the national cryptographic system include the SM2 algorithm, the SM3 algorithm, and the SM4 algorithm. The request-response module is used to send the second data packet to the national cryptographic system so that the national cryptographic system can decrypt the second data packet and generate a response data packet based on the decrypted second data packet, and encrypt the response data packet to generate a third data packet, and return the third data packet to the non-national cryptographic system; The data access module is used to call the kernel packet capture program in order to intercept third data packets sent from the national cryptographic system to the non-national cryptographic system; Invoke the conversion program to convert the third data packet into a fourth data packet that can be recognized by the non-national cryptographic system; The fourth data packet is sent to a non-national cryptographic system so that the non-national cryptographic system can decrypt the fourth data packet.

7. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-5.

8. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-5.

Images