Method and apparatus for application data message handling for transport layer security protocol

Abstract

This application relates to a method and apparatus for processing application data messages using a transport layer security protocol (TLS). The method includes: a server obtaining application data from a client based on a TLS protocol; obtaining the TLS negotiation state of the current session; caching the application data when the TLS negotiation state of the current session is in a waiting state; obtaining a decryption key when the TLS negotiation state of the current session is in a connected state; and decrypting and processing the application data using the decryption key. The application data message processing method and apparatus for a TLS protocol disclosed in this application can solve the problem of service failure caused by the short interval between the client's completion message and application data message transmission, thereby ensuring the accuracy and effectiveness of information transmission in the communication connection.

Description

Technical Field

[0001] This application relates to the field of computer information processing, and more specifically, to an application data message processing method and apparatus for transport layer security protocols. Background Technology

[0002] TLS 1.3 is a completely new TLS (Transport Layer Security) encryption protocol. Compared to TLS 1.2, it improves both access speed for internet users worldwide and enhances security. TLS 1.3 improves performance, efficiency, and security by removing support for older, broken cryptographic protocols, such as CBC mode ciphers, SHA-1 hash functions, various Diffie-Hellman groups, RSA key transfer, RC4 stream ciphers, and Export ciphers. It also improves speed by simplifying the TLS handshake, requiring only one round trip instead of the two in previous versions. This simplified handshake reduces latency and improves performance.

[0003] In existing technologies, when the TLS 1.3 state machine receives a client finished message, it needs to parse the message to obtain the decryption key for subsequent messages. If the client's application data arrives immediately at this point, the existing processing steps will fail to decrypt the application data message, causing the application data message processing to fail.

[0004] Therefore, a new method and apparatus for processing application data messages for transport layer security protocols is needed.

[0005] The information disclosed in the background section is only intended to enhance the understanding of the background of this application, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0006] In view of this, this application provides an application data message processing method and apparatus for transport layer security protocols, which can solve the problem of service failure caused by the short interval between the client's sending completion message and the application data message, thereby ensuring the accuracy and effectiveness of information transmission in the communication connection.

[0007] Other features and advantages of this application will become apparent from the following detailed description, or may be learned in part from practice of this application.

[0008] According to one aspect of this application, a method for processing application data messages using a transport layer security protocol is proposed. The method includes: a server obtaining application data from a client based on a transport layer security protocol; obtaining the TLS negotiation state of the current session; caching the application data when the TLS negotiation state of the current session is in a waiting state; obtaining a decryption key when the TLS negotiation state of the current session is in a connected state; and decrypting and processing the application data using the decryption key.

[0009] In one exemplary embodiment of this application, the transport layer security protocol is TLS 1.3.

[0010] In one exemplary embodiment of this application, before the server obtains the client's application data message based on the transport layer security protocol, the method further includes: the server obtaining the client's sending completion message based on the transport layer security protocol, wherein the sending completion message is a client finished message; setting the TLS negotiation state of the current session to a waiting state; and setting the TLS negotiation state of the current session to a connected state when the validity judgment passes.

[0011] In one exemplary embodiment of this application, before the server obtains the client's sending completion message based on the transport layer security protocol, the method further includes: the server obtaining the client's greeting message based on the transport layer security protocol, wherein the greeting message is a Client Hello message; the server and the client exchanging key data and protocol parameters based on the greeting message; and after successful authentication, the client generating its own sending completion message.

[0012] In one exemplary embodiment of this application, after setting the TLS negotiation state of the current session to the connected state, the method further includes: decrypting and processing the application data messages in the cache.

[0013] In one exemplary embodiment of this application, when the legality check passes, setting the TLS negotiation state of the current session to a connected state includes: generating a decryption key for the client's send completion message; decrypting the client's send completion message using the decryption key to generate plaintext data; checking the legality of the plaintext data; when the legality check passes, setting the TLS negotiation state of the current session to a connected state; and when the legality check fails, disconnecting the connection of the current session.

[0014] In one exemplary embodiment of this application, decrypting the client's sending completion message according to the decryption key to generate plaintext data includes: decrypting the client's sending completion message through a hardware decryption module to generate plaintext data.

