Communication method, communication device, electronic device, and computer storage medium

Abstract

The present disclosure provides a communication method, a communication device, an electronic device and a computer storage medium, relates to the technical field of communication, and in particular to the technical field of data encryption. The specific implementation scheme is: in response to having created a communication line with a client, configuring a proxy engine as a virtual proxy engine; in response to receiving client handshake data from the client via the communication line, determining version information of an encrypted communication protocol based on the client handshake data, the client handshake data being data used for encrypted communication; updating the virtual proxy engine to a target proxy engine matched with the version information; generating server handshake data based on the client handshake data by using the target proxy engine; and sending the server handshake data to the client.

Description

Technical Field

[0001] This disclosure relates to the field of communication technology, and more particularly to the field of data encryption technology. Specifically, it relates to a communication method, communication device, electronic device, computer storage medium, and program product. Background Technology

[0002] With the continuous development of computer technology, the demand for security in communication processes is also increasing. For example, communication operations need to be completed while adapting to multiple encrypted communication protocols. Summary of the Invention

[0003] This disclosure provides a communication method, a communication device, an electronic device, a computer storage medium, and a computer program product.

[0004] According to one aspect of this disclosure, a communication method is provided, comprising: configuring a proxy engine as a virtual proxy engine in response to an established communication line with a client; determining version information of an encrypted communication protocol based on the client handshake data in response to receiving client handshake data from the client via the communication line, wherein the client handshake data is data used for encrypted communication; updating the virtual proxy engine to a target proxy engine that matches the version information; generating server handshake data using the target proxy engine based on the client handshake data; and sending the server handshake data to the client.

[0005] According to another aspect of this disclosure, a communication apparatus is provided, comprising: a configuration module for configuring a proxy engine as a virtual proxy engine in response to the establishment of a communication line with a client; a version information determination module for determining version information of an encrypted communication protocol based on client handshake data received from the client via the communication line, wherein the client handshake data is data used for encrypted communication; an engine update module for updating the virtual proxy engine to a target proxy engine that matches the version information; a first generation module for generating server handshake data using the target proxy engine based on the client handshake data; and a first sending module for sending the server handshake data to the client.

[0006] According to another aspect of this disclosure, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the methods as disclosed herein.

[0007] According to another aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions, wherein the computer instructions are used to cause a computer to perform the methods as disclosed herein.

[0008] According to another aspect of this disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements the method as disclosed herein.

[0009] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0010] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:

[0011] Figure 1 This illustration schematically shows an exemplary system architecture to which communication methods and apparatus can be applied according to embodiments of the present disclosure;

[0012] Figure 2 A flowchart illustrating a communication method according to an embodiment of the present disclosure is shown schematically;

[0013] Figure 3 A signaling diagram of an encrypted communication connection according to an embodiment of the present disclosure is illustrated schematically;

[0014] Figure 4 A flowchart illustrating the generation of server handshake data according to an embodiment of this disclosure is shown schematically;

[0015] Figure 5 A flowchart illustrating the generation of server handshake data according to another embodiment of this disclosure is shown schematically;

[0016] Figure 6 A block diagram of a communication device according to an embodiment of the present disclosure is schematically shown; and

[0017] Figure 7 A block diagram of an electronic device suitable for implementing a communication method according to an embodiment of the present disclosure is shown schematically. Detailed Implementation

[0018] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0019] For communication between two or more terminals, various encrypted communication protocols can be used. Encrypted communication through these protocols can solve many network security problems. For example, data confidentiality is ensured by encrypting all information during transmission, preventing third parties from sniffing it out; data integrity is checked through MAC (Message Authentication Code) verification mechanisms, so any tampering will be immediately detected by both communicating parties; and identity authentication is achieved by equipping both parties with certificates to prevent identity impersonation.

[0020] According to embodiments of this disclosure, the encrypted communication protocol may include at least one of the following: Secure Sockets Layer (SSL) protocol, Transport Layer Security (TLS) protocol (an upgraded version of SSL), and a national cryptographic SSL protocol enhanced with national cryptographic algorithms. SSL and TLS protocols can be understood as standard SSL protocols.

[0021] Chinese national cryptographic algorithms include symmetric encryption algorithms, elliptic curve asymmetric encryption algorithms, hash algorithms, etc. The Chinese national cryptographic SSL protocol is an upgrade and enhanced version of transport layer security protocols. Chinese national cryptographic SSL employs a dual-certificate mechanism. The server-side key is a key pair using an asymmetric cryptographic algorithm, including a signature key pair and an encryption key pair. The signature key pair is generated by the VPN (Virtual Private Network)'s own cryptographic module, while the encryption key pair is obtained from the KMC (Key Management Center) through a CA (Certificate Authority). These keys are used for server authentication and negotiation of the pre-master key during the handshake process.

[0022] Although the Chinese national cryptographic SSL protocol references the standard SSL protocol, the encryption algorithm used in the Chinese national cryptographic SSL protocol differs from that of the standard SSL protocol when handshaking between two or more terminals. Furthermore, the Chinese national cryptographic SSL protocol has upgraded its certificate management from a single certificate to dual certificates. Therefore, standard SSL and Chinese national cryptographic SSL cannot be seamlessly replaced.

