Ssl session establishment method, server and storage medium

Abstract

The embodiment of the application provides a kind of SSL session establishment method, server and storage medium, belong to Internet field.The method comprises: according to the Client Hello message sent by client, Server Hello message and digital certificate are sent to client, and the authentication result information returned after the authentication of digital certificate by client is obtained;When determining that the authentication result information is authentication failure, if the transmission control protocol TCP reconnection message sent by client is obtained, then TCP reconnection message is not responded, and the number of TCP reconnection message is determined;When the number of TCP reconnection message is greater than the preset number threshold, according to the Client Hello message and Server Hello message, the SSL session between client and the server is established.The SSL session establishment method improves the rate of the page of client accessing server.

Description

Technical Field

[0001] This invention relates to the field of Internet technology, and more particularly to an SSL session establishment method, server, and storage medium. Background Technology

[0002] Hypertext Transfer Protocol over SecureSocketLayer (HTTPS) is a network protocol built on Secure Sockets Layer (SSL) and Hypertext Transfer Protocol (HTTP) that enables encrypted transmission and authentication. It can prevent data from being stolen or altered during transmission, improve the security of data transmission, and ensure data integrity.

[0003] Currently, the HTTPS protocol is widely used for data transmission between clients and servers. Before data transmission can occur between a client and a server, an SSL session needs to be established. This process requires a digital certificate. As a result, many enterprises now have increasingly higher security requirements for digital certificates. The higher the encryption level of a digital certificate, the higher the requirements for the server's memory and CPU. If the server has limited memory and low CPU processing power, it will take longer to establish an SSL session, affecting the speed at which the client accesses the server's pages. Summary of the Invention

[0004] This invention provides an SSL session establishment method, a server, and a storage medium, aiming to improve the speed at which clients access pages on the server.

[0005] In a first aspect, embodiments of the present invention provide an SSL session establishment method, applied to a server, the method comprising:

[0006] Based on the Client Hello message sent by the client, send a Server Hello message and a digital certificate to the client, and obtain the authentication result information returned by the client after authenticating the digital certificate;

[0007] When the authentication result information is determined to be authentication failure, if a Transmission Control Protocol (TCP) reconnection message sent by the client is obtained, the number of TCP reconnection messages is determined.

[0008] When the number of TCP reconnection messages exceeds a preset threshold, an SSL session is established between the client and the server based on the Client Hello message and the Server Hello message.

[0009] Secondly, embodiments of the present invention also provide a server, the server including a processor, a memory, a computer program stored in the memory and executable by the processor, and a data bus for implementing connection communication between the processor and the memory, wherein when the computer program is executed by the processor, it implements the SSL session establishment method as described above.

[0010] Thirdly, embodiments of the present invention also provide a storage medium for computer-readable storage, wherein the storage medium stores one or more programs that can be executed by one or more processors to implement the SSL session establishment method described above.

[0011] This invention provides an SSL session establishment method, server, and storage medium. The method involves obtaining the authentication result information returned by the client after authenticating the server's digital certificate during the establishment of an SSL session between the client and the server. If the authentication result indicates failure, and a Transmission Control Protocol (TCP) reconnection message sent by the client is received, the method does not respond to the TCP reconnection message and determines the number of TCP reconnection messages. Then, when the number of TCP reconnection messages exceeds a preset threshold, an SSL session is established between the client and the server based on ClientHello and ServerHello messages. Because the server does not respond to a large number of suspicious TCP reconnection messages, it can save the memory and CPU resources required to respond to TCP reconnection messages. This allows the server to concentrate its memory and CPU resources to quickly establish an SSL session between the server and the client, reducing the SSL session establishment time and improving the speed at which the client accesses the server's pages. Attached Figure Description

[0012] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 A schematic diagram of a scenario for implementing the SSL session establishment method provided in the embodiments of the present invention;

[0014] Figure 2 A flowchart illustrating an SSL session establishment method provided in an embodiment of the present invention;

[0015] Figure 3 for Figure 2 A flowchart illustrating the sub-steps of the SSL session establishment method in the document;

[0016] Figure 4 A flowchart illustrating another SSL session establishment method provided in an embodiment of the present invention;

[0017] Figure 5 This is a schematic block diagram of a server structure provided in an embodiment of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] The flowchart shown in the attached diagram is for illustrative purposes only and does not necessarily include all content and operations / steps, nor does it necessarily have to be performed in the order described. For example, some operations / steps can be broken down, combined, or partially merged, so the actual execution order may change depending on the actual situation.