[0015] In one exemplary embodiment of this application, when the legality determination passes, the TLS negotiation state of the current session is set to the connected state, and the method further includes: generating a decryption key for decrypting the application data message.

[0016] In one exemplary embodiment of this application, caching the application data message when the TLS negotiation state of the current session is in a waiting state includes: sending the application data message into a cache queue for caching when the TLS negotiation state of the current session is in a waiting state.

[0017] According to one aspect of this application, an application data message processing apparatus for a transport layer security protocol is proposed. The apparatus includes: a data module for a server to obtain application data from a client based on the transport layer security protocol, wherein the application data is an application data message; a status module for obtaining the TLS negotiation status of the current session; a caching module for caching the application data message when the TLS negotiation status of the current session is in a waiting state; a key module for obtaining a decryption key when the TLS negotiation status of the current session is in a connected state; and a processing module for decrypting and processing the application data message using the decryption key.

[0018] According to one aspect of this application, an electronic device is provided, comprising: one or more processors; a storage device for storing one or more programs; and, when the one or more programs are executed by the one or more processors, causing the one or more processors to implement the method as described above.

[0019] According to one aspect of this application, a computer-readable medium is provided having a computer program stored thereon that, when executed by a processor, implements the method described above.

[0020] According to the application data message processing method and apparatus for transport layer security protocols of this application, the server obtains the client's application data based on the transport layer security protocol; obtains the TLS negotiation state of the current session; when the TLS negotiation state of the current session is in a waiting state, the application data is cached; when the TLS negotiation state of the current session is in a connected state, the decryption key is obtained; and the application data is decrypted and processed using the decryption key. This method can solve the problem of service failure caused by the short interval between the client's sending completion message and the application data message, thereby ensuring the accuracy and effectiveness of information transmission in the communication connection.

[0021] It should be understood that the above general description and the following detailed description are merely exemplary and do not limit this application. Attached Figure Description

[0022] The above and other objects, features, and advantages of this application will become more apparent from the detailed description of exemplary embodiments with reference to the accompanying drawings. The drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0023] Figure 1 This is a system block diagram illustrating an application data message processing method and apparatus for a transport layer security protocol according to an exemplary embodiment.

[0024] Figure 2 This is a flowchart illustrating an application data message processing method for a transport layer security protocol according to an exemplary embodiment.

[0025] Figure 3 This is a flowchart illustrating an application data message processing method for a transport layer security protocol according to another exemplary embodiment.

[0026] Figure 4 This is a flowchart illustrating an application data message processing method for a transport layer security protocol according to another exemplary embodiment.

[0027] Figure 5 This is a flowchart illustrating an application data message processing method for a transport layer security protocol according to another exemplary embodiment.

[0028] Figure 6 This is a block diagram illustrating an application data message processing apparatus for a transport layer security protocol according to an exemplary embodiment.

[0029] Figure 7 This is a block diagram illustrating an electronic device according to an exemplary embodiment.

[0030] Figure 8 This is a block diagram illustrating a computer-readable medium according to an exemplary embodiment. Detailed Implementation

[0031] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the embodiments set forth herein; rather, they are provided so that this application will be thorough and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted.

[0032] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this application. However, those skilled in the art will recognize that the technical solutions of this application can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this application.

[0033] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0034] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0035] It should be understood that although the terms first, second, third, etc., may be used herein to describe various components, these components should not be limited by these terms. These terms are used to distinguish one component from another. Therefore, the first component discussed below may be referred to as the second component without departing from the teachings of this application. As used herein, the term "and / or" includes all combinations of any one and more of the associated listed items.

[0036] Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of exemplary embodiments, and the modules or processes in the drawings are not necessarily essential for implementing this application, and therefore cannot be used to limit the scope of protection of this application.

[0037] The technical abbreviations used in this application are explained as follows:

[0038] SSL is a secure transmission protocol. SSL stands for Secure Socket Layer. Originally developed by Netscape, it has become the global standard for authenticating websites and web browsers, and for encrypting communication between browser users and web servers. Because SSL technology is built into all major browsers and web server programs, only a digital certificate or server certificate is needed to activate server functionality.

[0039] The SSL protocol provides robust protection for credit cards and personal information. SSL encrypts the entire session between computers. It employs both public and private key encryption methods.

