Method, device and equipment for constructing secure communication architecture and storage medium

Abstract

The application provides a construction method and device of a secure communication architecture, equipment and a storage medium, relates to the technical field of data security and communication, identifies the full-link requirement of a system to be connected for security encryption, the requirement including an encryption algorithm library, connects the system to be connected by applying a command based on a first secure encryption protocol based on a command line tool supporting the encryption algorithm library, and obtains a first result; if the first result is a connection failure, connects the system to be connected by applying a command based on a second secure encryption protocol, and obtains key information of the system to be connected; updates the protocol configuration of a communication component and loads it, and if the key information is displayed after loading, it is determined that the secure communication architecture based on the second secure encryption protocol is applied to the system to be connected. The application can determine the secure encryption protocol connected with the system to be connected through the command line tool in the test environment, and verify the feasibility, so as to reduce the research and development cycle, and further reduce the project implementation cost of facing new encryption protocols.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data security and communication technology, and in particular to a method and device for constructing a secure communication architecture, and a storage medium. BACKGROUND

[0002] With the progress of science and technology, the application range of the Internet is becoming wider and wider, for example, users rely on the network for shopping, communication, learning and work, which also makes the personal data and sensitive information of users at risk of being stolen or misused in the network environment. Network security deeply affects information security and social and economic development. Among various technologies for protecting network security, cryptographic algorithms are currently recognized as the key core technology that is effective, reliable and economical in the world.

[0003] In critical fields such as the financial industry, long-term use of encryption algorithms such as AES and 3DES is not self-controllable, and therefore, there is an urgent need to provide a secure communication architecture based on a self-controllable encryption algorithm. SUMMARY

[0004] The present application provides a method and device for constructing a secure communication architecture, and a storage medium, to solve the problem of lack of a secure communication architecture based on a self-controllable encryption algorithm.

[0005] In a first aspect, the present application provides a method for constructing a secure communication architecture, comprising:

[0006] Identifying the full-link requirement for secure encryption of the interfacing system, the full-link requirement including a secure and controllable encryption algorithm library;

[0007] Based on a command line tool supporting the encryption algorithm library, applying a first command to connect with the interfacing system, obtaining a first result of whether the connection with the interfacing system is successful, the first command being based on a first secure encryption protocol;

[0008] If the first result is a connection failure, then based on the command line tool, a second command is applied to connect with the interfacing system, obtaining key information of the interfacing system, the second command being based on a second secure encryption protocol;

[0009] Updating the protocol configuration of the communication component to the second secure encryption protocol, and connecting with the interfacing system by loading the communication component, if the key information is displayed after loading, then it is determined that the secure communication architecture based on the second secure encryption protocol is applied to the interfacing system.

[0010] In a possible implementation, the method further includes: adding related code of the secure encryption algorithm in the function code corresponding to the communication component if the key information is not displayed after being loaded, updating the protocol configuration to the second secure encryption protocol, and obtaining an updated communication component; connecting with the interfacing system by loading the updated communication component; and determining that the secure communication architecture based on the second secure encryption protocol is applied to the interfacing system if the key information is displayed after being loaded.

[0011] In a possible implementation, the method further includes: determining a Secure Sockets Layer (SSL) gateway that meets the full-link requirement; importing the public key certificate of the interfacing system obtained in advance into the SSL gateway; and performing an updating operation on the protocol configuration in the SSL gateway, the updating operation including updating the protocol configuration to the second secure encryption protocol, so that the secure communication architecture based on the second secure encryption protocol is applied to the interfacing system in the production environment.

[0012] In a possible implementation, the secure communication architecture includes an application system, an interfacing system, and an SSL gateway, and the SSL gateway is configured to establish a communication session between the application system and the interfacing system based on a public key certificate and a protocol and a key suite supported by the application system, to obtain key information of the interfacing system, and to send the key information of the application system to the interfacing system.

[0013] In a possible implementation, the secure communication architecture further includes a HaProxy cluster, and the SSL gateway is further configured to receive a second encrypted message sent by the interfacing system, decrypt the second encrypted message based on the key information of the interfacing system to obtain a decrypted message, convert the decrypted message into the first message format to obtain a decrypted message in the first format, and send the decrypted message in the first format to the HaProxy cluster.