[0023] In IoT scenarios, a large number of devices need to connect to the server via encryption. Some devices support standard SSL protocol communication, while others support Chinese national cryptographic SSL protocol or other encrypted communication protocols. Regarding solutions that adapt multiple encrypted communication protocols through multiple service ports, the inventors discovered that due to the diverse, numerous, and varied client types in the IoT, using multiple service ports to adapt multiple encrypted communication protocols leads to technical problems such as complex and error-prone adaptation operations, high port configuration costs, and high manual maintenance costs.

[0024] To at least partially address the aforementioned technical problems, this disclosure proposes a communication method, comprising: configuring a proxy engine as a virtual proxy engine in response to the establishment of a communication line with a client; determining version information of an encrypted communication protocol based on client handshake data received from the client via the communication line, wherein the client handshake data is data used for encrypted communication; updating the virtual proxy engine to a target proxy engine that matches the version information; generating server handshake data using the target proxy engine based on the client handshake data; and sending the server handshake data to the client.

[0025] In the technical solution disclosed herein, the collection, storage, use, processing, transmission, provision, disclosure, and application of user personal information comply with the provisions of relevant laws and regulations, necessary confidentiality measures have been taken, and there is no violation of public order and good morals.

[0026] In the technical solution disclosed herein, the user's authorization or consent is obtained before acquiring or collecting the user's personal information.

[0027] Figure 1 The illustration schematically depicts an exemplary system architecture to which communication methods and apparatus can be applied according to embodiments of the present disclosure.

[0028] It is important to note that Figure 1 The examples shown are merely examples of system architectures applicable to embodiments of this disclosure, intended to help those skilled in the art understand the technical content of this disclosure. They do not imply that embodiments of this disclosure cannot be used in other devices, systems, environments, or scenarios. For instance, in another embodiment, an exemplary system architecture to which communication methods and devices can be applied may include a client, but the client can implement the communication methods and devices provided in the embodiments of this disclosure without interacting with the server.

[0029] like Figure 1 As shown, the system architecture 100 according to this embodiment may include clients 101, 102, and 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between clients 101, 102, and 103 and the server 105. The network 104 may include various connection types, such as wired and / or wireless communication links, etc.

[0030] Users can use clients 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on clients 101, 102, and 103, such as knowledge reading applications, web browser applications, search applications, instant messaging tools, email clients, and / or social media platform software (for example only).

[0031] Clients 101, 102, and 103 can be various electronic devices with displays and web browsing capabilities, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0032] Server 105 can be a server that provides various services, such as a backend management server that supports the content browsed by users using clients 101, 102, and 103 (for example only). The backend management server can analyze and process encrypted data such as received user requests, encrypt the processing results (such as web pages, information, or data obtained or generated according to user requests), and send the encrypted processing results back to the client.

[0033] The communication method provided in this embodiment can generally also be executed by the server 105. Correspondingly, the communication device provided in this embodiment can generally be located in the server 105. The communication method provided in this embodiment can also be executed by a server or server cluster that is different from the server 105 and capable of communicating with clients 101, 102, 103 and / or the server 105. Correspondingly, the communication device provided in this embodiment can also be located in a server or server cluster that is different from the server 105 and capable of communicating with clients 101, 102, 103 and / or the server 105.

[0034] For example, a communication line has been established between clients 101, 102, and 103 and server 105. In response to the established communication line with the clients, server 105 configures its proxy engine as a virtual proxy engine. Clients 101, 102, and 103 send client handshake data to server 105 via the communication line to establish an SSL handshake connection. In response to receiving the client handshake data, server 105 determines the version information of the encrypted communication protocol based on the client handshake data. It updates the virtual proxy engine to the target proxy engine that matches the version information. Based on the client handshake data, it generates server handshake data using the target proxy engine. Server 105 sends the server handshake data to clients 101, 102, and 103, completing the encrypted communication connection with clients 101, 102, and 103.

[0035] It should be understood that Figure 1 The number of clients, networks, and servers shown is merely illustrative. Depending on implementation needs, there can be any number of clients, networks, and servers.

[0036] It should be noted that the sequence numbers of the operations in the following methods are for descriptive purposes only and should not be considered as indicating the execution order of the operations. Unless explicitly stated otherwise, the method does not need to be executed in the exact order shown.

[0037] Figure 2 A flowchart illustrating a communication method according to an embodiment of the present disclosure is shown schematically.

[0038] like Figure 2 As shown, the method includes operations S210 to S250.

[0039] In operation S210, in response to the established communication line with the client, the proxy engine is configured as a virtual proxy engine.

[0040] In operation S220, in response to receiving client handshake data from the client via the communication line, the version information of the encrypted communication protocol is determined based on the client handshake data.

[0041] In operation S230, the virtual proxy engine is updated to the target proxy engine that matches the version information.

[0042] When operating S240, server-side handshake data is generated based on client handshake data using the target proxy engine.

[0043] When operating the S250, the server-side handshake data is sent to the client.

[0044] According to embodiments of this disclosure, the terminal used for communication can be a client or a server. For example, multiple clients communicate with the same server; or, multiple clients communicate with multiple servers; or, multiple clients communicate with each other and multiple servers communicate with each other.

[0045] According to embodiments of this disclosure, a communication line is established between the client and the server before they communicate. For example, the client and server establish the communication line through a three-way handshake, and the communication line includes a TCP connection based on the Transmission Control Protocol (TCP).

