A data processing method and related apparatus

Abstract

The application relates to the technical field of computers, and provides a data processing method and related devices, which can be applied to various scenes such as cloud technology, artificial intelligence, intelligent transportation and auxiliary driving, and are used for improving the processing efficiency of compatible support, and the method comprises the following steps: obtaining a target plug-in containing a target transmission class, the target transmission class and a specified mounting class are inherited from the same interface or parent class, and the target plug-in is loaded in a target component library containing the mounting class; then when a communication request for an application program is received, a secure encryption channel between the application program and a server end is established by calling each target method contained in the target transmission class in the target component library, and the application program is caused to communicate with the server end based on the secure encryption channel.

Description

Technical Field

[0001] This application relates to the field of computer technology, and provides a data processing method and related apparatus. Background Technology

[0002] With the deepening of informatization and the rapid development of the Internet, information security issues have become increasingly prominent. Cryptographic algorithms are the core of ensuring data transmission security, but most software currently does not support the national cryptographic algorithm.

[0003] To achieve compatibility support for Chinese cryptographic algorithms, related technologies typically involve customizing an Open Secure Sockets Layer (OpenSSL) protocol to enable applications to support these algorithms. However, using a custom OpenSSL protocol requires further development of the corresponding application layer protocol, resulting in a significant development workload and impacting the efficiency of compatibility support. Summary of the Invention

[0004] This application provides a data processing method and related apparatus to improve the processing efficiency of compatible and supported systems.

[0005] In a first aspect, embodiments of this application provide a data processing method applied to a client, the method comprising: Obtain a target plugin containing a target transport class, wherein there is at least one target method with the same name and parameters between the target transport class and the specified mount class, and each target method contained in the target transport class is used to implement the target transport layer protocol; Load the target plugin in the target component library that contains the mount class; When a communication request for an application is received, a secure encrypted channel is established between the application and the server by calling the target methods contained in the target transport class in the target component library, and the application communicates with the server based on the secure encrypted channel.

[0006] Secondly, embodiments of this application provide a data processing apparatus, including: A construction unit is used to obtain a target plugin containing a target transport class. There is at least one target method with the same name and parameters between the target transport class and the specified mount class. Each target method contained in the target transport class is used to implement the target transport layer protocol. A loading unit is used to load the target plugin in a target component library containing the mount class; The establishment unit is used to, when receiving a communication request for an application, establish a secure encrypted channel between the application and the server by calling the target methods contained in the target transport class in the target component library, and enable the application to communicate with the server based on the secure encrypted channel.

[0007] As one possible implementation, the target plugin also includes a wrapper layer for obtaining the data transfer from the native framework layer. When obtaining the target transport layer protocol implementation method from the native layer of the local framework, the establishment unit is specifically used for: When the wrapper layer receives a data query request from the Java layer, it reads the stored implementation method of the target transport layer protocol into the native layer. The target transport layer protocol implementation method is passed to the Java layer through the wrapper layer.

[0008] As one possible implementation, when the application communicates with the server based on the secure encrypted channel, the establishment unit is specifically used for: The communication request is encrypted using the shared key negotiated in the TLS connection to obtain the encrypted communication request; Enable the Hypertext Transfer Protocol (HTTP) service, and based on the enabled HTTP service, send the encrypted communication request to the server.

[0009] As one possible implementation, the target component library includes a network component, which is used to implement data transmission with the server. When the encrypted communication request is sent to the server based on the already enabled HTTP service, the establishment unit is specifically used for: Based on the enabled HTTP service, the encrypted communication request is sent to the server via a network component.

[0010] As one possible implementation, the establishment unit is further used for: When it is determined that the default transport layer protocol will be used, and a new communication request for the application is received, a default encrypted channel between the application and the server is established in the target component library by calling the target methods contained in the mount class; wherein, the target methods contained in the mount class are used to implement the default transport layer protocol. The application communicates with the server via the default encrypted channel.

[0011] Thirdly, embodiments of this application provide an electronic device, including a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the above-described data processing method.

[0012] Fourthly, embodiments of this application provide a computer-readable storage medium including a computer program, which, when run on an electronic device, causes the electronic device to perform the steps of the above-described data processing method.

[0013] Fifthly, embodiments of this application provide a computer program product, the program product including a computer program stored in a computer-readable storage medium, wherein a processor of an electronic device reads from the computer-readable storage medium and executes the computer program, causing the electronic device to perform the steps of the above-described data processing method.

[0014] In this embodiment, a target plugin containing a target transport class is obtained. This target transport class is overridden from a specified mount class. The target plugin is loaded into a target component library containing the mount class. Then, when a communication request for the application is received, a secure encrypted channel is established between the application and the server by calling the target methods contained in the target transport class within the target component library. The application then communicates with the server through this secure encrypted channel. Since the target transport class in the target plugin is overridden from the mount class in the target component library, after loading the target transport class into the target component library, a secure encrypted channel can be established by calling the target transport class. Thus, based on an existing component library, support for national cryptographic algorithms and other target encryption algorithms can be achieved through a plugin, without requiring modification to the original component library. This reduces modification costs and significantly improves the efficiency of compatibility support.