[0014] In a possible implementation, the method for constructing the secure communication architecture further includes: deploying the HaProxy cluster in an isolated area of an internal network where the application system is located, and performing uniform resource locator (URL) mapping of the internal network address of the application system through the HaProxy cluster.

[0015] In a possible implementation, the command line tool is obtained by: downloading source code of a Linux distribution integrated with an openssl library and the command line tool; and compiling the source code to obtain the command line tool.

[0016] In a second aspect, the present application provides a device for constructing a secure communication architecture, comprising:

[0017] a recognition module configured to recognize a full-link requirement of a system to be connected for security encryption, the full-link requirement comprising a security-controllable encryption algorithm library;

[0018] a first processing module configured to connect to the system to be connected based on a command line tool supporting the encryption algorithm library, and to obtain a first result of whether the connection to the system to be connected is successful, the first command being based on a first security encryption protocol;

[0019] a second processing module configured to, when the first result is a connection failure, connect to the system to be connected based on the command line tool and a second command, and to obtain key information of the system to be connected, the second command being based on a second security encryption protocol;

[0020] a third processing module configured to update a protocol configuration of a communication component to the second security encryption protocol, and to connect to the system to be connected by loading the communication component, and to determine that the secure communication architecture based on the second security encryption protocol is applied to the system to be connected, if the key information is displayed after the loading.

[0021] In a third aspect, the present application provides an electronic device, comprising: a processor, and a memory in communication connection with the processor;

[0022] the memory is configured to store computer execution instructions;

[0023] the processor is configured to execute the computer execution instructions stored in the memory, so as to implement the method of any one of the first aspect.

[0024] In a fourth aspect, the present application provides a computer readable storage medium, the computer readable storage medium storing computer execution instructions, the computer execution instructions being executed to implement the method of any one of the first aspect.

[0025] In a fifth aspect, the present application provides a computer program product comprising a computer program which, when executed, implements the method of any one of the first aspect.

[0026] The application provides a construction method, device and equipment of a secure communication architecture and a storage medium. The construction method, device and equipment of the secure communication architecture identify full-link requirements of a system to be connected for security encryption, the full-link requirements including a security controllable encryption algorithm library. A command line tool supporting the encryption algorithm library is applied to connect the system to be connected based on a first command, and a first result of whether the connection with the system to be connected is successful is obtained, the first command being based on a first secure encryption protocol. If the first result is a connection failure, a second command is applied to connect the system to be connected based on the command line tool, and key information of the system to be connected is obtained, the second command being based on a second secure encryption protocol. The protocol configuration of a communication component is updated to the second secure encryption protocol, and the communication component is connected to the system to be connected by loading. If the key information is displayed after the loading, it is determined that the secure communication architecture based on the second secure encryption protocol is applied to the system to be connected. In this process, in an environment without a hard encryption infrastructure, the secure encryption protocol is applied to connect the system to be connected based on the command line tool supporting the encryption algorithm library. When the soft encryption faces a communication layer error, the new secure encryption protocol is applied to connect the system to be connected, so as to determine the secure encryption protocol supporting the connection with the system to be connected. The protocol configuration of the communication component is further updated to the secure encryption protocol supporting the connection with the system to be connected. If the key information is displayed after the loading of the communication component, it is determined that the secure communication architecture for the system to be connected is determined. Thus, the secure encryption protocol supporting the connection with the system to be connected can be determined through the command line tool in the test environment, and the feasibility can be verified through the communication component, so that the development and test cycle is reduced, and the project implementation cost for facing a new encryption protocol is reduced. BRIEF DESCRIPTION OF DRAWINGS

[0027] The accompanying drawings, which are incorporated herein and form part of the specification, illustrate embodiments consistent with the present application and, together with the description, further serve to explain the principles of the application.

[0028] Figure 1 A flowchart of a construction method of a secure communication architecture provided for an exemplary embodiment of the present application;

[0029] Figure 2 An interaction process diagram of an SSL / TLS protocol provided for an exemplary embodiment of the present application;

[0030] Figure 3 A secure communication architecture diagram provided for an exemplary embodiment of the present application;

[0031] Figure 4 A structure diagram of a construction device of a secure communication architecture provided for an exemplary embodiment of the present application;

[0032] Figure 5 The structural schematic diagram of the electronic device provided in the exemplary embodiments of the present application is shown.