[0046] According to embodiments of this disclosure, a client and server can establish a communication line through the following steps: The client sends a socket connection request to the server. The server receives the socket connection request, processes it, and sends a connection confirmation message to the client. After receiving the connection confirmation message from the server, the client sends another confirmation message to the server. Simultaneously, the client sends a notification to the upper-layer application that the communication line has been established. Thus, a communication line is established between the server and the client.

[0047] According to embodiments of this disclosure, a proxy engine, also known as an engine, allows the server to access third-party hardware encryption devices or software encryption libraries for encrypting or decrypting data during communication.

[0048] According to embodiments of this disclosure, a virtual proxy engine can be understood as a non-physical, virtualized proxy engine. A target proxy engine can be understood as a proxy engine with software or hardware devices that can access third parties.

[0049] For example, for a proxy engine A that is actually installed or configured on the server, proxy engine A can serve as the target proxy engine to perform encryption operations that match the version information of the encrypted communication protocol. To implement the embodiments of this disclosure, a proxy engine B can also be virtualized and used as a virtual proxy engine. In this case, proxy engine B exists only by name; it is not actually installed or configured on the server.

[0050] According to embodiments of this disclosure, a high-performance network communication framework, such as a Netty application, can provide an asynchronous, event-driven network application framework and tools. Once a socket connection is established between the client and the server, the high-performance network communication framework loaded on the server establishes an encrypted communication connection with the client. For example, upon determining that a communication line with the client has been established, the high-performance network communication framework loads an SSL certificate and a proxy engine.

[0051] According to embodiments of this disclosure, in response to the establishment of a communication line with the client, the server can configure the proxy engine as a virtual proxy engine. Specifically, parameters related to the proxy engine can be configured as virtual proxy engines. For example, the target parameter item of the execution object dEngine in the proxy engine can be configured as a parameter value or identifier related to the virtual proxy engine.

[0052] According to embodiments of this disclosure, the client handshake data is data used for encrypted communication. Specifically, the client handshake data includes client-related data used for communication, such as Client Hello data packets. The client handshake data may include version information of encrypted communication protocols supported by the client, such as version information of the Chinese national cryptographic SSL protocol or the standard SSL protocol.

[0053] According to embodiments of this disclosure, the client handshake data may also include encryption-related data used for communication, such as the client-supported cipher suite sequence, random numbers, and other information.

[0054] According to embodiments of this disclosure, in response to the establishment of a communication line with the client, the high-performance network communication framework can perform initialization operations by calling an initialization method, such as the InitialChannel method, in an initialization class, such as the Channel Initializer class. The initialization operations may include configuring the proxy engine as a virtual proxy engine. The current proxy engine is a virtual proxy engine and cannot perform actual functions, such as data encryption operations and generating server-side handshake data.

[0055] According to embodiments of this disclosure, once it is determined that the initialization operation has been completed, the version information of the encrypted communication protocol can be determined based on the client handshake data using a data processing class, such as the data processing method in the Distinguish SSL Handler class.

[0056] According to embodiments of this disclosure, when the version information of the encrypted communication protocol is determined, the virtual proxy engine can be updated to a target proxy engine that matches the aforementioned version information, enabling the server to perform data encryption operations based on the target proxy engine, such as generating server handshake data based on client handshake data.

[0057] According to embodiments of this disclosure, the server may include multiple encrypted communication protocols of different versions, and multiple proxy engines corresponding one-to-one with the version information. When the version information of the encrypted communication protocol is determined based on client handshake data, a target proxy engine matching the version information can be selected from the multiple proxy engines. This allows the current proxy engine to be configured as the actual target proxy engine, enabling communication between the client and server while adapting to the encrypted communication protocol. For example, if the encrypted communication protocol is the Chinese national standard SSL protocol, the Chinese national standard SSL proxy engine is used as the target proxy engine. If the encrypted communication protocol is the standard SSL protocol, the standard SSL proxy engine is used as the target proxy engine.

[0058] According to embodiments of this disclosure, after determining the target proxy engine, the server can generate server-side handshake data based on the client handshake data using the target proxy engine. The server-side handshake data is then sent to the client to notify the client of a successful handshake.

[0059] According to embodiments of this disclosure, in response to the establishment of a communication line with the client, configuring the proxy engine as a virtual proxy engine enables the initialization of a high-performance network communication framework. The version information of the encrypted communication protocol is determined based on the client handshake data, and the virtual proxy engine is updated to the target proxy engine based on this version information. The initialization operation of loading the target proxy engine matching the version information is delayed until the client handshake data has been received. This requires minimal modification to the program code and eliminates the need for proxy, forwarding mechanisms, or intermediate devices. It enables adaptive adaptation to multiple encrypted communication protocols without causing any performance loss or network latency. Furthermore, since the version information of the encrypted communication protocol in the embodiments of this disclosure is determined based on the client handshake data and does not depend on other data, the applicability of the communication method is improved.

[0060] In realizing the above-mentioned inventive concept, the inventors discovered that it is possible to receive client handshake data from clients through a protocol forwarder or proxy node, and determine the protocol type of the encrypted communication protocol based on the client handshake data. The protocol forwarder or proxy node then forwards the client handshake data to the corresponding server, thereby adapting to multiple encrypted communication protocols of different types. Specifically, the proxy node can determine the version information of the encrypted communication protocol by extracting the values ​​of the HTTP header field and the Cipher Suite field, and then forward the client handshake data to the server corresponding to the version information for data encryption.