[0015] Other features and advantages of this application will be set forth in the following description and will be apparent in part from the description or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description and the accompanying drawings. Attached Figure Description

[0016] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1A This is a schematic diagram illustrating the application of a distributed system to a blockchain system, as provided in the embodiments of this application. Figure 1B This is a schematic diagram of a block structure provided in an embodiment of this application; Figure 2 This is a flowchart illustrating a data processing method provided in an embodiment of this application; Figure 3 This is a schematic diagram of a class diagram provided in an embodiment of this application; Figure 4 This is a logical diagram illustrating a data processing procedure provided in an embodiment of this application; Figure 5 This is a logical diagram illustrating the selection of available instructions provided in an embodiment of this application; Figure 6A This is a schematic diagram of the structure of an operating system that does not support the national cryptographic standard, as provided in the embodiments of this application. Figure 6B This is a schematic diagram of the structure of the operating system supporting the national cryptographic standard provided in the embodiments of this application; Figure 7 This is a logical diagram illustrating a data transmission process provided in an embodiment of this application; Figure 8 This is a schematic diagram of the structure of a data processing device provided in an embodiment of this application; Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this application. Obviously, the described embodiments are only some embodiments of the technical solutions of this application, and not all embodiments. Based on the embodiments recorded in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the technical solutions of this application.

[0018] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0019] The following describes some of the concepts involved in the embodiments of this application.

[0020] Chinese cryptographic algorithms: Domestically developed cryptographic algorithms, including but not limited to SM1, SM2, SM3, SM4, etc. Both the key length and block length are 128 bits.

[0021] National Cryptographic Standard: A standard for establishing secure encrypted channels based on national cryptographic algorithms.

[0022] Transport Layer Security (TLS): A security protocol that provides security and data integrity for network communications.

[0023] Open Secure Sockets Layer (OpenSSL): An open-source software library package that applications can use for secure communication.

[0024] Class relationships: Class relationships include inheritance, association, aggregation, composition, dependency, and realization.

[0025] Association: A connection between classes that allows one class to know the attributes and methods of another class.

[0026] Aggregation relationship: This is a type of association relationship, representing a whole-part relationship where the part can exist independently of the whole. For example, a car and its tires have a whole-part relationship; the tires can still exist without the car.

[0027] Compositional relationship: This is a type of association relationship, representing a whole-part relationship where the individual cannot exist independently of the whole. For example, a company and a department have a whole-part relationship; without a company, there would be no department.

[0028] Dependency: It is a connection between classes, indicating that one class depends on the definition of another class.

[0029] Implementation relationship: A relationship between a class and an interface, indicating that the class implements all the features and behaviors of the interface.

[0030] Application: A computer program that can perform one or more tasks. It generally has a visual interface and can interact with the user; examples include electronic maps and calendars. Some applications require installation on the user's device, while others do not, such as the various mini-programs and web pages within certain instant messaging applications. Mini-programs do not require downloading or installation; users can open them by scanning a QR code or searching.

[0031] A client, also known as a user terminal, is a program that provides services to clients in contrast to a server, such as financial trading applications. Except for some applications that run only locally, they are generally installed on ordinary client machines and need to work in conjunction with the server. A specific communication connection needs to be established between the client and the server to ensure the normal operation of the application.

[0032] Cloud technology refers to a managed technology that unifies a series of resources such as hardware, software, and networks within a wide area network or local area network to achieve data computing, storage, processing, and sharing.

[0033] Cloud technology is a collective term for network technologies, information technologies, integration technologies, management platform technologies, and application technologies based on cloud computing business models. It can form resource pools, providing flexible and convenient on-demand access. Cloud computing technology will become a crucial support. Backend services of technical network systems require substantial computing and storage resources, such as video websites, image websites, and many portal websites. With the rapid development and application of the internet industry, every item may have its own identification mark in the future, requiring transmission to backend systems for logical processing. Data at different levels will be processed separately, and various industry data will all require robust system support, which can only be achieved through cloud computing.

[0034] Cloud security refers to the collective term for security software, hardware, users, organizations, and security cloud platforms based on cloud computing business models. Cloud security integrates emerging technologies and concepts such as parallel processing, grid computing, and the identification of unknown virus behavior. Through a large network of clients, it monitors abnormal software behavior on the network, obtains the latest information on Trojans and malware on the internet, sends it to the server for automatic analysis and processing, and then distributes solutions for viruses and Trojans to each client.

[0035] The main research directions in cloud security include: 1. Cloud computing security, which mainly studies how to ensure the security of the cloud itself and various applications on the cloud, including cloud computer system security, secure storage and isolation of user data, user access authentication, information transmission security, network attack protection, and compliance auditing; 2. Cloudification of security infrastructure, which mainly studies how to use cloud computing to build and integrate security infrastructure resources and optimize security protection mechanisms, including building a large-scale security event and information collection and processing platform through cloud computing technology to achieve the collection and correlation analysis of massive amounts of information and improve the ability to control network-wide security events and risks; 3. Cloud security services, which mainly studies various security services provided to users based on cloud computing platforms, such as antivirus services.

[0036] With the deepening of informatization and the rapid development of the Internet, information security issues have become increasingly prominent. Cryptographic algorithms are the core of ensuring data transmission security, but most software currently does not support the national cryptographic algorithm.

[0037] To achieve compatibility support for Chinese cryptographic algorithms, related technologies typically involve customizing OpenSSL to enable applications to support these algorithms. However, using a custom OpenSSL requires further development of the corresponding application layer protocol, resulting in a significant development workload and impacting the efficiency of compatibility support.

[0038] In this embodiment, a target plugin containing a target transport class for implementing the target transport layer protocol is obtained. The target transport class is rewritten based on a specified mount class. Then, the target plugin is loaded into the target component library containing the mount class. When a communication request for the application is received, a secure encrypted channel between the application and the server is established by calling the target methods contained in the target transport class within the target component library. Since the target transport class in the target plugin is rewritten based on the mount class in the target component library, after loading the target transport class into the target component library, a secure encrypted channel can be established by calling the target transport class. Thus, based on an existing component library, support for target encryption algorithms such as Chinese national cryptographic standards can be achieved through a plugin, without requiring modification to the original component library, resulting in low modification costs and significantly improved efficiency in compatibility support.