[0020] It should be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0021] Currently, the HTTPS protocol is widely used for data transmission between clients and servers. Before data transmission can occur between clients and servers, an SSL session needs to be established. This process requires a digital certificate. Many enterprises now have increasingly higher security requirements for digital certificates. Higher-level encryption certificates place higher demands on server memory and CPU. The inventors discovered that when servers have limited memory and low CPU processing power, using high-level HTTPS digital certificates takes significantly longer to establish an SSL session. This results in very slow page loading speeds for clients, typically taking around 50 seconds or even longer to open a website's homepage, leading to a poor user experience.

[0022] To address the aforementioned issues, the inventors analyzed captured TCP packets or Transport Layer Security (TLS) packets and discovered that the server consumes significant amounts of memory and CPU resources when parsing the client's Client Hello message and handling processes where the client has low trust in the server's digital certificate. Furthermore, this high memory and CPU usage is due to the server responding to a large number of TCP reconnection packets. Therefore, this invention provides an SSL session establishment method. During the establishment of an SSL session between a client and a server, the method obtains the authentication result information returned by the client after authenticating the server's digital certificate. If the authentication result indicates authentication failure, and a Transmission Control Protocol (TCP) reconnection message sent by the client is obtained, the method does not respond to the TCP reconnection message and determines the number of TCP reconnection messages. Then, when the number of TCP reconnection messages exceeds a preset threshold, an SSL session between the client and the server is established based on the Client Hello message and the Server Hello message. Because the server does not respond to a large number of suspicious TCP reconnection messages, it can save the memory and CPU resources required to respond to TCP reconnection messages. This allows the server to concentrate its memory and CPU resources to quickly establish an SSL session between the server and the client, thereby reducing the SSL session establishment time and improving the speed at which the client accesses the server's pages.

[0023] The following detailed description of some embodiments of the present invention is provided in conjunction with the accompanying drawings. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0024] Please see Figure 1 , Figure 1 This is a schematic diagram illustrating a scenario for implementing the SSL session establishment method provided in this embodiment of the invention. Figure 1 As shown, this scenario includes a client 11 and a server 12. The client 11 communicates with the server 12 and establishes an SSL session with the server 12 via the HTTPS protocol. The client 11 can include a browser, smartphone, tablet, personal computer (PC), laptop, etc. The server 12 can be a standalone server, a server cluster consisting of multiple servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0025] In one embodiment, when client 11 wants to access server 12, the client generates a Client Hello message and sends it to server 12. When server 12 receives the Client Hello message, it sends a Server Hello message and a digital certificate to client 11 based on the Client Hello message. Client 11 uses the public key information recorded in the built-in root certificate to authenticate the digital certificate, obtains the authentication result information, and sends the authentication result information to server 12. If the authentication result information indicates authentication failure, client 11 disconnects the TCP connection with server 12 and then sends a TCP reconnection message to server 12. When server 12 receives the authentication result information sent by client 11, it determines whether the authentication result information indicates authentication failure. If the authentication result information indicates authentication failure, i.e., client 12 does not trust the digital certificate sent by server 12, and if it receives the TCP reconnection message sent by client 11, it does not respond to the TCP reconnection message and determines the number of TCP reconnection messages. Then, when the number of TCP reconnection messages exceeds a preset threshold, it establishes an SSL session between client 11 and server 12 based on the Client Hello message and Server Hello message.

[0026] The following will combine Figure 1 The following scenario provides a detailed description of the SSL session establishment method provided by the embodiments of the present invention. It should be noted that... Figure 1 The scenarios described are only used to explain the SSL session establishment method provided in the embodiments of the present invention, but do not constitute a limitation on the application scenarios of the SSL session establishment method provided in the embodiments of the present invention.

[0027] Please see Figure 2 , Figure 2 This is a flowchart illustrating an SSL session establishment method provided in an embodiment of the present invention.