[0061] Compared to communication methods using protocol repeaters or proxy nodes, the communication method provided in this disclosure eliminates the need for additional protocol repeaters or proxy nodes, as well as the need to configure multiple server sets, thereby reducing system complexity and development and maintenance costs. Furthermore, by avoiding the use of proxy nodes or repeaters, the communication method provided in this disclosure avoids system bottlenecks and thus prevents network latency. Moreover, this disclosure determines the version protocol based on client handshake data, expanding the application scope of the client beyond website-based scenarios.

[0062] Figure 3 A signaling diagram of a communication method according to an embodiment of the present disclosure is illustrated schematically.

[0063] like Figure 3 As shown, the method includes operations S310 to S360.

[0064] When operating S310, the server responds to the establishment of a communication line with the client by configuring the proxy engine as a virtual proxy engine.

[0065] When operating the S320, the server receives client handshake data from the client via the communication line.

[0066] When operating the S330, the server determines the version information of the encrypted communication protocol based on the client's handshake data.

[0067] When operating S340, the server updates the virtual proxy engine to the target proxy engine that matches the version information.

[0068] When operating the S350, the server generates server-side handshake data based on the client handshake data, using the target proxy engine.

[0069] When operating S360, the server sends server handshake data to the client.

[0070] According to embodiments of this disclosure, by configuring a virtual proxy engine, the initialization operation still uses the open-source SSL handshake mechanism. Only the loading timing of the target proxy engine needs to be adjusted, delaying loading until the version information is determined based on the client handshake data. This avoids any modification to the execution logic of the target proxy engine without affecting the timing of the SSL handshake operation.

[0071] According to embodiments of this disclosure, for example, Figure 2 The illustrated operation S220, based on client handshake data, determines the version information of the encrypted communication protocol, including: decoding the client handshake data to obtain first decoded data; determining the content of predetermined fields from the first decoded data; and determining the version information based on the field content.

[0072] According to embodiments of this disclosure, the client can send client handshake data to the server in the form of data packets.

[0073] According to embodiments of this disclosure, during the decoding of client handshake data, the entire client handshake data can be decoded into first decoded data. Alternatively, the client handshake data can be partially decoded to obtain the first decoded data. For example, the client handshake data can be decoded using a decoding method in a data processing class, such as the `Decode` method, to obtain the first decoded data. This decoding operation can be partial decoding, decoding predetermined fields of the client handshake data to determine version information based on the content of the predetermined fields.

[0074] According to embodiments of this disclosure, multiple encrypted communication protocols have the same or similar coding standards, thereby enabling the coding of version information related to the encrypted communication protocol in predetermined fields or predetermined locations based on the same or similar coding standards.

[0075] According to embodiments of this disclosure, upon obtaining first decoded data, the content of a predetermined field in the first decoded data can be read according to the general coding standards of encrypted communication protocols, and version information can be determined based on the field content. This method of determining version information based on the content of predetermined fields is simple to operate, requires minimal code rewriting in the decoding program, and is easy to implement.

[0076] According to embodiments of this disclosure, the field content includes a first field content and a second field content. Determining version information based on the field content includes: determining a data type identification result based on the first field content. If the data type identification result is used to characterize the client handshake data as a handshake data type, then the version information is determined based on the second field content.

[0077] According to embodiments of this disclosure, if the data type identification result indicates that the client handshake data is not a handshake data type, there is no need to determine version information, and subsequent operations can be performed according to the server's predetermined execution logic. For example, an error may occur.

[0078] According to the embodiments of this disclosure, since the data type identification result is first determined based on the content of the first field, and the version information is then determined based on the content of the second field after determining that the data type identification result is used to characterize the client handshake data as a handshake data type, the above two-layer matching operation can improve the identification accuracy and matching efficiency.

[0079] As a specific embodiment, the client handshake data includes multiple bytes. Decoding the client handshake data to obtain the first decoded data may include: decoding the first 6 bytes of the client handshake data to obtain the first decoded data.

[0080] According to embodiments of this disclosure, the content of the first field may include the field content of the first byte and the sixth byte of the client handshake data, and the content of the second field may include the field content of the second byte and the third byte of the client handshake data.

[0081] According to embodiments of this disclosure, the field content of the first byte is used to characterize the packet type (Content Type), the field content of the second byte and the field content of the third byte are used to characterize version information, the field content of the fourth byte and the field content of the fifth byte are used to characterize the length of subsequent data segments, and the field content of the sixth byte is used to characterize the handshake data type.

[0082] For example, for client handshake data, such as the Client Hello data packet, the parsed first byte has a field content of 0x16, indicating a handshake message, and the parsed sixth byte has a field content of 0x01, indicating the client's Client Hello data type. Therefore, based on the field contents of the first and sixth bytes, it can be determined that the data type identification result indicates that the client handshake data is a handshake data type.

[0083] According to embodiments of this disclosure, for the Chinese national cryptographic SSL protocol, the format of the client handshake data is as follows: 16 01 0101 3e 01..., where "16", "01", "01", "01", "3e", and "01" represent the first 6 bytes respectively. The decoded field content can have "0x" added before "16", "01", "01", "01", "3e", and "01", or it can be omitted.