[0040] The advantage of the SSL protocol lies in its independence from application layer protocols. Higher-level application protocols such as HTTP, FTP, and Telnet can be transparently built on top of the SSL protocol. The encryption algorithm, communication key negotiation, and server authentication are completed before application layer protocol communication. Afterward, all data transmitted by the application layer protocol is encrypted, thus ensuring the security of our communication over the Internet.

[0041] TLS stands for Transport Layer Security, and it is the successor to SSL (Secure Sockets Layer). TLS provides secure communication between web browsers and servers. The connection itself is secure because symmetric encryption is used to encrypt transmitted data. The key is uniquely generated for each connection and is based on a shared secret negotiated at the start of the session, also known as a TLS handshake.

[0042] The Internet Engineering Task Force (IETF) is the organization responsible for defining the TLS protocol, which has undergone many different iterations. The previous TLS version, TLS 1.2, was defined in RFC 5246 and was used by most web browsers for the past eight years. On March 21, 2018, after 28 drafts, TLS 1.3 was finalized. As of August 2018, the final version of TLS 1.3 has been released (RFC 8446).

[0043] The applicant in this case discovered through research that in the existing TLS 1.3 protocol, upon receiving a client-finished message, the message needs to be parsed. At this time, an application data message may be sent immediately. In the existing processing flow, if the interval between the application data message and the client-finished message is too short, the server is still in the process of parsing the client-finished message. Because the connection is not fully established and the key for encrypting and decrypting the application data message has not yet been generated, the application data message cannot be decrypted, leading to processing failure.

[0044] In view of the technical deficiencies in the prior art, this application proposes an application data message processing method for transport layer security protocols. This method is a server-side one-way authentication asynchronous process state machine processing scheme, which solves the problem of possible failure to decrypt application data sent by the client.

[0045] The actual technology of this application is equivalent to providing a TLS 1.3 server-side one-way authentication asynchronous process. Before decrypting and verifying the client's finished message, the received application data message is cached until the key for encrypting and decrypting the application data message is generated before processing. In traditional asynchronous processes, when the interval between the application data message and the client's finished message is too short, the server is still in the state of parsing the client's finished message, the connection is not fully established, and the key for encrypting and decrypting the application data message has not yet been generated, causing processing of the application data message to fail. This application designs a caching mechanism to address this situation and adds a GET_CLNT_FINISH_ASYN_WAIT state, which allows for successful connection establishment and encryption / decryption of the application data message.

[0046] The content of this application will be described in detail below with reference to specific embodiments.

[0047] Figure 1 This is a system block diagram illustrating an application data message processing method and apparatus for a transport layer security protocol according to an exemplary embodiment.

[0048] like Figure 1 As shown, system architecture 10 may include terminal devices 101, 102, and 103, a network 104, and a server 105. Network 104 serves as the medium for providing communication links between terminal devices 101, 102, and 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0049] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc.

[0050] Terminal devices 101, 102, and 103 can be various electronic devices with displays and web browsing capabilities, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0051] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using terminal devices 101, 102, and 103. The backend management server first establishes a communication connection with terminal devices 101, 102, and 103, receives data based on the communication connection, performs analysis and other processing, and can also feed back the processing results to the terminal devices.

[0052] Server 105 may, for example, obtain the sending completion message of terminal devices 101, 102, and 103 based on the transport layer security protocol, wherein the sending completion message is a client finished message; server 105 may, for example, set the TLS negotiation state of the current session to a waiting state; server 105 may, for example, set the TLS negotiation state of the current session to a connected state when the validity judgment is passed.

[0053] Server 105 may also, for example, obtain application data messages from terminal devices 101, 102, and 103 based on transport layer security protocols, wherein the application data messages are application data messages; server 105 may also, for example, obtain the TLS negotiation state of the current session; server 105 may also, for example, cache the application data messages when the TLS negotiation state of the current session is in a waiting state; server 105 may also, for example, obtain a decryption key when the TLS negotiation state of the current session is in a connected state; server 105 may also, for example, decrypt and process the application data messages using the decryption key.

[0054] In this application, server 105 can be a single physical server, or it can be composed of multiple servers. It should be noted that the application data message processing method for transport layer security protocols provided in this application embodiment can be executed by server 105. Correspondingly, the application data message processing device for transport layer security protocols can be set in server 105.