[0028] like Figure 2 As shown, the SSL session establishment method includes steps S101 to S103.

[0029] Step S101: Based on the Client Hello message sent by the client, send a Server Hello message and a digital certificate to the client, and obtain the authentication result information returned by the client after authenticating the digital certificate.

[0030] The Client Hello message includes a list of cipher suites supported by the client, a random number, and SSL version information. The cipher suite list includes cipher suites supported by the client, and each cipher suite includes a key exchange algorithm, encryption algorithm, digest algorithm, and pseudo-random function. The Server Hello message includes SSL version information, a random number, SessionID, and the negotiated cipher suite.

[0031] In this embodiment, before the client needs to establish an SSL session with the server, a TCP connection is established between the client and the server. After the TCP connection between the client and the server is successfully established, the client sends a Client Hello message to the server. The server enables a listener. When it hears the Client Hello message sent by the client, the server records the Client Hello message through the message recording module, and sends a Server Hello message to the client based on the heard Client Hello message. At the same time, it sends a digital certificate to the client, and then obtains the authentication result information returned by the client after authenticating the digital certificate.

[0032] The client stores the root certificate, and the server stores the digital certificate. Both the root certificate and the digital certificate are generated by the CA device. For example, the server generates a first private key and a first public key, and sends the first public key to the CA device; the CA device generates a second private key and a second public key, and uses the second private key to sign the first public key to generate a digital certificate. The digital certificate is then sent to the server for storage, and the root certificate and the second public key are sent to the client for storage.

[0033] In one embodiment, such as Figure 3 As shown, step S101 includes sub-steps S1011 to S1013.

[0034] Sub-step S1011: Based on the Client Hello message, determine the first list of cipher suites supported by the client.

[0035] For example, it is determined whether an extended message exists in the Client Hello message. If no extended message exists in the Client Hello message, the list of cipher suites in the Client Hello message is determined as the first list of cipher suites supported by the client. The Client Hello message includes a list of cipher suites supported by the client, and the first list of cipher suites includes multiple cipher suites supported by the client. For example, if the list of cipher suites in the Client Hello message includes cipher suite A, cipher suite B, cipher suite C, cipher suite D, cipher suite E, and cipher suite F, since no extended message exists in the Client Hello message, the list of cipher suites in the Client Hello message can be determined as the first list of cipher suites, that is, the first list of cipher suites includes cipher suite A, cipher suite B, cipher suite C, cipher suite D, cipher suite E, and cipher suite F.

[0036] For example, when extended messages exist in the Client Hello message, the number of extended messages in the Client Hello message is determined; when the number of extended messages is greater than or equal to a preset threshold, the extended cipher suites supported by the client are determined based on a portion of the extended messages in the Client Hello message; and a first cipher suite list supported by the client is determined based on the cipher suite list in the Client Hello message and the extended cipher suites. The preset threshold can be set based on actual conditions, and this embodiment does not impose a specific limitation on it; for example, the preset threshold can be 1 or 2. By determining the extended cipher suites supported by the client based on a portion of the extended messages in the Client Hello message when multiple extended messages exist, the waste of server memory and CPU resources can be further reduced, and processing efficiency can be improved, thereby increasing the speed of SSL session establishment.

[0037] For example, determining the extended cipher suites supported by the client based on a portion of the extended messages in the Client Hello message may include: determining the order of the extended messages in the Client Hello message, and reading the extended messages sequentially from the Client Hello message according to the order of the extended messages in the Client Hello message until the number of extended messages read reaches a preset threshold; and determining the extended cipher suites supported by the client based on the read extended messages.

[0038] For example, a Client Hello message includes extended messages a, b, c, d, and e, and the order of extended messages a, b, c, d, and e in the Client Hello message is extended message d, extended message b, extended message c, extended message a, and extended message e. If the preset threshold is 1, the server reads extended message d and determines the cipher suite J in extended message d as the extended cipher suite supported by the client. The cipher suite list in the Client Hello message includes cipher suite A, cipher suite B, cipher suite C, cipher suite D, cipher suite E, and cipher suite F. After adding the extended cipher suite, the first cipher suite list includes cipher suite A, cipher suite B, cipher suite C, cipher suite D, cipher suite E, cipher suite F, and cipher suite J.