[0084] According to embodiments of this disclosure, when the data type identification result is used to characterize the client handshake data as a handshake data type, determining the version information based on the content of the second field includes: determining the version information that matches the content of the second field from the version list based on the content of the second byte and the third byte.

[0085] According to embodiments of this disclosure, the version list may be a list pre-stored on a server. The version list includes a mapping relationship between the field contents of the second and third bytes and multiple encrypted communication protocols and version information.

[0086] As a specific embodiment, the encrypted communication protocol may include the standard SSL protocol and the Chinese national cryptographic SSL protocol. The version information of the encrypted communication information includes the standard SSL protocol or the Chinese national cryptographic SSL protocol, as well as the version identifier and version name of the standard SSL protocol or the Chinese national cryptographic SSL protocol.

[0087] For example, detailed information about the version list can be found in Table 1 below.

[0088] 0x01 0x01 GMSSL 1.1 (Chinese National Cryptography) 0x03 0x01 Standard TLS 1.0 (TLS 1.0) 0x03 0x02 Standard TLS 1.1 (TLS 1.1) 0x03 0x03 Standard TLS 1.2 (TLS 1.2) 0x03 0x04 Standard TLS 1.3 (TLS 1.3)

[0089] Table 1

[0090] According to the embodiments of this disclosure, since the first 6 bytes of the client handshake data are used as the basis for judgment, there is no need to modify or read the non-client handshake data and the data of the subsequent encrypted data transmission process. While ensuring accurate identification of the version information of the encrypted communication protocol, the performance of the handshake process and subsequent encrypted data transmission can also be guaranteed.

[0091] According to embodiments of this disclosure, when the encrypted communication protocol includes two versions of different types, the following can be performed: Figure 4 The method shown is for generating server-side handshake data.

[0092] Figure 4 A flowchart illustrating the generation of server handshake data according to an embodiment of this disclosure is shown schematically.

[0093] like Figure 4 As shown, the method includes operations S410-S450, S461-S471, and S462-S472.

[0094] When operating the S410, a communication line is created between the server and the client.

[0095] When operating S420, the server configures the proxy engine as a virtual proxy engine.

[0096] When operating the S430, the server receives client handshake data from the client via the communication line.

[0097] When operating the S440, the version information of the encrypted communication protocol is determined based on the client handshake data.

[0098] In operation S450, it is determined whether the version information is the first predetermined version information. If the version information is the first predetermined version information, operations S461 and S462 are executed. If the version information is not the first predetermined version information, operations S471 and S472 are executed.

[0099] In operation S461, the virtual agent engine is updated to match the target agent engine that is compatible with the first version information.

[0100] In operation S462, server handshake data is generated using the target proxy engine that matches the first version information.

[0101] In operation S471, the virtual agent engine is updated to match the target agent engine with the second version information.

[0102] In operation S472, server handshake data is generated using the target proxy engine that matches the first version information.

[0103] According to embodiments of this disclosure, the first version information may refer to the version information of the standard SSL protocol. The second version information may refer to the version information of the Chinese national cryptographic SSL protocol. Through the above operations, it is possible to combine with real-world scenarios. By utilizing open-source encrypted communication programs, only one program needs to be deployed on the server side to monitor one port. With minimal modifications to the code or execution logic, adaptation to different types of encrypted communication protocols can be achieved.

[0104] According to embodiments of this disclosure, when performing such Figure 2Following the operation S210 shown, the communication method may further include the operation of generating an engine identifier in response to a configured virtual agent engine.

[0105] According to embodiments of this disclosure, an engine identifier is used to characterize whether the proxy engine is virtual. In response to the establishment of a communication line with the client, the proxy engine is configured as a virtual proxy engine. In response to the configuration of the virtual proxy engine, an engine identifier is generated to characterize that the proxy engine is virtual. For example, the engine identifier characterizing that the proxy engine is virtual can be "null".

[0106] According to embodiments of this disclosure, by generating an engine identifier, it can be determined whether the current proxy engine is a virtual proxy engine, thereby avoiding configuration errors caused by repeated updates to the proxy engine.

[0107] According to embodiments of this disclosure, when performing such Figure 2 Following the operation S230 shown, the communication method may further include the operation of updating the engine identifier in response to the virtual agent engine being updated to the target agent engine.

[0108] According to embodiments of this disclosure, in response to the establishment of a communication line with the client, the proxy engine is configured as a virtual proxy engine. At this time, the generated engine identifier indicates that the proxy engine is virtual, and the server-side high-performance network communication framework cannot call the actual proxy engine for data encryption operations. Therefore, in response to the virtual proxy engine being updated to the target proxy engine, the engine identifier indicating virtuality can be updated to an engine identifier indicating non-virtuality.

[0109] For example, in response to the establishment of a communication line with the client, the generated engine identifier is "null". In response to the update of the virtual proxy engine to the target proxy engine, the engine identifier can be updated from "null" to "1", where "1" represents a non-virtual proxy engine, such as the target proxy engine. The engine identifier representing a non-virtual proxy engine is not limited to "1" and can also be 0, 1, 2, or other values, as long as it is different from the engine identifier representing a virtual proxy engine.

[0110] According to embodiments of this disclosure, by updating the engine identifier in real time in response to the virtual proxy engine being updated to the target proxy engine, it is possible to determine in a timely manner whether the current proxy engine has been updated based on the engine identifier, thereby improving operational accuracy.