[0039] The preferred embodiments of this application are described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit this application. Furthermore, the embodiments and features in the embodiments of this application can be combined with each other without conflict.

[0040] The system involved in this application embodiment can be a distributed system formed by connecting a client and multiple nodes (any form of computing device in the network, such as a server or user terminal) through network communication.

[0041] In this embodiment, the user terminal may be an IoT device, mobile phone, computer, smart voice interaction device, smart home appliance, vehicle terminal, aircraft, etc., but is not limited to these.

[0042] The server is the server corresponding to the user terminal. For example, the user terminal can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms. The terminal device and the server can be connected directly or indirectly through wired or wireless communication, and this application does not impose any restrictions.

[0043] Taking a distributed system as an example, see blockchain system. Figure 1A , Figure 1A This is an optional structural diagram of a distributed system applied to a blockchain system, as provided in this application embodiment. It consists of multiple nodes 200 (any form of computing device in the network, such as servers or user terminals) and clients 300. The nodes form a peer-to-peer (P2P) network. The P2P protocol is an application layer protocol running on top of the Transmission Control Protocol (TCP). In the distributed system 100, any machine, such as a server or terminal, can join and become a node. A node includes a hardware layer, a middleware layer, an operating system layer, and an application layer.

[0044] See Figure 1A The functions of each node in the blockchain system shown include: 1) Routing: A basic function of nodes used to support communication between nodes.

[0045] In addition to routing capabilities, nodes can also have the following functions: 2) Applications are deployed in the blockchain to implement specific business needs. They record data related to the implementation of functions to form record data, carry digital signatures in the record data to indicate the source of the task data, and send the record data to other nodes in the blockchain system. When other nodes successfully verify the source and integrity of the record data, they add the record data to a temporary block.

[0046] For example, the business logic implemented by the application includes: 2.1) A wallet is used to provide the function of conducting electronic currency transactions, including initiating transactions (i.e., sending the transaction record of the current transaction to other nodes in the blockchain system; after other nodes successfully verify the transaction, they store the transaction record data in the temporary block of the blockchain as a response to acknowledge the validity of the transaction; of course, the wallet also supports querying the remaining electronic currency in the electronic currency address. 2.2) Shared ledger, used to provide functions such as storage, query and modification of ledger data. It sends the record data of the operation on the ledger data to other nodes in the blockchain system. After the other nodes verify the validity, as a response to acknowledge the validity of the ledger data, they store the record data in a temporary block. They can also send confirmation to the node that initiated the operation.

[0047] 2.3) Smart contracts are computerized protocols that can execute the terms of a contract. They are implemented through code deployed on a shared ledger that executes when certain conditions are met. Based on actual business needs, the code is used to complete automated transactions, such as querying the logistics status of goods purchased by a buyer and transferring the buyer's electronic money to the merchant's address after the buyer signs for the goods. Of course, smart contracts are not limited to executing contracts for transactions; they can also execute contracts for processing received information.

[0048] 3) A blockchain consists of a series of blocks that are sequentially generated. Once a new block is added to the blockchain, it will not be removed. The blocks contain the data submitted by the nodes in the blockchain system.

[0049] See Figure 1B , Figure 1B This is an optional schematic diagram of the block structure provided in this application embodiment. Each block includes the hash value of the transaction records stored in this block (the hash value of this block) and the hash value of the previous block. The blocks are connected through their hash values ​​to form a blockchain. Additionally, the block may include information such as a timestamp when it was generated. A blockchain is essentially a decentralized database, a chain of data blocks linked together using cryptographic methods. Each data block contains relevant information used to verify the validity of the information (anti-counterfeiting) and to generate the next block.

[0050] The embodiments of this application can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, and assisted driving.

[0051] See Figure 2 The diagram shown is a flowchart of a data processing method provided in an embodiment of this application. This method is applied to a client, and the specific process is as follows: S201. Obtain the target plugin containing the target transport class. There is at least one target method with the same name and parameters between the target transport class and the specified mount class. Each target method contained in the target transport class is used to implement the target transport layer protocol.

[0052] S202. Load the target plugin in the target component library containing the mount class.

[0053] S203. When a communication request for the application is received, a secure encrypted channel between the application and the server is established by calling the target methods contained in the target transport class in the target component library, and the application communicates with the server based on the secure encrypted channel.

[0054] In this embodiment, since the target transmission class contained in the target plugin is rewritten based on the mount class in the target component library, after loading the target transmission class in the target component library, a secure encrypted channel can be established by calling the target transmission class. In this way, based on the existing component library, support for national cryptographic algorithms and other target encryption algorithms can be achieved through the plugin form, without modifying the original component library, resulting in low modification costs and greatly improving the efficiency of compatibility support.

[0055] In S201, it should be noted that in this embodiment of the application, the target transmission class and the specified mount class inherit from the same interface or parent class.

[0056] The target component library includes, but is not limited to, okhttp, Netty, libcurl, etc. The okhttp network request component is a framework for handling network requests in the Android system. It has advantages such as good layered architecture design and strong stability.

[0057] The target transport layer protocol is a transport layer protocol that is not supported in the target component library. The target transport layer protocol can be a Chinese cryptographic algorithm, including but not limited to GM / T 0024-2014 SSL VPN technical specification, Transport Layer Cryptography (TLCP), and Chinese cryptographic algorithms defined in RFC8998.

[0058] The following explanation will only use the example of okhttp as the target component library and Chinese cryptographic algorithm as the target transport layer protocol.