[0039] For example, if the preset threshold is 2, the server reads extended message d and extended message b from the Client Hello message in sequence, and determines the cipher suite J in extended message d and the cipher suite K in extended message b as the extended cipher suites supported by the client. The cipher suite list in the Client Hello message includes cipher suite A, cipher suite B, cipher suite C, cipher suite D, cipher suite E and cipher suite F. After adding the extended cipher suites, the first cipher suite list includes cipher suite A, cipher suite B, cipher suite C, cipher suite D, cipher suite E, cipher suite F, cipher suite J and cipher suite K.

[0040] For example, when the number of extended messages is less than a preset threshold, the extended cipher suites supported by the client are determined based on all extended messages in the Client Hello message; and the first list of cipher suites supported by the client is determined based on the cipher suite list and the extended cipher suites in the Client Hello message. By analyzing all extended messages in the Client Hello message when the number of extended messages is less than the preset threshold to determine the extended cipher suites supported by the client, the amount of extended messages to be analyzed is small, which can further reduce the waste of server memory and CPU resources, improve processing efficiency, and thus increase the speed of SSL session establishment.

[0041] Sub-step S1012: Determine the target encryption suite from the first encryption suite list according to the second encryption suite list pre-configured by the server.

[0042] For example, an encryption suite is selected from the first encryption suite list and matched against each encryption suite in the second encryption suite list. If no matching encryption suite is found, an encryption suite is selected from the remaining encryption suites in the first encryption suite list and matched against each encryption suite in the second encryption suite list. If a matching encryption suite is found, the matched encryption suite is determined as the target encryption suite. The second encryption suite list includes multiple encryption suites supported by the server.

[0043] For example, if the first cipher suite list includes cipher suite A, cipher suite B, cipher suite C, cipher suite D, cipher suite E, and cipher suite F, and the second cipher suite list includes cipher suite a, cipher suite b, cipher suite c, cipher suite D, and cipher suite e, then cipher suite A is selected for matching against cipher suite a, cipher suite B, cipher suite c, cipher suite D, and cipher suite e in the second cipher suite list. If no matching cipher suite is found, then cipher suite B is matched against cipher suite a, cipher suite B, cipher suite c, cipher suite D, and cipher suite e in the second cipher suite list. If a matching cipher suite B is found during the matching process, then the matching stops, and cipher suite B is identified as the target cipher suite.

[0044] Sub-step S1013: Generate a Server Hello message based on the target encryption suite, and send the Server Hello message and digital certificate to the client.

[0045] The generated Server Hello message includes the target cipher suite, SSL version information, a random number, and a SessionID. The target cipher suite defines the cipher suite used in this SSL session. The SSL version information in the Server Hello message determines the SSL version for this SSL session. The random number in the Server Hello message has the same composition as the random number in the Client Hello message. The SessionID is used to identify the SSL session.

[0046] Step S102: When the authentication result information is determined to be authentication failure, if a Transmission Control Protocol (TCP) reconnection message sent by the client is obtained, then the TCP reconnection message is not responded to, and the number of TCP reconnection messages is determined.

[0047] In this step, when the client obtains the digital certificate sent by the server, it uses the stored root certificate and second public key to authenticate the digital certificate, obtains the authentication result information, and sends the authentication result information to the server. Based on the authentication result information, it can be confirmed whether the server is trustworthy. If the authentication result information is successful, the server can be determined to be trustworthy. If the authentication result information is untrustworthy, the server can be determined to be untrustworthy. At this time, the client disconnects the TCP connection with the server and then sends a TCP reconnection message to the server.

[0048] Step S103: When the number of TCP reconnection messages exceeds a preset threshold, establish an SSL session between the client and the server based on the Client Hello message and the Server Hello message.

[0049] The preset threshold can be set based on actual conditions, and this embodiment of the invention does not impose specific limitations on it. For example, if the preset threshold is 6, then when the number of TCP reconnection packets is greater than 6, an SSL session between the client and the server is established based on the Client Hello message and the Server Hello message.