[0033] The specific embodiments of the present application have been shown and described in the above-described drawings, and will be described in more detail hereinafter. These drawings and the written description are not intended to restrict the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by reference to a particular embodiment. DETAILED DESCRIPTION

[0034] The exemplary embodiments will be described in detail herein with reference to the attached drawings. The same numbers are used in different drawings to represent the same or similar elements. The embodiments described in the following exemplary embodiments are not meant to represent all implementations consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with some aspects of the present application as detailed in the appended claims.

[0035] The terms "first", "second", and the like in the description and in the claims of the present application are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the use of the terms so construed can interchange depending on the context in which they are used, and that the embodiments of the present application described herein are capable of operation in other sequences than described or otherwise illustrated herein. Further, the terms "comprise" and "include", and variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises, has, includes, or comprises elements or steps that are not expressly listed is not excluded from use as long as these elements or steps are consistent with those specifically listed. Any process, method, article, or apparatus that comprises, has, includes, or comprises elements or steps not expressly listed is nevertheless within the scope of the present application.

[0036] It should be noted that the collection, storage, use, processing, transmission, provision, and disclosure of information such as financial data or user data in the technical solutions of the present application comply with relevant laws and regulations and do not violate public order and good customs. The user information (including but not limited to user device information and user personal information) and data (including but not limited to data for analysis, stored data, and displayed data) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use, and processing of relevant data need to comply with relevant laws, regulations, and standards, and provide corresponding operation portals for users to choose authorization or rejection.

[0037] Terminology:

[0038] Security encryption: the password algorithm approved by the relevant department, which includes SM1, SM4, SM7, and Zuchongzhi cipher (ZUC) is a symmetric algorithm; SM2 and SM9 are asymmetric algorithms, and SM3 is a hash algorithm; the algorithms mainly involved in the application include SM1, SM2, SM3, and SM4.

[0039] SM1: a block cipher algorithm, the block length is 128 bits, and the key length is 128 bits. The algorithm security strength and related hardware and software implementation performance are equivalent to AES. The algorithm is not public and exists in the chip in the form of an IP core.

[0040] SM2: namely, the elliptic curve cryptography (ECC), but different from the signature algorithm (ECDSA) and encryption algorithm (ECDH) in signature and key exchange, and a more secure mechanism is adopted; in addition, SM2 recommends a 256-bit curve as a standard curve. The SM2 standard includes four parts: general rules, digital signature algorithm, key exchange protocol, and public key encryption algorithm, and the appendix of each part details the related details and examples of implementation; the digital signature algorithm, the key exchange protocol, and the public key encryption algorithm all use the SM3 password hash algorithm and the random number generator approved by the relevant department, and select the finite field and the elliptic curve according to the general rules to generate the key pair.

[0041] SM3: the password hash algorithm (i.e. hash or hash) algorithm gives the calculation method and calculation steps of the hash function algorithm, and gives the operation example; this algorithm is suitable for digital signature and verification, message authentication code generation and verification, and random number generation in commercial cryptographic applications, and can meet the security requirements of various cryptographic applications; it can be used in SM2 and SM9 standards.

[0042] SM4: this algorithm is a block algorithm for wireless local area network products. The block length of the algorithm is 128 bits, and the key length is 128 bits. The encryption algorithm and the key expansion algorithm both use a 32-round nonlinear iteration structure. The decryption algorithm and the encryption algorithm have the same structure, except that the order of use of the round keys is reversed, and the decryption round key is the reverse order of the encryption round key.

[0043] Nginx: (engine x) is a high-performance Hypertext Transfer Protocol (HTTP) and reverse proxy World Wide Web (web) server that also provides IMAP / POP3 / SMTP services. Nginx releases source code under a Berkeley Software Distribution (BSD) license and is known for its stability, rich feature set, example configuration files, and low system resource consumption. Nginx is characterized by low memory footprint and high concurrency, and its concurrency performance is good among web servers of the same type.

[0044] SSL: Secure Sockets Layer (SSL) is used to establish an encrypted connection between a web browser and a web server in network communication.

[0045] TLS: Transport Layer Security (TLS) is used to provide confidentiality and data integrity between two communicating applications. Due to differences in encryption algorithms between SSL and TLS, they cannot operate with each other.