[0059] When executing S201, the specified mount class can be the sslSocketFactory reserved in Okhttp. The mount class can also be called the mount point. In this embodiment, sslSocketFactory is used as the mount point, and the specific implementation of the sslSocket class, TgmsslSocketlmpl, is overridden to implement the Chinese national cryptographic protocol. In this document, the Chinese national cryptographic SSL can also be referred to as tgmssl.

[0060] See Figure 3 As shown, this is a class diagram of a target plugin provided in an embodiment of this application. The class diagram includes: OKHttpClient, Builder, TgmsslSession, TgmsslContextlmpl, TgmsslSocketFactorlmpl, javax.net.ssl.SSLSocket, AbsTgmSocket, TgmsslSocketlmpl, SSLOutputstream, SSLInputstream, and NativeSSL.

[0061] exist Figure 3 In this diagram, different styles of arrows are used to represent different class relationships, including inheritance, association, aggregation, composition, dependency, and realization. Inheritance arrows are solid lines with triangular arrowheads pointing to the parent class; realization arrows are dashed lines with triangular arrowheads pointing to the interface; composition arrows are solid lines with solid diamonds pointing to the whole; aggregation arrows are solid lines with hollow diamonds pointing to the whole; association arrows are solid lines with plain arrowheads pointing to the owned class; and dependency arrows are dashed lines with plain arrowheads pointing to the used class.

[0062] Specifically, OKHttpClient and Builder have a composition relationship; TgmsslSocketFactorylmpl and Builder have an aggregation relationship; TgmsslSocketFactorylmpl and TgmsslContextlmpl have an association relationship; TgmsslSocketFactorylmpl and TgmsslSocketlmpl have a dependency relationship; SSLOutputstream, SSLInputstream, and TgmsslSession all have a dependency relationship with TgmsslSocketlmpl; AbsTgmSocket and TgmsslSocketlmpl have an inheritance relationship; and NativeSSL has a dependency relationship with both SSLOutputstream and SSLInputstream.

[0063] OKHttpClient is used to send HTTP requests and read the responses to those requests. OKHttpClient contains the execute and enqueue methods. The methods in OKHttpClient and their descriptions are shown in Table 1.

[0064] Table 1 lists the methods included in OKHttpClient and their descriptions.

[0065] OKHttpClient uses a Builder to configure parameters. The Builder contains the connectTimeout method, readTimeout method, sslSocketFactory method, and Build method. The methods contained in OKHttpClient and their descriptions are shown in Table 2.

[0066] Table 2. Methods included in Builder and their descriptions

[0067] TgmsslContextlmpl is used to create SSL context objects. TgmsslContextlmpl contains the properties protocol and sslParams. protocol represents the protocol and sslParams represents the required SSL parameters. TgmsslContextlmpl also contains the Init method and the EngineGetSocketFactory method. The methods contained in TgmsslContextlmpl and their descriptions are shown in Table 3.

[0068] Table 3. Methods included in TgmsslContextlmpl and their descriptions.

[0069] TgmsslSocketFactorylmpl is used to create SSLSockets. TgmsslSocketFactorylmpl contains the property tgmsslParam, which represents the Chinese national cryptographic SSL parameter. TgmsslSocketFactorylmpl also contains the createSocket method, the getSupportedCipherSuits method, and the getDefaultCipherSuits method. The methods contained in TgmsslSocketFactorylmpl and their descriptions are shown in Table 4.

[0070] Table 4 lists the methods included in TgmsslSocketFactorylmpl and their descriptions.

[0071] TgmsslSocketlmpl is used to provide sockets that use the SSL or TLS protocol. TgmsslSocketlmpl contains the following properties: nativeGmSSL, tgmsslParam, and tgmsslSession. nativeGmSSL represents the native layer Chinese cryptographic SSL, tgmsslParam represents the Chinese cryptographic SSL parameters, and tgmsslSession represents the Chinese cryptographic SSL session. TgmsslSocketFactorlmpl also contains the startHandShake method and the Operation method. The methods contained in TgmsslSocketlmpl and their descriptions are shown in Table 5.

[0072] Table 5 lists the methods included in TgmsslSocketlmpl and their descriptions.

[0073] TgmsslSession is used to create SSL sessions. TgmsslSession contains the property protocol, which represents the protocol. TgmsslSession also contains the methods getPeerCertificates, getPeerHost, getProtocols, and getCipherSuits. The methods contained in TgmsslSession and their descriptions are shown in Table 6.

[0074] Table 6 lists the methods included in TgmsslSession and their descriptions.

[0075] AbsTgmSocket is used to create Chinese cryptographic sockets. AbsTgmSocket contains the attributes socket and PeerPort. socket represents a socket and PeerPort represents a peer. AbsTgmSocket also contains the connect method, bind method, getInterAddress method, getInputStream method, and getOutputStream method. The methods contained in AbsTgmSocket and their descriptions are shown in Table 7.

[0076] Table 7 lists the methods included in AbsTgmSocket and their descriptions.

[0077] The javax.net.ssl ​​package provides classes for the Secure Sockets package. The javax.net.ssl.SSLSocket package contains the getEnableCipherSuits method, the startHandShake method, the getSupportProtocals method, and the setSSLParametes method. The methods contained in javax.net.ssl.SSLSocket and their descriptions are shown in Table 8.

[0078] Table 8 lists the methods contained in javax.net.ssl.SSLSocket and their descriptions.

[0079] SSLOutputstream is used for output, and it contains a write method.

[0080] SSLInputstream is used for input. SSLInputstream contains a read method and an available method. The available method is used to close the input stream.

[0081] NativeSSL is used for... NativeSSL includes the doHandshake method, write method, read method, getVersion method, getCipherSuit method, getPeerCertificate method, and Shutdown method. The methods included in NativeSSL and their descriptions are shown in Table 9.