[0050] For example, when the number of TCP reconnection packets exceeds a preset threshold, the server sends a Server Hello Done message to the client. Upon receiving the Server Hello Done message, the client calculates the target random number pre-master using the key exchange algorithm in the target cipher suite, combining the random numbers in the Client Hello and Server Hello messages. Based on these random numbers, the client calculates the symmetric key. The client then encrypts the target random number pre-master using the server's public key, obtaining ciphertext, and sends it to the server. The server decrypts the ciphertext using its private key, obtaining the target random number pre-master, and calculates the symmetric key based on the random numbers in the Client Hello, Server Hello, and Server Hello messages, thus completing the key exchange. Key verification is then performed. After successful key verification, an SSL session is established between the client and server, and they communicate using the symmetric key.

[0051] The SSL session establishment method provided in the above embodiments obtains the authentication result information returned by the client after authenticating the server's digital certificate during the establishment of an SSL session between the client and the server. If the authentication result information indicates authentication failure, and a Transmission Control Protocol (TCP) reconnection message sent by the client is obtained, the method does not respond to the TCP reconnection message and determines the number of TCP reconnection messages. Then, when the number of TCP reconnection messages exceeds a preset threshold, an SSL session between the client and the server is established based on the Client Hello message and the Server Hello message. Since the server does not respond to a large number of suspicious TCP reconnection messages, it can save the memory and CPU resources required to respond to TCP reconnection messages. This allows the server to concentrate its memory and CPU resources to quickly establish an SSL session between the server and the client, thereby reducing the SSL session establishment time and improving the speed at which the client accesses the server's pages.

[0052] Please see Figure 4 , Figure 4 This is a flowchart illustrating another SSL session establishment method provided in an embodiment of the present invention.

[0053] like Figure 4 As shown, the SSL session establishment method includes steps S201 to 204.

[0054] Step S201: Based on the Client Hello message sent by the client, send a Server Hello message and a digital certificate to the client, and obtain the authentication result information returned by the client after authenticating the digital certificate.

[0055] The Client Hello message includes a list of cipher suites supported by the client, a random number, and SSL version information. The cipher suite list includes cipher suites supported by the client, and each cipher suite includes a key exchange algorithm, encryption algorithm, digest algorithm, and pseudo-random function. The Server Hello message includes SSL version information, a random number, SessionID, and the negotiated cipher suite.

[0056] Step S202: When the authentication result information is determined to be authentication failure, if a Transmission Control Protocol (TCP) reconnection message sent by the client is obtained, then the TCP reconnection message is not responded to, and the number of TCP reconnection messages is determined.

[0057] In this step, when the client obtains the digital certificate sent by the server, it uses the stored root certificate and second public key to authenticate the digital certificate, obtains the authentication result information, and sends the authentication result information to the server. Based on the authentication result information, it can be confirmed whether the server is trustworthy. If the authentication result information is successful, the server can be determined to be trustworthy. If the authentication result information is untrustworthy, the server can be determined to be untrustworthy. At this time, the client disconnects the TCP connection with the server and then sends a TCP reconnection message to the server.

[0058] Step S203: When the number of TCP reconnection packets exceeds a preset threshold, determine whether the client requests to create a new SSL session.

[0059] For example, the system retrieves the Client Hello message recorded by the server and determines whether the random number in the Client Hello message recorded by the server is the same as the random number in the Client Hello message sent by the client. If the random number in the Client Hello message recorded by the server is different from the random number in the Client Hello message sent by the client, it is determined that the client has requested to create a new SSL session. If the random number in the Client Hello message recorded by the server is the same as the random number in the Client Hello message sent by the client, it is determined that the client has not requested to create a new SSL session. The server records the Client Hello message through a message logging module, and the message logging module records the listened-to Client Hello message when the server listens for it.

[0060] For example, it is determined whether the number of Client Hello messages recorded by the message recording module is greater than 1. If the number of Client Hello messages recorded by the message recording module is greater than 1, it is determined that the client has requested to create a new SSL session; if the number of Client Hello messages recorded by the message recording module is equal to 1, it is determined that the client has not requested to create a new SSL session.

[0061] Step S204: When it is determined that the client requests to create a new SSL session, establish an SSL session between the client and the server based on the Client Hello message and the Server Hello message.