[0055] This application primarily addresses the scenario where a client sends an `application data` message shortly after receiving a `client finished` message. When the server receives the `client finished` message, it first needs to generate a key to decrypt it and verify the message's validity. Only after verification will it calculate the key used to encrypt and decrypt the `application data` message. This process takes time, and the `application data` message arrives during this period, preventing the server from processing it immediately. A caching mechanism is needed to allow the server to determine if a connection has been established before processing the message.

[0056] Figure 2This is a flowchart illustrating an application data message processing method for a transport layer security protocol according to an exemplary embodiment. The application data message processing method 20 for a transport layer security protocol includes at least steps S202 to S210.

[0057] like Figure 2 As shown, in S202, the server obtains the client's application data message based on the transport layer security protocol, where the application data message is an application data message. The transport layer security protocol is TLS 1.3.

[0058] In S204, the TLS negotiation state of the current session is retrieved. For example, a dedicated session list can be set up to store the current session state. The current session state can be associated with and bound to the session ID and stored in the session list. The session list can store the TLS negotiation states of multiple current sessions so that the state of each session can be found in a timely manner. After the session connection is completed and closed, the corresponding entry can be deleted from the session list, and expired entries can also be cleaned up periodically.

[0059] In S206, the application data message is cached when the TLS negotiation state of the current session is in a waiting state. More specifically, the application data message can be sent to a cache queue for caching when the TLS negotiation state of the current session is in a waiting state (GET_CLNT_FINISH_ASYN_WAIT).

[0060] In S208, when the TLS negotiation state of the current session is connected, the decryption key is obtained. Prior to this, a decryption key for decrypting the application data messages is generated. The current session state is only set to connected if the decryption key is ready. Therefore, when the current session state is connected, it proves that the decryption key for the current session is ready and can be directly retrieved.

[0061] In S210, the application data message is decrypted and processed using the decryption key. The data message can be decrypted according to the processing method agreed upon in the protocol, and then forwarded according to the source port and destination port of the message.

[0062] Figure 3 This is a flowchart illustrating an application data message processing method for a transport layer security protocol according to another exemplary embodiment. Figure 3 The process shown in step 30 is... Figure 2 Additional descriptions of the process shown.

[0063] like Figure 3As shown, in S302, the server obtains the client's sending completion message based on the transport layer security protocol, and the sending completion message is the client finished message.

[0064] In one embodiment, prior to this step, the method further includes: the server obtaining a greeting message from the client based on a transport layer security protocol, wherein the greeting message is a Client Hello message; the server and the client exchanging key data and protocol parameters based on the greeting message; and after successful authentication, the client generating a client sending completion message.

[0065] In S304, the TLS negotiation state of the current session is set to the waiting state.

[0066] In S306, upon successful validity verification, the TLS negotiation state of the current session is set to the connected state. Application data messages in the cache can also be decrypted and processed. Application data messages can be retrieved from the cache queue, and the corresponding decryption key can be extracted based on the current session identifier corresponding to the application message for subsequent processing.

[0067] In one embodiment, the method further includes: generating a decryption key for the client's send completion message; decrypting the client's send completion message using the decryption key to generate plaintext data; determining the validity of the plaintext data; setting the TLS negotiation state of the current session to a connected state if the validity determination passes; and disconnecting the connection of the current session if the validity determination fails.

[0068] More specifically, the client's send completion message can be decrypted using a hardware decryption module to generate plaintext data.

[0069] In S308, if the validity check fails, the connection of the current session is disconnected. If the validity check fails, the current connection is considered illegal and can be disconnected.

[0070] According to the application data message processing method for transport layer security protocols of this application, the server obtains the client's application data based on the transport layer security protocol; obtains the TLS negotiation state of the current session; when the TLS negotiation state of the current session is in a waiting state, the application data is cached; when the TLS negotiation state of the current session is in a connected state, the decryption key is obtained; and the application data is decrypted and processed using the decryption key. This method can solve the problem of service failure caused by the short interval between the client's sending completion message and the application data message, thereby ensuring the accuracy and effectiveness of information transmission in the communication connection.