[0082] Table 9 lists the methods included in NativeSSL and their descriptions.

[0083] When executing S202, in this embodiment of the application, the software development kit (SDK) of the target plugin can be encapsulated, the code can be packaged into a .jar file, and the packaged .jar file can be imported into the development tool. Then, when using Okhttp in the development tool, the methods in the target plugin can be called directly.

[0084] Assuming the SDK packages Okhttp-tgmssl-plugin.jar, after importing the packaged .jar file into the development tool, a TgmsslContext object is created using TgmsslContextlmpl, and its init method is called to initialize it. Then, the EngineGetSocketFactory method of the TgmsslContext object is called, returning a SocketFactory object from the TgmsslContext object. This returned SocketFactory object is used as an sslSocketFactory object, and then an OKHttpClient is created based on the sslSocketFactory object. In this way, subsequent communication is based on the created OKHttpClient.

[0085] In some embodiments, the target component library includes a connection component for establishing a connection with the server. During execution S203, a secure encrypted channel between the application and the server is established in the target component library by calling various target methods contained in the target transport class, including: When the connection component receives a communication request, it calls the target methods contained in the target transport class to establish a TLS (Transport Layer Security) connection. When the TLS connection is successful, it confirms that a secure encrypted channel between the application and the server has been established.

[0086] In Okhttp, connection components can use connection interceptors.

[0087] See Figure 4 As shown in the diagram, this application provides a structural schematic of an OkHttp instance. OkHttp includes an OKHttpClient and multiple interceptors, including a retry and redirection interceptor (RetryAndFollowUpInterceptor), a bridge interceptor, a cache interceptor (CacheInterceptor), a connection interceptor, a network interceptor (NetworkInterceptor), and an I / O interceptor (CallServerInterceptor). The retry and redirection interceptor handles retries and redirections in case of failed connections. The bridge interceptor encapsulates request messages and parses response messages. The cache interceptor determines if there is available cache and cached response data. The network interceptor is a custom interceptor. The I / O interceptor handles network data requests and responses.

[0088] When OKHttpClient receives a communication request, it can create a `call` object using the `newCall` method. Synchronous execution uses the `call.execute` method, and asynchronous execution uses the `call.enqueue` method. Then, the `getResponseWithInterceptorChain` method, which contains a chain of multiple interceptors, executes the communication request. Specifically, interceptors are used sequentially, including retry and redirection interceptors, encapsulation interceptors, caching interceptors, and connection interceptors. When the connection interceptor receives the communication request, it calls the target methods in the target transport class to search for available connections. If no connection is available, a `RealConnector` is created, and a TLS connection under the national cryptographic standard is established. When the TLS connection succeeds, a secure encrypted channel between the application and the server is confirmed. Afterward, the communication request is passed to the network interceptor and I / O interceptor, thus sending the communication request to the server.

[0089] By utilizing the features of connection interceptors, communication requests for applications are sent to the server through an encrypted and secure channel. This ensures information security without requiring changes to the Okhttp component library, minimizing client-side modifications and further improving compatibility.

[0090] In some embodiments, when invoking the target methods contained in the target transport class to establish a TLS (Transport Layer Security) connection, the following methods can be used: Determine if there are any available connections in the connection pool; if no available connections are found, then when determining the target transport layer protocol to use, call the target methods contained in the target transport class to establish a TLS connection.

[0091] In this embodiment of the application, an available connection refers to a TCP connection that has the same host number and port number as the communication request.

[0092] It should be noted that in this embodiment of the application, before determining whether there is an available connection in the connection pool, it is also possible to determine whether the current connection is available. If it is not available, then it is further determined whether there is an available connection in the connection pool. Determining whether the current connection is available includes, but is not limited to, determining that new connections will not be accepted, and determining whether a hostname and port number identical to those contained in the current communication request exist.

[0093] For example, see Figure 5 As shown, assume that the host number and port number in the communication request are 13 and 80 respectively, and the connection pool contains candidate connection 1, candidate connection 2, candidate connection 3, etc. The host number and port number of candidate connection 1 are 13 and 80 respectively, the host number and port number of candidate connection 2 are 14 and 13 respectively, and the host number and port number of candidate connection 1 are 15 and 21 respectively. The host number and port number of candidate connection 1 are the same as the host number and port number in the communication request. It is determined that there is an available connection in the connection pool, and the available connection is candidate connection 1.

[0094] For example, suppose the communication request contains a host number and a port number of 13 and 80 respectively. If there is no candidate connection with a host number and a port number of 13 and 80 in the connection pool, then it is determined that there is no available connection in the connection pool.

[0095] By implementing the above method, when an available connection exists, it can be reused directly; when no available connection exists, a new connection can be created, thereby improving network connection efficiency.

[0096] In some embodiments, the target methods included in the target transport class include: a socket creation method, a protocol initiation method, and a target transport layer protocol implementation method. In this case, invoking the target methods included in the target transport class to establish a TLS connection includes: When the socket creation method is called, a socket is created, and a session is created based on the created socket; When the protocol startup method is called, the target transport layer protocol implementation method is obtained from the native layer of the local framework, and a TLS connection is established in the created session based on the target transport layer protocol implementation method.

[0097] The development of upper-layer applications in operating systems (such as Android) is based on Java, hence the term Java layer. However, because Java is platform-independent, some low-level tasks are not easy to implement in Java. For example, when it comes to tasks involving local services, link libraries, or hardware drivers, it is usually necessary to run C programs. Since C programs run in the Java layer, the corresponding low-level tasks that need to be implemented using C programs are called the native layer.