[0062] For example, when the authentication result is determined to be authentication failure, if a Transmission Control Protocol (TCP) reconnection message sent by the client is received, the system does not respond to the TCP reconnection message within a preset time period and determines the number of TCP reconnection messages. When the number of TCP reconnection messages is less than or equal to a preset threshold, the system responds to the TCP reconnection message to re-establish the TCP connection between the client and the server. The preset time period can be set based on actual conditions, and this embodiment does not impose a specific limitation on it. By not responding to the TCP reconnection message within the preset time period, but responding to the TCP reconnection message when the number of TCP reconnection messages is less than or equal to the preset threshold, the waste of server memory and CPU resources can be reduced, and processing efficiency can be improved, thereby increasing the speed of SSL session establishment.

[0063] For example, when it is determined that the client requests to create a new SSL session, all TCP reconnection packets are deleted, and the Client Hello message sent by the client is verified as trustworthy. In this way, the server and the client can establish an SSL session between the client and the server based on the Client Hello message and the Server Hello message.

[0064] For example, when it is determined that a client requests to create a new SSL session, TCP reconnection messages are disabled, and the Client Hello message is retained. Based on the retained Client Hello and Server Hello messages, an SSL session is established between the client and the server. Retaining the Client Hello message means that the message logging module in the server does not delete the Client Hello message; instead, it continues to retain it. By disabling TCP reconnection messages and using the retained Client Hello message, the waste of server memory and CPU resources can be reduced, and processing efficiency can be improved, thereby increasing the speed of SSL session establishment.

[0065] For example, when the number of TCP reconnection packets is less than or equal to a preset threshold, the Client Hello messages recorded by the server are deleted. Deleting the Client Hello messages recorded by the server includes clearing the Client Hello message count recorded by the message recording module.

[0066] The SSL session establishment method provided in the above embodiments obtains the authentication result information returned by the client after authenticating the server's digital certificate during the establishment of an SSL session between the client and the server. If the authentication result information indicates authentication failure, and a Transmission Control Protocol (TCP) reconnection message sent by the client is obtained, the method does not respond to the TCP reconnection message and determines the number of TCP reconnection messages. Then, if the number of TCP reconnection messages exceeds a preset threshold, the method further determines whether the client requests to create a new SSL session. If it is determined that the client requests to create a new SSL session, the method establishes an SSL session between the client and the server based on the Client Hello message and the Server Hello message. Since the server does not respond to a large number of suspicious TCP reconnection messages, it can save the memory and CPU resources required to respond to TCP reconnection messages. This allows the server to concentrate its memory and CPU resources to quickly establish an SSL session between the server and the client, thereby reducing the SSL session establishment time and improving the speed at which the client accesses the server's pages.

[0067] Please see Figure 5 , Figure 5 This is a schematic block diagram of a server structure provided in an embodiment of the present invention.

[0068] like Figure 5 As shown, server 300 includes processor 301 and memory 302, which are connected via bus 303, such as I2C (Inter-integrated Circuit) bus.

[0069] Specifically, processor 301 provides computing and control capabilities to support the operation of the entire server. Processor 301 can be a Central Processing Unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0070] Specifically, the memory 302 can be a Flash chip, a read-only memory (ROM) disk, an optical disk, a USB flash drive, or a portable hard drive, etc.

[0071] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the embodiments of the present invention, and does not constitute a limitation on the server to which the embodiments of the present invention are applied. A specific server may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0072] The processor is configured to run a computer program stored in a memory, and to implement any of the SSL session establishment methods provided in the embodiments of the present invention when executing the computer program.

[0073] In one embodiment, the processor is configured to run a computer program stored in memory, and to perform the following steps when executing the computer program:

[0074] Based on the Client Hello message sent by the client, send a Server Hello message and a digital certificate to the client, and obtain the authentication result information returned by the client after authenticating the digital certificate;

[0075] When the authentication result information is determined to be authentication failure, if a Transmission Control Protocol (TCP) reconnection message sent by the client is obtained, the client does not respond to the TCP reconnection message and determines the number of TCP reconnection messages.