[0111] According to embodiments of this disclosure, when performing such Figure 2 Following operation S250, the communication method may further include the operation of: determining an engine identifier in response to receiving client handshake data. If the engine identifier is determined to be used to characterize the proxy engine as the target proxy engine, server-side handshake data is generated based on the client handshake data and utilizing the target proxy engine.

[0112] According to embodiments of this disclosure, after operations S210 to S250, the client can continue to send client handshake data to the server to complete subsequent handshake operations. Since operations S210 to S250 have already completed the configuration of the proxy engine as a virtual proxy engine and the update of the virtual proxy engine to the target proxy engine, the engine identifier indicates that the proxy engine is the target proxy engine. When the engine identifier is used to indicate that the proxy engine is the target proxy engine, server handshake data can be directly generated using the target proxy engine based on the client handshake data, without needing to repeatedly update the target proxy engine.

[0113] According to embodiments of this disclosure, if it is determined that the engine identifier is used to characterize that the proxy engine is not the target proxy engine, indicating that the handshake has failed or that this handshake is the first connection, operations S220 and S230 can be performed to determine the version information of the encrypted communication protocol based on the client handshake data and update the engine identifier so as to update the virtual proxy engine to the target proxy engine that matches the version information.

[0114] According to embodiments of this disclosure, the loaded target proxy engine can be identified by the engine identifier, avoiding repeated updates and improving processing efficiency.

[0115] Figure 5 A flowchart illustrating the generation of server handshake data according to another embodiment of this disclosure is shown.

[0116] like Figure 5 As shown, the method includes operations S510 to S560.

[0117] When operating the S510, client handshake data is received from the client via the communication line.

[0118] In operation S520, determine whether the engine identifier indicates that the proxy engine is virtual. If it is determined that the engine identifier indicates that the proxy engine is virtual, execute operations S530 to S560. If it is determined that the engine identifier indicates that the proxy engine is not virtual, execute operation S560.

[0119] When operating the S530, the version information of the encrypted communication protocol is determined based on the client handshake data.

[0120] When operating S540, update the virtual proxy engine to the target proxy engine that matches the version information.

[0121] When operating the S550, update the engine identifier.

[0122] When operating S560, the target proxy engine is used to generate server-side handshake data.

[0123] According to embodiments of this disclosure, an encrypted communication protocol connection, such as an SSL connection, is established between the server and the client. Multiple client handshake data transmissions from the client are required. The proxy engine can be configured as a virtual proxy engine after establishing the communication line before the first reception of the client handshake data from the client. When the server receives the client handshake data from the client for the second time, the target proxy engine directly generates server handshake data based on the second client handshake data received by the server.

[0124] According to embodiments of this disclosure, for example, Figure 2 The illustrated operation S240, which generates server-side handshake data based on client-side handshake data using a target proxy engine, may include: decoding the client-side handshake data using the target proxy engine to obtain second decoded data; determining client-side encryption protocol data from the second decoded data; obtaining server-side encryption protocol data that matches the client-side encryption protocol data using the target proxy engine; and generating server-side handshake data based on the server-side encryption protocol data.

[0125] According to embodiments of this disclosure, when the virtual proxy engine is updated to the target proxy engine, the target proxy engine can be used for subsequent operations such as certificate verification. Therefore, the target proxy engine can be used to decode the client handshake data to obtain second decoded data. The second decoded data may include first decoded data and client encryption protocol data. The first decoded data is used to determine the version information of the encrypted communication protocol, and the client encryption protocol data is used for subsequent handshake operations.

[0126] According to embodiments of this disclosure, client-side encryption protocol data may include a list of cipher suites supported by the client, random numbers, etc. Client-side encryption protocol data can be determined from second decoded data based on predetermined encrypted field content. When client-side encryption protocol data is determined from the second decoded data, the target proxy engine can obtain server-side encryption protocol data matching the client-side encryption protocol data from a third-party hardware encryption device or software encryption library. The server uses the target proxy engine to generate server-side handshake data based on the server-side encryption protocol data. An encrypted communication connection, such as an SSL handshake connection, can be established between the server and client by repeatedly receiving client-side handshake data from the client and repeatedly sending server-side handshake data to the client.

[0127] According to other embodiments of this disclosure, the communication method may further include the operation of loading a protocol certificate that matches version information. The protocol certificate may be a digital certificate configured on the server side. Data encryption and authentication can be performed using the protocol certificate.

[0128] According to embodiments of this disclosure, upon determining that a protocol certificate matching the version information has been loaded, a server-side handshake data is generated using a target proxy engine based on the server-side encrypted protocol data and the digital version of the protocol certificate. This confirms that an encrypted communication connection has been established between the client and the server.

[0129] According to embodiments of this disclosure, the communication method provided by these embodiments can adaptively establish encrypted communication connections with multiple clients loaded with different encrypted communication protocols, thereby expanding the application scope and improving applicability.

[0130] According to embodiments of this disclosure, when an encrypted communication connection, such as an SSL handshake connection, is established between the client and the server, the communication method may further include the following operations: in response to receiving client communication data, generating server communication data based on the client communication data using a target proxy engine; and sending the server communication data to the client.