[0098] As one possible implementation, if the application does not support the Chinese national cryptographic SSL, see [link / reference]. Figure 6A As shown, the Java layer, from top to bottom, includes Okhttp, context, socket, SSL parameters, and input / output streams. The native layer can include Conscrypt and Boringssl. Conscrypt is a component that provides Java security using OpenSSL, and Boringssl is an encrypted SSL.

[0099] As another possible implementation, if the application does not support Chinese national cryptographic SSL, see [link / reference]. Figure 6B As shown, the Java layer, from top to bottom, includes Okhttp, context, Chinese cryptographic socket, SSL session, and input / output stream. The native layer may include a wrapper layer, Chinese cryptographic SSL, and a Chinese cryptographic algorithm library. (Compared to...) Figure 6A Chinese operating system architecture Figure 6B In this method, only the national cryptographic socket, SSL session, and native layer need to be adjusted. There is no need to modify Okhttp, context, or input / output streams. The operation is relatively simple, which can further improve the efficiency of compatibility support.

[0100] For example, the socket creation method is the createSocket method in Table 4, and the protocol startup method is the startHandShake method in Table 5. When the createSocket method is called, a Chinese cryptographic socket is created, and an SSL session is created based on the created Chinese cryptographic socket. When the startHandShake method is called, the Chinese cryptographic SSL is obtained from the native layer, and a TLS connection is established in the created session based on the Chinese cryptographic SSL.

[0101] With the above implementation, since the target plugin includes the Chinese national cryptographic SSL certificate in the native layer, and the Java layer implements a custom Socket class, and integrates the factory method for producing the tgmsocket class into OkHttp using the builder pattern, only the tgmSoketFactory needs to be added to enable the Chinese national cryptographic plugin and allow OkHttp to support Chinese national cryptographic SSL channels.

[0102] In some embodiments, see Figure 6B As shown, the target plugin also includes a wrapper layer, which is used to retrieve and pass data from the native layer. During the process of retrieving the target transport layer protocol implementation method from the native framework layer, when the client's wrapper layer receives a data query request from the Java layer, it reads the stored target transport layer protocol implementation method into the native layer, and then passes it to the Java layer through the wrapper layer.

[0103] It should be noted that, in the embodiments of this application, the target transport layer protocol implementation method can be stored in a database.

[0104] For example, see Figure 7 As shown, when the wrapper layer receives a data query request from the Java layer, it reads the stored national cryptographic SSL certificate into the native layer, and then passes the national cryptographic SSL certificate to the Java layer through the wrapper layer. This implementation method, using the wrapper layer for data transmission, improves data transmission efficiency and further enhances the efficiency of compatibility support implementation.

[0105] In some embodiments, before the client and server begin communication, they need to exchange or agree on encryption keys and ciphers to be used when encrypting data. Specifically, during the process of enabling the application to communicate with the server via a secure encrypted channel, the following methods may be used, but are not limited to: The communication request is encrypted using the shared key negotiated in the TLS connection to obtain the encrypted communication request; then, the Hypertext Transfer Protocol (HTTP) service is enabled, and the encrypted communication request is sent to the server based on the enabled HTTP service.

[0106] It should be noted that, in the embodiments of this application, the HTTP service includes, but is not limited to, HTTP 1.0, HTTP 2.0, etc. The shared key can be set in the target transport layer protocol.

[0107] For example, assuming the shared key is a 16-byte symmetric key, the communication request is encrypted based on the shared key negotiated in the TLS connection to obtain the encrypted communication request. Then, the HTTP / 2.0 service is started, and based on the started HTTP / 2.0 service, the encrypted communication request is sent to the server.

[0108] By implementing the above method, the client and server exchange or agree on encryption keys and passwords to be used when encrypting data before starting communication, which improves the security of communication data and ensures the confidentiality and reliability of communication between the client and the server.

[0109] In some embodiments, if the target component library contains a network component used to implement data transmission with the server, then based on the enabled HTTP service, the encrypted communication request is sent to the server, including: based on the enabled HTTP service, the encrypted communication request is sent to the server through the network component.

[0110] In Okhttp, network components can be network interceptors.

[0111] For example, see Figure 4 As shown, assuming the enabled HTTP service is an HTTP / 2.0 service, based on the enabled HTTP service, the request is sent to the I / O interceptor through the network interceptor, and the I / O interceptor sends the encrypted communication request to the server.

[0112] In some embodiments, when it is determined that the default transport layer protocol is to be used and a new communication request for the application is received, the client can also establish a default encrypted channel between the application and the server by calling the target methods contained in the mount class in the target component library, and enable the application to communicate with the server based on the default encrypted channel.

[0113] It should be noted that, in the embodiments of this application, the target methods included in the mount class are used to implement the default transport layer protocol.

[0114] For example, when the default transport layer protocol is determined to be used and a new communication request for the application is received, the client can also create sslSocketFactory objects and sslSocket objects in Okhttp, call the target methods contained in the creation of sslSocketFactory objects and sslSocket objects respectively, and establish a default encrypted channel between the application and the server.

[0115] With the above implementation method, if you want to use the international algorithm and disable the national cryptographic algorithm, you only need to use the default parameters of Okhttp during construction. In this way, Okhttp can support both international and national cryptographic algorithms, and the switching process between the international and national cryptographic algorithms is relatively simple and efficient.

[0116] Based on the same inventive concept, embodiments of this application provide a data processing apparatus. For example... Figure 8 As shown, this is a schematic diagram of the structure of a data processing device 800, which may include: The construction unit 801 is used to obtain a target plugin containing a target transport class. There is at least one target method with the same name and parameters between the target transport class and the specified mount class. Each target method contained in the target transport class is used to implement the target transport layer protocol. Loading unit 802 is used to load the target plugin in the target component library containing the mount class; The establishment unit 803 is used to establish a secure encrypted channel between the application and the server by calling the target methods contained in the target transport class in the target component library when a communication request for the application is received, and to enable the application to communicate with the server based on the secure encrypted channel.