[0076] When the number of TCP reconnection messages exceeds a preset threshold, an SSL session is established between the client and the server based on the Client Hello message and the Server Hello message.

[0077] In one embodiment, when the processor sends a Server Hello message and a digital certificate to the client based on the Client Hello message sent by the client, it is configured to:

[0078] Based on the Client Hello message, a first list of cipher suites supported by the client is determined, the first list of cipher suites including multiple cipher suites supported by the client;

[0079] Based on a second encryption suite list pre-configured by the server, a target encryption suite is determined from the first encryption suite list, wherein the second encryption suite list includes multiple encryption suites supported by the server;

[0080] Based on the target encryption suite, a Server Hello message is generated, and the Server Hello message and digital certificate are sent to the client.

[0081] In one embodiment, when the processor determines the first list of cipher suites supported by the client based on the Client Hello message, it is configured to:

[0082] Determine whether an extended message exists in the Client Hello message;

[0083] If no extended message is present in the Client Hello message, the list of cipher suites in the Client Hello message is determined as the first list of cipher suites supported by the client.

[0084] In one embodiment, after determining whether an extended message exists in the Client Hello message, the processor is further configured to:

[0085] When an extended message exists in the Client Hello message, determine the number of extended messages in the Client Hello message;

[0086] When the number of extended messages is greater than or equal to a preset threshold, the extended encryption suite supported by the client is determined based on a portion of the extended messages in the Client Hello message.

[0087] When the number of extended messages is less than a preset threshold, the extended encryption suites supported by the client are determined based on all extended messages in the Client Hello message;

[0088] Based on the list of cipher suites in the Client Hello message and the extended cipher suites, determine the first list of cipher suites supported by the client.

[0089] In one embodiment, before establishing an SSL session between the client and the server based on the Client Hello message and the Server Hello message, the processor is further configured to implement:

[0090] When the number of TCP reconnection packets exceeds a preset threshold, determine whether the client requests to create a new SSL session;

[0091] When it is determined that the client requests to create a new SSL session, an SSL session is established between the client and the server based on the Client Hello message and the Server Hello message.

[0092] In one embodiment, when the processor determines that the client has requested to create a new SSL session, and establishes an SSL session between the client and the server based on the Client Hello message and the Server Hello message, the processor is configured to:

[0093] When it is determined that the client requests to create a new SSL session, the TCP reconnection message is closed, but the Client Hello message is retained;

[0094] Based on the retained Client Hello message and Server Hello message, an SSL session is established between the client and the server.

[0095] In one embodiment, when determining whether the client requests to create a new SSL session, the processor is configured to:

[0096] Obtain the Client Hello message recorded by the server, and determine whether the random number in the Client Hello message recorded by the server is the same as the random number in the Client Hello message sent by the client;

[0097] If the random number in the Client Hello message recorded by the server is different from the random number in the Client Hello message sent by the client, then it is determined that the client is requesting to create a new SSL session;

[0098] If the random number in the Client Hello message recorded by the server is the same as the random number in the Client Hello message sent by the client, then it is determined that the client has not requested to create a new SSL session.

[0099] In one embodiment, after determining the number of TCP reconnection packets, the processor is further configured to:

[0100] When the number of TCP reconnection messages is less than or equal to a preset threshold, the Client Hello message recorded by the server is deleted.

[0101] It should be noted that those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the server described above can be referred to the corresponding process in the aforementioned SSL session establishment method embodiment, and will not be repeated here.

[0102] This invention also provides a storage medium for computer-readable storage, wherein the storage medium stores one or more programs that can be executed by one or more processors to implement any of the SSL session establishment methods provided in the specification of this invention.

[0103] The storage medium can be the internal storage unit of the server described in the foregoing embodiments, such as the server's hard drive or memory. Alternatively, the storage medium can be an external storage device for the server, such as a plug-in hard drive, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card.