[0071] It should be clearly understood that this application describes how specific examples are formed and used, but the principles of this application are not limited to any details of these examples. Rather, based on the teachings of the disclosure of this application, these principles can be applied to many other embodiments.

[0072] Figure 4 This is a flowchart illustrating an application data message processing method for a transport layer security protocol according to another exemplary embodiment. Figure 4 The process shown in step 40 is a detailed description of the actual application process of this application.

[0073] like Figure 4 As shown, in S402, the client finished message is received.

[0074] In S404, a key is generated to decrypt the client finished message.

[0075] In S406, hardware decryption is performed, and the current state is set to waiting. The client's "finished" message is verified; if incorrect, the connection is closed; otherwise, the process continues to the next step.

[0076] In S408, the application data message is received.

[0077] In S410, it is determined whether the current state is a connected state.

[0078] In S412, the application data message is decrypted.

[0079] In S414, application data messages are stored in a cache queue.

[0080] As described above, after receiving the client's "finished" message, the server first generates a key to decrypt this message, sends it to the hardware module for decryption, sets the state machine to "GET_CLNT_FINISH_ASYN_WAIT," and continues to receive messages. Upon receiving the "application data" message, it checks if the current state is "CONNECTED." If so, it decrypts the message directly; otherwise, it sends it to a buffer queue for further processing.

[0081] Figure 5 This is a flowchart illustrating an application data message processing method for a transport layer security protocol according to another exemplary embodiment. Figure 5 The flowchart 50 shown is a detailed description of the decryption process of this application.

[0082] like Figure 5As shown, in S502, the client finished message is decrypted.

[0083] In S504, the correctness of decrypting the client finished message is verified.

[0084] In S506, the key used to encrypt and decrypt application data messages is calculated.

[0085] In S508, the state is set to connected state.

[0086] In S510, application data messages in the cache queue are processed.

[0087] In S512, disconnect.

[0088] As described in the steps above, after the hardware module decrypts the client finished message and verifies it successfully, it sets the status to CONNECTED. Then it checks if there is data in the cache queue. If there is, it decrypts the data; otherwise, it continues with the subsequent process.

[0089] This application provides a TLS 1.3 server-side asynchronous state machine processing method for one-way authentication. Before decrypting and verifying the `client finished` message, the received `application data` message is cached until the key for encrypting / decrypting the `application data` message is generated. This solves the problem of business failures caused by the short interval between sending the `client finished` and `application data` messages.

[0090] Those skilled in the art will understand that all or part of the steps of the above embodiments are implemented as a computer program executed by a CPU. When the computer program is executed by the CPU, it performs the functions defined by the method provided in this application. The program can be stored in a computer-readable storage medium, such as a read-only memory, a magnetic disk, or an optical disk.

[0091] Furthermore, it should be noted that the above figures are merely illustrative representations of the processes included in the method according to exemplary embodiments of this application, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0092] The following are embodiments of the apparatus described in this application, which can be used to execute the embodiments of the method described in this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the method described in this application.

[0093] Figure 6 This is a block diagram illustrating an application data message processing apparatus for a transport layer security protocol, according to an exemplary embodiment. Figure 6 As shown, the application data message processing apparatus 60 for transport layer security protocols includes: a data module 602, a status module 604, a cache module 606, a key module 608, and a processing module 610. The application data message processing apparatus 60 for transport layer security protocols may further include: a setting module 612.

[0094] Data module 602 is used by the server to obtain application data from the client based on the transport layer security protocol, wherein the application data is an application data message;

[0095] State module 604 is used to obtain the TLS negotiation state of the current session;

[0096] The caching module 606 is used to cache the application data messages when the TLS negotiation state of the current session is in a waiting state;

[0097] The key module 608 is used to obtain the decryption key when the TLS negotiation state of the current session is in the connected state;

[0098] The processing module 610 is used to decrypt and process the application data message using the decryption key.

[0099] The setting module 612 is used by the server to obtain the client's sending completion message based on the transport layer security protocol, wherein the sending completion message is a client finished message; set the TLS negotiation state of the current session to a waiting state; and set the TLS negotiation state of the current session to a connected state when the validity judgment is passed.