[0046] CA: Certificate Authority (CA) is a third-party authority that undertakes the legal verification of public keys.

[0047] In related technologies, in key fields such as the financial industry, long-term use of encryption algorithms such as AES and 3DES is not self-controllable. With the increasing popularity of secure encryption algorithms, it has become an urgent need to replace long-term use of algorithms such as AES and 3DES with self-controllable secure encryption algorithms in key fields such as the financial industry. Therefore, it is urgent to provide a secure communication architecture based on a self-controllable encryption algorithm.

[0048] In view of the above problems, the inventors have found in the research process that, compared with the good ecology of algorithms such as AES and 3DES, the self-controllable encryption algorithm is still in the development stage, and the related architecture, technical implementation and ecological chain in the industry and the technical accumulation within the enterprise still have deficiencies, and it is difficult to complete the technical key milestones in a short period of time; and in the process of enterprise old system transformation or new system construction, relevant technical personnel lack standardized guidance, and the knowledge system of the self-controllable encryption algorithm still needs to be improved; in addition, with the large-scale development of digital transformation and security encryption transformation in various industries, the project implementation cost of the new encryption protocol will continue to rise due to the lack of follow-up of the industry technical support. For example, taking a certain application system accessing a system (such as a financial supervision platform) through a secure encryption protocol as an example, there are multiple potential architecture schemes, such as SSL gateway, Nginx proxy and Java programming interface, but the interfacing system does not provide specific client implementation, only provides the types of encryption algorithm library; for the above schemes, any one of the routes may be found to be infeasible after going through the development and testing period, and even affect the supply strategy of the infrastructure.

[0049] Based on the above, the embodiment of the present application provides a construction scheme of a secure communication architecture, which identifies the full-link requirement of the interfacing system for secure encryption in advance, in an environment without hard encryption infrastructure, based on a command line tool supporting the encryption algorithm library in the full-link requirement, applies a secure encryption protocol to connect with the interfacing system, and when the soft encryption faces a communication layer error, analyzes the link failure reason from the bottom layer, based on the failure reason, applies a new secure encryption protocol to connect with the interfacing system, to determine the secure encryption protocol supporting the connection with the interfacing system, further updates the protocol configuration of the communication component to the secure encryption protocol supporting the connection with the interfacing system, and then performs a prototype test, if the key information is displayed after loading the communication component, it is determined that the secure communication architecture for the interfacing system, thereby reducing the development and testing period, and further reducing the project implementation cost of the new encryption protocol.

[0050] In order to facilitate understanding, first, the application scenario of the embodiment of the present application is introduced.

[0051] For example, the application scenario of the embodiment of the present application includes a server, an application system and an interfacing system. The server and the application system are deployed in the intranet where the application system is located, and a communication connection is established between the server, the application system and the interfacing system. In actual application, the server identifies the full-link requirement of the interfacing system for secure encryption, executes the construction method of the secure communication architecture provided by the present application, and determines the secure communication architecture for the interfacing system.

[0052] The technical solutions of the embodiments of the present application and how the technical solutions solve the above technical problems will be described in detail below with specific embodiments in combination with the above application scenarios. The following specific embodiments can be combined with each other, and the same or similar concepts or processes can not be described again in some embodiments. The embodiments of the present application will be described below in combination with the drawings. It should be noted that the above application scenarios are only used to facilitate understanding of the spirit and principles of the present application, and the embodiments of the present application are not limited by the above application scenarios.

[0053] Figure 1 A flowchart of a construction method of a secure communication architecture provided for an exemplary embodiment of the present application is shown in FIG. 1. As shown in FIG. 1, the construction method of the secure communication architecture includes the following steps: Figure 1

[0054] S101, identify the full-link requirement of the interfacing system for secure encryption, including a secure and controllable encryption algorithm library.

[0055] For example, the full-link requirement of the interfacing system for secure encryption is identified, including a secure and controllable encryption algorithm library, such as a secure and controllable encryption algorithm library gmssl. Considering that the interfacing system has a clear requirement for security control, a secure encryption digital signature is required to ensure the reliability and anti-fraud of business data, such as SSL encryption and decryption and message signature and verification, which are TLS ECC WITH SM4 SM3 and SM2 with SM3 respectively, but the interfacing system does not provide an implementation tool.