[0117] As one possible implementation, the target component library includes a connection component for establishing a connection with the server. When establishing a secure encrypted channel between the application and the server by calling the target methods contained in the target transport class in the target component library, the establishment unit 803 is specifically used for: When the connection component receives the communication request, it calls the target methods contained in the target transport class to establish a TLS (Transport Layer Security) connection. When the TLS connection is successful, it is determined that a secure encrypted channel between the application and the server has been established.

[0118] As one possible implementation, when invoking the target methods contained in the target transport class to establish a TLS (Transport Layer Security) connection, the establishment unit 803 is specifically used for: Determine if there are available connections in the connection pool; If no available connection is found, when the target transport layer protocol is determined to be used, the target methods contained in the target transport class are invoked to establish a TLS connection.

[0119] As one possible implementation, the target methods included in the target transport class include: a socket creation method, a protocol initiation method, and the target transport layer protocol implementation method; When the target methods contained in the target transport class are invoked to establish a TLS connection, the establishment unit 803 is specifically used for: When the socket creation method is called, a socket is created, and a session is created based on the created socket; When the protocol startup method is invoked, the target transport layer protocol implementation method is obtained from the native layer of the local framework, and a TLS connection is established in the created session based on the target transport layer protocol implementation method.

[0120] As one possible implementation, the target plugin also includes a wrapper layer for obtaining the data transfer from the native framework layer. When obtaining the target transport layer protocol implementation method from the native layer of the local framework, the establishment unit 803 is specifically used for: When the wrapper layer receives a data query request from the Java layer, it reads the stored implementation method of the target transport layer protocol into the native layer. The target transport layer protocol implementation method is passed to the Java layer through the wrapper layer.

[0121] As one possible implementation, when the application communicates with the server based on the secure encrypted channel, the establishment unit 803 is specifically used for: The communication request is encrypted using the shared key negotiated in the TLS connection to obtain the encrypted communication request; Enable the Hypertext Transfer Protocol (HTTP) service, and based on the enabled HTTP service, send the encrypted communication request to the server.

[0122] As one possible implementation, the target component library includes a network component, which is used to implement data transmission with the server. When the encrypted communication request is sent to the server based on the already enabled HTTP service, the establishment unit 803 is specifically used for: Based on the enabled HTTP service, the encrypted communication request is sent to the server via a network component.

[0123] As one possible implementation, the establishment unit 803 is further used for: When it is determined that the default transport layer protocol will be used, and a new communication request for the application is received, a default encrypted channel between the application and the server is established in the target component library by calling the target methods contained in the mount class; wherein, the target methods contained in the mount class are used to implement the default transport layer protocol. The application communicates with the server via the default encrypted channel.

[0124] For ease of description, the above sections are divided into modules (or units) according to their functions and described separately. Of course, in implementing this application, the functions of each module (or unit) can be implemented in one or more software or hardware components.

[0125] Regarding the apparatus in the above embodiments, the specific manner in which each unit executes the request has been described in detail in the embodiments related to the method, and will not be elaborated here.

[0126] Those skilled in the art will understand that various aspects of this application can be implemented as a system, method, or program product. Therefore, various aspects of this application can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, collectively referred to herein as a "circuit," "module," or "system."

[0127] Based on the same inventive concept, embodiments of this application also provide an electronic device. In one embodiment, the electronic device can be a server or a terminal device. See also... Figure 9 As shown, it is a schematic diagram of the structure of a possible electronic device provided in an embodiment of this application. Figure 9 In the electronic device 900, there are: processor 910 and memory 920.

[0128] The memory 920 stores a computer program that can be executed by the processor 910. The processor 910 can execute the steps of the above data processing method by executing the instructions stored in the memory 920.

[0129] Memory 920 may be volatile memory, such as random-access memory (RAM); memory 920 may also be non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid-state drive (SSD); or memory 920 may be any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto. Memory 920 may also be a combination of the above-mentioned memories.

[0130] The processor 910 may include one or more central processing units (CPUs) or digital processing units, etc. The processor 910 implements the aforementioned data processing methods when executing computer programs stored in the memory 920.

[0131] In some embodiments, the processor 910 and the memory 920 may be implemented on the same chip, while in other embodiments they may be implemented on separate chips.

[0132] This application embodiment does not limit the specific connection medium between the processor 910 and the memory 920. This application embodiment takes the connection between the processor 910 and the memory 920 via a bus as an example. Figure 9 The diagram uses thick lines to describe the connections between other components; these are merely illustrative and not intended to be limiting. Buses can be categorized as address buses, data buses, control buses, etc. For ease of description, Figure 9 It is described using only a thick line, but does not indicate that there is only one bus or one type of bus.

[0133] Based on the same inventive concept, embodiments of this application provide a computer-readable storage medium including a computer program. When the computer program is run on an electronic device, it causes the electronic device to perform the steps of the aforementioned data processing method. In some possible implementations, various aspects of the data processing method provided in this application can also be implemented as a program product including a computer program. When the program product is run on an electronic device, the computer program causes the electronic device to perform the steps of the aforementioned data processing method. For example, the electronic device can perform actions such as... Figure 2 The steps are shown in the figure.

[0134] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections having one or more wires, portable disks, hard disks, RAM, ROM, erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0135] The program product of the embodiments of this application may be a CD-ROM and include a computer program, and may run on an electronic device. However, the program product of this application is not limited thereto. In this document, the readable storage medium may be any tangible medium that contains or stores a computer program that may be used by or in conjunction with a command execution system, apparatus, or device.