[0131] According to embodiments of this disclosure, client communication data can refer to encrypted communication messages. Client communication data can be data encrypted using an encryption algorithm that matches the version information of the communication encryption protocol. A target proxy engine can be used to decode the client communication data to obtain decoded communication data. Based on the decoded communication data, unencrypted data for feedback to the client is generated. The target proxy engine obtains an encryption algorithm matching the version protocol and encrypts the unencrypted data for feedback to the client, generating server communication data. The server sends the server communication data to the client, completing the encrypted data communication.

[0132] According to embodiments of this disclosure, a target proxy engine is used to process encrypted client communication data from the client and send encrypted server communication data from the client, thereby realizing encrypted data transmission between the server and the client and improving the security of data transmission.

[0133] Figure 7 A block diagram of a communication device according to an embodiment of the present disclosure is shown schematically.

[0134] like Figure 7 As shown, the communication device 700 includes: a configuration module 710, a version information determination module 720, an engine update module 730, a first generation module 740, and a first sending module 750.

[0135] Configuration module 710 is used to configure the proxy engine as a virtual proxy engine in response to the established communication line with the client.

[0136] The version information determination module 720 is used to determine the version information of the encrypted communication protocol based on client handshake data received from the client via the communication line. The client handshake data is used for encrypted communication.

[0137] Engine update module 730 is used to update the virtual proxy engine to the target proxy engine that matches the version information.

[0138] The first generation module 740 is used to generate server-side handshake data based on client-side handshake data using the target proxy engine.

[0139] The first sending module 750 is used to send server handshake data to the client.

[0140] According to embodiments of this disclosure, the version information determination module includes: a first decoding submodule, a field determination submodule, and a version determination submodule.

[0141] The first decoding submodule is used to decode the client handshake data to obtain the first decoded data.

[0142] The field determination submodule is used to determine the field content of a predetermined field from the first decoded data.

[0143] The version determination submodule is used to determine version information based on field content.

[0144] According to embodiments of this disclosure, the field content includes a first field content and a second field content.

[0145] According to embodiments of this disclosure, the version determination submodule includes an identification unit and a version determination unit.

[0146] The identification unit is used to determine the data type identification result based on the content of the first field.

[0147] The version determination unit is used to determine version information based on the content of the second field when the data type identification result is used to characterize the client handshake data as a handshake data type.

[0148] According to embodiments of this disclosure, the communication device further includes a second generation module.

[0149] The second generation module generates an engine identifier in response to a configured virtual proxy engine. The engine identifier is used to identify whether the proxy engine is virtual.

[0150] According to embodiments of this disclosure, the communication device further includes an identifier update module.

[0151] The identifier update module is used to update the engine identifier in response to the virtual proxy engine being updated to the target proxy engine.

[0152] According to embodiments of this disclosure, the communication device further includes: an engine identifier determination module and a third generation module.

[0153] The engine identifier determination module is used to determine the engine identifier in response to receiving handshake data from the client.

[0154] The third generation module is used to generate server-side handshake data based on the client handshake data and utilizing the target proxy engine, provided that the engine identifier is used to characterize the proxy engine as the target proxy engine.

[0155] According to embodiments of this disclosure, the first generation module includes: a second decoding submodule, a client encryption protocol determination submodule, a server encryption protocol determination submodule, and a generation submodule.

[0156] The second decoding submodule is used to decode the client handshake data using the target proxy engine to obtain the second decoded data.

[0157] The client encryption protocol determination submodule is used to determine the client encryption protocol data from the second decoded data.

[0158] The server-side encryption protocol determination submodule is used to obtain server-side encryption protocol data that matches the client-side encryption protocol data using the target proxy engine.

[0159] The generation submodule is used to generate server handshake data based on server-side encrypted protocol data.

[0160] According to embodiments of this disclosure, the communication device further includes a loading module.

[0161] The loading module is used to load the protocol certificate that matches the version information.

[0162] According to embodiments of this disclosure, the communication device further includes a fourth generation module and a second transmission module.

[0163] The fourth generation module is used to generate server-side communication data based on the received client communication data using the target proxy engine.

[0164] The second sending module is used to send server-side communication data to the client.

[0165] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0166] According to an embodiment of the present disclosure, an electronic device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform a method as described in the embodiments of the present disclosure.

[0167] According to embodiments of the present disclosure, a non-transitory computer-readable storage medium stores computer instructions, wherein the computer instructions are used to cause a computer to perform methods as described in embodiments of the present disclosure.

[0168] According to embodiments of the present disclosure, a computer program product includes a computer program that, when executed by a processor, implements the methods as described in embodiments of the present disclosure.

[0169] Figure 7 A schematic block diagram of an example electronic device 700 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0170] like Figure 7 As shown, device 700 includes a computing unit 701, which can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) 702 or a computer program loaded from storage unit 708 into random access memory (RAM) 703. RAM 703 may also store various programs and data required for the operation of device 700. The computing unit 701, ROM 702, and RAM 703 are interconnected via bus 704. Input / output (I / O) interface 705 is also connected to bus 704.

[0171] Multiple components in device 700 are connected to I / O interface 705, including: input unit 706, such as keyboard, mouse, etc.; output unit 707, such as various types of monitors, speakers, etc.; storage unit 708, such as disk, optical disk, etc.; and communication unit 709, such as network card, modem, wireless transceiver, etc. Communication unit 709 allows device 700 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0172] The computing unit 701 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 701 performs the various methods and processes described above, such as communication methods. For example, in some embodiments, the communication method may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 708. In some embodiments, part or all of the computer program may be loaded and / or installed on device 700 via ROM 702 and / or communication unit 709. When the computer program is loaded into RAM 703 and executed by the computing unit 701, one or more steps of the communication method described above may be performed. Alternatively, in other embodiments, the computing unit 701 may be configured to perform the communication method by any other suitable means (e.g., by means of firmware).