[0100] The application data message processing apparatus for transport layer security protocols according to this application obtains client application data through the server based on the transport layer security protocol; obtains the TLS negotiation state of the current session; caches the application data when the TLS negotiation state of the current session is in a waiting state; obtains the decryption key when the TLS negotiation state of the current session is in a connected state; and decrypts and processes the application data using the decryption key. This method can solve the problem of service failure caused by the short interval between the client's message completion message and the application data message, thereby ensuring the accuracy and effectiveness of information transmission in the communication connection.

[0101] Figure 7 This is a block diagram illustrating an electronic device according to an exemplary embodiment.

[0102] The following reference Figure 7To describe an electronic device 700 according to this embodiment of the present application. Figure 7 The electronic device 700 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0103] like Figure 7 As shown, the electronic device 700 is presented in the form of a general-purpose computing device. The components of the electronic device 700 may include, but are not limited to: at least one processing unit 710, at least one storage unit 720, a bus 730 connecting different system components (including storage unit 720 and processing unit 710), a display unit 740, etc.

[0104] The storage unit stores program code that can be executed by the processing unit 710, causing the processing unit 710 to perform the steps described in this specification according to various exemplary embodiments of this application. For example, the processing unit 710 can perform actions such as... Figure 2 , Figure 3 , Figure 4 , Figure 5 The steps are shown in the figure.

[0105] The storage unit 720 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 7201 and / or a cache storage unit 7202, and may further include a read-only memory unit (ROM) 7203.

[0106] The storage unit 720 may also include a program / utility 7204 having a set (at least one) program module 7205, such program module 7205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0107] Bus 730 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0108] Electronic device 700 can also communicate with one or more external devices 700' (e.g., keyboard, pointing device, Bluetooth device, etc.), enabling users to communicate with devices that interact with electronic device 700, and / or any device (e.g., router, modem, etc.) that allows electronic device 700 to communicate with one or more other computing devices. This communication can be performed via input / output (I / O) interface 750. Furthermore, electronic device 700 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 760. Network adapter 760 can communicate with other modules of electronic device 700 via bus 730. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 700, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0109] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software, or by combining software with necessary hardware. Therefore, as... Figure 8 As shown, the technical solution according to the embodiments of this application can be embodied in the form of a software product. The software product can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, mobile hard drive, etc.) or on a network, and includes several instructions to cause a computing device (such as a personal computer, server, or network device, etc.) to execute the above-described method according to the embodiments of this application.

[0110] In summary, this disclosure primarily addresses the scenario where a client sends an application data message shortly after receiving a client-finished message. When the server receives the client-finished message, it first needs to generate a key to decrypt it and verify the content's validity. Only after verification will it calculate the key used to encrypt and decrypt the application data message. This process takes time, and the application data message from the client arrives during this period, preventing the server from processing it immediately. A caching mechanism is needed to wait until the server determines the connection is established before processing. Specifically, this involves two parts: After receiving the client-finished message, the server first generates a key to decrypt it, sends it to the hardware module for decryption, sets the state machine to GET_CLNT_FINISH_ASYN_WAIT, and continues receiving messages. Upon receiving the application data message, it checks if the current state is CONNECTED. If so, it decrypts it directly; otherwise, it sends it to a cache queue for further processing. After the hardware module decrypts the client-finished message and verifies its success, it sets the state to CONNECTED and checks the cache queue for data. If data is present, it decrypts it; otherwise, it continues the subsequent process. The specific process includes: the server receiving the client finished message; generating a key to decrypt the client finished message; sending the client finished message to the hardware encryption / decryption module for decryption; setting the current state to GET_CLNT_FINISH_ASYN_WAIT; receiving applicationdata messages; checking if the current state is CONNECTED, and if so, decrypting directly, otherwise queuing and buffering; the process after the hardware encryption / decryption module has completed decryption of the client finished message includes: decrypting the client finished message into plaintext; verifying if the client finished message is correct, disconnecting directly if incorrect, and continuing to the next step if correct; generating a key for encrypting and decrypting application data messages; setting the current connection state to CONNECTED; and processing the messages buffered in the decryption queue.