[0104] It will be understood by those skilled in the art that all or some of the steps, systems, or apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware embodiments, the division between functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0105] It should be understood that the term "and / or" as used in this specification and the appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes such combinations. It should be noted that, herein, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0106] The sequence numbers of the above embodiments of the present invention are merely for descriptive purposes and do not represent the superiority or inferiority of the embodiments. The above descriptions are only specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for establishing a Secure Sockets Protocol (SSL) session, applied to a server, characterized in that, include: Based on the Client Hello message sent by the client, send a Server Hello message and a digital certificate to the client, and obtain the authentication result information returned by the client after authenticating the digital certificate; When the authentication result information is determined to be authentication failure, if a Transmission Control Protocol (TCP) reconnection message sent by the client is obtained, the client does not respond to the TCP reconnection message and determines the number of TCP reconnection messages. When the number of TCP reconnection messages exceeds a preset threshold, an SSL session is established between the client and the server based on the Client Hello message and the Server Hello message.

2. The SSL session establishment method according to claim 1, characterized in that, The step of sending a Server Hello message and a digital certificate to the client based on the Client Hello message sent by the client includes: Based on the Client Hello message, a first list of cipher suites supported by the client is determined, the first list of cipher suites including multiple cipher suites supported by the client; Based on a second encryption suite list pre-configured by the server, a target encryption suite is determined from the first encryption suite list, wherein the second encryption suite list includes multiple encryption suites supported by the server; Based on the target encryption suite, a Server Hello message is generated, and the Server Hello message and digital certificate are sent to the client.

3. The SSL session establishment method according to claim 2, characterized in that, The step of determining the first list of cipher suites supported by the client based on the Client Hello message includes: Determine whether an extended message exists in the Client Hello message; If no extended message is present in the Client Hello message, the list of cipher suites in the Client Hello message is determined as the first list of cipher suites supported by the client.

4. The SSL session establishment method according to claim 3, characterized in that, After determining whether an extended message exists in the Client Hello message, the process further includes: When an extended message exists in the Client Hello message, determine the number of extended messages in the Client Hello message; When the number of extended messages is greater than or equal to a preset threshold, the extended encryption suites supported by the client are determined based on a portion of the extended messages in the Client Hello message. When the number of extended messages is less than a preset threshold, the extended encryption suites supported by the client are determined based on all extended messages in the Client Hello message. Based on the list of cipher suites in the Client Hello message and the extended cipher suites, determine the first list of cipher suites supported by the client.

5. The SSL session establishment method according to any one of claims 1-4, characterized in that, Before establishing an SSL session between the client and the server based on the Client Hello message and the Server Hello message, the method further includes: When the number of TCP reconnection packets exceeds a preset threshold, determine whether the client requests to create a new SSL session; When it is determined that the client requests to create a new SSL session, an SSL session is established between the client and the server based on the Client Hello message and the Server Hello message.

6. The SSL session establishment method according to claim 5, characterized in that, When it is determined that the client requests to create a new SSL session, the step of establishing an SSL session between the client and the server based on the Client Hello message and the Server Hello message includes: When it is determined that the client requests to create a new SSL session, the TCP reconnection message is closed, but the Client Hello message is retained; Based on the Client Hello message and the Server Hello message, an SSL session is established between the client and the server.

7. The SSL session establishment method according to claim 5, characterized in that, Determining whether the client requests to create a new SSL session includes: Obtain the Client Hello message recorded by the server, and determine whether the random number in the Client Hello message recorded by the server is the same as the random number in the Client Hello message sent by the client; If the random number in the Client Hello message recorded by the server is different from the random number in the Client Hello message sent by the client, then it is determined that the client is requesting to create a new SSL session; If the random number in the Client Hello message recorded by the server is the same as the random number in the Client Hello message sent by the client, then it is determined that the client has not requested to create a new SSL session.

8. The SSL session establishment method according to claim 7, characterized in that, After determining the number of TCP reconnection messages, the process further includes: When the number of TCP reconnection messages is less than or equal to a preset threshold, the Client Hello message recorded by the server is deleted.

9. A server, characterized in that, The server includes a processor, a memory, a computer program stored in the memory and executable by the processor, and a data bus for establishing communication between the processor and the memory, wherein the computer program, when executed by the processor, implements the SSL session establishment method according to any one of claims 1 to 8.

10. A storage medium for computer-readable storage, characterized in that, The storage medium stores one or more programs, which can be executed by one or more processors to implement the SSL session establishment method according to any one of claims 1 to 8.

Images