[0173] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0174] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0175] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0176] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0177] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0178] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, distributed system servers, or servers incorporating blockchain technology.

[0179] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0180] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A communication method, comprising: In response to the established communication line with the client, the target parameter item of the network communication framework regarding the proxy engine is configured as the engine identifier of the virtual proxy engine to complete the initialization operation. The network communication framework is used for encrypted communication with the client. In response to receiving client handshake data from the client via the communication line, the client handshake data is decoded to obtain first decoded data; Based on a general writing standard for encrypted communication protocols, the content of a predetermined field is determined from the first decoded data. The general writing standard is a writing standard that is followed by multiple encrypted communication protocols. The general writing standard includes writing version information related to the encrypted communication protocol in the predetermined field. Based on the content of the field, the version information of the encrypted communication protocol is determined, wherein the client handshake data is data used for encrypted communication; In response to the fact that a target proxy engine matching the version information has been loaded, the target parameter item is updated from the engine identifier of the virtual proxy engine to the engine identifier of the target proxy engine; Based on the client handshake data, server handshake data is generated using the target proxy engine; and The server handshake data is sent to the client.

2. The method according to claim 1, wherein, The field content includes the first field content and the second field content. Determining the version information of the encrypted communication protocol based on the content of the field includes: Based on the content of the first field, the data type identification result is determined; and If the data type identification result is determined to characterize the client handshake data as a handshake data type, the version information is determined based on the content of the second field.

3. The method according to claim 1, further comprising: In response to receiving the client handshake data, the engine identifier is determined; as well as If the engine identifier is determined to be used to characterize the proxy engine as the target proxy engine, the server-side handshake data is generated based on the client handshake data and using the target proxy engine.

4. The method according to any one of claims 1 to 3, wherein, The step of generating server-side handshake data based on the client handshake data, using the target proxy engine, includes: The target proxy engine is used to decode the client handshake data to obtain second decoded data; Determine the client encryption protocol data from the second decoded data; Using the target proxy engine, obtain server-side encryption protocol data that matches the client-side encryption protocol data; and The server-side handshake data is generated based on the server-side encryption protocol data.

5. The method according to any one of claims 1 to 3, further comprising: In response to receiving client communication data, the target proxy engine generates server communication data based on the client communication data. as well as The server-side communication data is sent to the client.

6. A communication device, comprising: The configuration module is used to configure the target parameter item of the network communication framework about the proxy engine as the engine identifier of the virtual proxy engine in response to the established communication line with the client, so as to complete the initialization operation. The network communication framework is used for encrypted communication between the network communication framework and the client. The version information determination module is used to determine the version information of the encrypted communication protocol based on the client handshake data received from the client via the communication line in response to the client handshake data received via the communication line. The client handshake data is data used for encrypted communication. An engine update module is used to update the virtual proxy engine to a target proxy engine that matches the version information; in response to the target proxy engine that matches the version information being loaded, the target parameter item is updated from the engine identifier of the virtual proxy engine to the engine identifier of the target proxy engine; The first generation module is used to generate server-side handshake data based on the client handshake data and using the target proxy engine; and The first sending module is used to send the server handshake data to the client; The version information determination module includes: The first decoding submodule is used to decode the client handshake data to obtain the first decoded data; The field determination submodule is used to determine the content of a predetermined field from the first decoded data based on a common coding standard for encrypted communication protocols. The common coding standard is a coding standard followed by multiple encrypted communication protocols, and includes writing version information related to the encrypted communication protocol in the predetermined field. The version determination submodule is used to determine the version information based on the content of the field.

7. The apparatus according to claim 6, wherein, The field content includes the first field content and the second field content. The version determination submodule includes: The identification unit is configured to determine the data type identification result based on the content of the first field; and The version determination unit is used to determine the version information based on the content of the second field when it is determined that the data type identification result is used to characterize the client handshake data as a handshake data type.

8. The apparatus according to claim 6, further comprising: An engine identifier determination module is used to determine the engine identifier in response to receiving the client handshake data; as well as The third generation module is used to generate the server handshake data based on the client handshake data and using the target proxy engine, when it is determined that the engine identifier is used to characterize the proxy engine as the target proxy engine.

9. The apparatus according to any one of claims 6 to 8, wherein, The first generation module includes: The second decoding submodule is used to decode the client handshake data using the target proxy engine to obtain second decoded data; A client encryption protocol determination submodule is used to determine client encryption protocol data from the second decoded data; The server-side encryption protocol determination submodule is used to obtain server-side encryption protocol data that matches the client-side encryption protocol data using the target proxy engine; and A generation submodule is used to generate the server handshake data based on the server-side encryption protocol data.

10. The apparatus according to any one of claims 6 to 8, further comprising: The fourth generation module is used to generate server-side communication data based on the client-side communication data in response to receiving client-side communication data, using the target proxy engine. as well as The second sending module is used to send the server-side communication data to the client.

11. An electronic device, comprising: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 5.

12. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to any one of claims 1 to 5.

13. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 5.

Images