[0136] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying a readable computer program. This propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting a computer program for use by or in conjunction with a command execution system, apparatus, or device.

[0137] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0138] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A data processing method, characterized in that, Applied to a client, the method includes: Obtain a target plugin containing a target transport class, wherein there is at least one target method with the same name and parameters between the target transport class and the specified mount class, and each target method contained in the target transport class is used to implement the target transport layer protocol; The target plugin is loaded into the target component library containing the mount class. The target transport class contained in the target plugin is obtained by rewriting the mount class in the target component library. The target component library is OkHttp, and the mount class is the sslSocketFactory reserved in OkHttp. The specific implementation of the sslSocket class is rewritten using sslSocketFactory as the mount point. The target component library contains a connection component, which uses the connection interceptor included in OkHttp to establish a connection with the server. When a communication request for an application is received and the connection component obtains the communication request, it calls the target methods contained in the target transport class to establish a Transport Layer Security (TLS) connection. When the TLS connection is successful, it determines that a secure encrypted channel between the application and the server has been established, and enables the application to communicate with the server based on the secure encrypted channel.

2. The method as described in claim 1, characterized in that, The invocation of the target methods contained in the target transport class to establish a TLS (Transport Layer Security) connection includes: Determine if there are available connections in the connection pool; If no available connection is found, when the target transport layer protocol is determined to be used, the target methods contained in the target transport class are invoked to establish a TLS connection.

3. The method as described in claim 1, characterized in that, The target methods included in the target transport class include: a socket creation method, a protocol initiation method, and an implementation method of the target transport layer protocol; The invocation of the target methods contained in the target transport class to establish a TLS connection includes: When the socket creation method is called, a socket is created, and a session is created based on the created socket; When the protocol startup method is called, the implementation method of the target transport layer protocol is obtained from the native layer of the local framework, and a TLS connection is established in the created session based on the implementation method of the target transport layer protocol.

4. The method as described in claim 3, characterized in that, The target plugin also includes a wrapper layer; The method for obtaining the implementation of the target transport layer protocol from the native layer of the local framework includes: When the wrapper layer receives a data query request from the Java layer, it reads the implementation method of the target transport layer protocol stored therein into the native layer. The implementation method of the target transport layer protocol is passed to the Java layer through the wrapper layer.

5. The method according to any one of claims 1-4, characterized in that, The step of enabling the application to communicate with the server via the secure encrypted channel includes: The communication request is encrypted using the shared key negotiated in the TLS connection to obtain the encrypted communication request; Enable the Hypertext Transfer Protocol (HTTP) service, and based on the enabled HTTP service, send the encrypted communication request to the server.

6. The method as described in claim 5, characterized in that, The target component library includes a network component, which is used to implement data transmission with the server. Sending the encrypted communication request to the server based on the already enabled HTTP service includes: Based on the enabled HTTP service, the encrypted communication request is sent to the server via a network component.

7. The method according to any one of claims 1-4, characterized in that, Also includes: When it is determined that the default transport layer protocol will be used, and a new communication request for the application is received, a default encrypted channel between the application and the server is established in the target component library by calling the target methods contained in the mount class; wherein, the target methods contained in the mount class are used to implement the default transport layer protocol. The application communicates with the server via the default encrypted channel.

8. A data processing apparatus, characterized in that, include: A construction unit is used to obtain a target plugin containing a target transport class. There is at least one target method with the same name and parameters between the target transport class and the specified mount class. Each target method contained in the target transport class is used to implement the target transport layer protocol. A loading unit is used to load the target plugin from the target component library containing the mount class; the target transport class contained in the target plugin is obtained by rewriting the mount class in the target component library; the target component library is OkHttp, the mount class is the sslSocketFactory reserved in OkHttp, and the specific implementation of the sslSocket class is rewritten with sslSocketFactory as the mount point; the target component library contains a connection component, and the connection component uses the connection interceptor included in OkHttp to establish a connection with the server. The establishment unit is used to, when a communication request for an application is received and the connection component obtains the communication request, call the target methods contained in the target transport class to establish a Secure Transport Layer Protocol (TLS) connection; when the TLS connection is successful, determine that the secure encrypted channel between the application and the server has been established, and enable the application to communicate with the server based on the secure encrypted channel.

9. The apparatus as claimed in claim 8, characterized in that, When invoking the target methods contained in the target transport class to establish a TLS (Transport Layer Security) connection, the establishment unit is specifically used for: Determine if there are available connections in the connection pool; If no available connection is found, when the target transport layer protocol is determined to be used, the target methods contained in the target transport class are invoked to establish a TLS connection.

10. The apparatus as claimed in claim 9, characterized in that, The target methods included in the target transport class include: a socket creation method, a protocol initiation method, and an implementation method of the target transport layer protocol; When invoking the target methods contained in the target transport class to establish a TLS connection, the establishment unit is specifically used for: When the socket creation method is called, a socket is created, and a session is created based on the created socket; When the protocol startup method is called, the implementation method of the target transport layer protocol is obtained from the native layer of the local framework, and a TLS connection is established in the created session based on the implementation method of the target transport layer protocol.

11. An electronic device, characterized in that, It includes a processor and a memory, wherein the memory stores a computer program that, when executed by the processor, causes the processor to perform the steps of the method according to any one of claims 1 to 7.

12. A computer-readable storage medium, characterized in that, It includes a computer program that, when run on an electronic device, causes the electronic device to perform the steps of the method according to any one of claims 1 to 7.

13. A computer program product, characterized in that, It includes a computer program stored in a computer-readable storage medium, and a processor of an electronic device reads from and executes the computer program, causing the electronic device to perform the steps of the method according to any one of claims 1 to 7.

Images