[0111] The software product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections with one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0112] The computer-readable storage medium may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable storage medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0113] Program code for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0114] The aforementioned computer-readable medium carries one or more programs, which, when executed by a device, cause the computer-readable medium to perform the following functions: the server obtains the client's application data based on a transport layer security protocol; obtains the TLS negotiation state of the current session; caches the application data when the TLS negotiation state of the current session is in a waiting state; obtains a decryption key when the TLS negotiation state of the current session is in a connected state; and decrypts and processes the application data using the decryption key.

[0115] The computer-readable medium can also perform the following functions: the server obtains the client's send completion message based on the transport layer security protocol, the send completion message being a client finished message; sets the TLS negotiation state of the current session to a waiting state; if the validity check passes, sets the TLS negotiation state of the current session to a connected state; if the validity check fails, disconnects the connection of the current session.

[0116] Those skilled in the art will understand that the above modules can be distributed in the device as described in the embodiments, or they can be modified accordingly and placed in one or more devices that are unique to this embodiment. The modules in the above embodiments can be combined into one module, or they can be further divided into multiple sub-modules.

[0117] Through the description of the above embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this application.

[0118] Exemplary embodiments of this application have been specifically shown and described above. It should be understood that this application is not limited to the detailed structures, arrangements, or implementation methods described herein; rather, this application is intended to cover various modifications and equivalent arrangements contained within the spirit and scope of the appended claims.

Claims

1. A method for processing application data messages for transport layer security protocols, characterized in that, include: The server obtains the client's send completion message based on the transport layer security protocol, and the send completion message is the clientfinished message; Set the TLS negotiation state of the current session to the waiting state; If the validity check passes, the TLS negotiation state of the current session is set to the connected state; The server obtains the client's application data message based on the transport layer security protocol, and the application data message is the application data message. Get the TLS negotiation state of the current session; While the TLS negotiation state of the current session is in the waiting state, the application data message is cached; Obtain the decryption key while the current session's TLS negotiation state is connected; The application data message is decrypted and processed using the decryption key.

2. The method as described in claim 1, characterized in that, The transport layer security protocol is TLS 1.

3.

3. The method as described in claim 1, characterized in that, Before the server obtains the client's send completion message based on the transport layer security protocol, it also includes: The server obtains the client's greeting message based on the transport layer security protocol, and the greeting message is the Client Hello message; The server and client exchange key data and protocol parameters based on greeting messages; After successful authentication, the client generates a message indicating that the sending process is complete.

4. The method as described in claim 1, characterized in that, After setting the TLS negotiation state of the current session to the connected state, the process also includes: Decrypt and process the application data messages in the cache.

5. The method as described in claim 1, characterized in that, Upon successful validity verification, the TLS negotiation state of the current session is set to the connected state, including: Generate the decryption key for the client's send completion message; The client's send completion message is decrypted using the decryption key to generate plaintext data; The legality of the plaintext data is determined; If the legitimacy check passes, the TLS negotiation state of the current session is set to the connected state; If the validity check fails, disconnect the current session.

6. The method as described in claim 5, characterized in that, The client's send completion message is decrypted using the decryption key to generate plaintext data, including: The client's send completion message is decrypted using a hardware decryption module to generate plaintext data.

7. The method as described in claim 5, characterized in that, If the validity check passes, the TLS negotiation state of the current session is set to the connected state, and the method further includes: Generate a decryption key for decrypting the application data messages.

8. The method as described in claim 1, characterized in that, While the TLS negotiation state of the current session is in a waiting state, the application data messages are cached, including: When the TLS negotiation state of the current session is in the waiting state, the application data message is sent to the cache queue for caching.

9. An application data message processing apparatus for a transport layer security protocol, characterized in that, include: The data module is used by the server to obtain the client's sending completion message based on the transport layer security protocol. The sending completion message is a client finished message. The server sets the TLS negotiation state of the current session to a waiting state. When the validity check passes, the server sets the TLS negotiation state of the current session to a connected state. The server also obtains the client's application data based on the transport layer security protocol. The application data is an application data message. The state module is used to obtain the TLS negotiation state of the current session; The caching module is used to cache the application data messages when the TLS negotiation state of the current session is in a waiting state; The key module is used to obtain the decryption key when the TLS negotiation state of the current session is in the connected state; The processing module is used to decrypt and process the application data message using the decryption key.

Images