[0056] For example, Figure 2 An interaction process diagram of an SSL / TLS protocol provided for an exemplary embodiment of the present application is shown in FIG. 2. As shown in FIG. 2, each TLS connection starts with a handshake, and if the TLS client has not established a session with the TLS server before, a complete handshake process will be performed by both parties to negotiate the TLS session. Among them, the common handshake rules are as follows: Figure 2

[0057] 1) The TLS client sends a request ClientHello to the TLS server;

[0058] ​​The message carries the function and preference of the TLS client to the TLS server, including Version, Random, Session ID, Cipher Suites and Compression. Among them, Version refers to the protocol version, used to indicate the best protocol version supported by the TLS client; Random is a 32-byte data, of which 28 bytes are randomly generated, and the other 4 bytes contain additional information related to the TLS client clock. In the handshake, the TLS client and the TLS server will both provide random numbers, and the client's temporary record is recorded as the random_C parameter (used for subsequent key generation). This randomness is unique for each handshake, plays a crucial role in authentication, can prevent replay attacks, and confirms the integrity of the initial data exchange; Session ID is empty in the first connection, indicating that the TLS client does not want to restore an existing session. A typical session ID contains 32 bytes of randomly generated data, which is usually generated by the TLS server and returned to the client through ServerHello; Cipher Suites is a cipher suite block, which is a list of all cipher suites supported by the TLS client, arranged in priority order; Compression is a compression method supported by the TLS client, and the default compression method is null, representing no compression; Extensions is an extension block, composed of any number of extensions, which carry additional data.

[0059] 2) The TLS server responds to ServerHello;

[0060] The message also includes ServerCertificate, ServerKeyExchange, CertificateRequest and ServerHelloDone, which are used to return the connection parameters selected by the TLS server to the TLS client. Among them, ServerCertificate refers to the server certificate, ServerKeyExchange refers to the server key exchange, and CertificateRequest refers to the certificate application. The structure of this message is similar to ClientHello, but each field only contains one option, which contains the random_S parameter of the server (used for subsequent key negotiation); the TLS server does not need to support the best version supported by the TLS client. If the TLS server does not support the same version as the TLS client, it can provide some other version in the hope that the TLS client can accept it.

[0061] 3) TLS client response and TLS server response Certificate;

[0062] The message includes: ClientCertificate, ClientKeyExchange, CertificateVerify, ChangeCipherSpec and Finished. Wherein ClientCertificate refers to the client certificate, ClientKeyExchange refers to the client key exchange, CertificateVerify refers to the certificate verification, ChangeCipherSpec refers to the change cipher specification. The typical Certificate message is used to carry the TLS server X.509 certificate chain.

[0063] Wherein, the TLS server must ensure that the certificate it sends is consistent with the selected algorithm suite, that is, the public key algorithm must match the one used in the suite. In addition, some key exchange algorithms rely on specific data embedded in the certificate, and the certificate must be signed with an algorithm supported by the TLS client. In summary, it is shown that the TLS server needs to configure multiple certificates (each certificate may be equipped with different certificate chains). In addition, the Certificate message is optional, because not all suites use identity authentication, and not all identity authentication methods require a certificate.

[0064] In the related art, the underlying implementation of SSL / TLS in the C / S communication architecture is that the application service (C / Java / Python) calls system library functions, and is completed in combination with a proxy server such as Nginx, the algorithms such as AES and 3DES used by the application service have been implemented by mainstream software manufacturers, and a large amount of knowledge base including code, configuration, error troubleshooting is provided in the Internet community, which can effectively help beginners or experienced developers to build high-availability encryption components; at the application or protocol layer, commercial CA certificates are usually purchased from professional certificate suppliers to support binding single domain names or multiple domain names. For the B / S architecture, only the certificates issued by the certificate authority CA certified by the international relevant departments are trusted by major browsers, and users can also manually install the certificate chain to trust the user certificates issued by a specific manufacturer.

[0065] Considering the traditional AES and 3DES encryption standard implementation, from the operating system openssl library to the JDK development tool, including open source projects, there are complete provisions, and the soft encryption scheme can be used in the whole link to complete the green light test quickly. Therefore, the loading and unloading of the SSL / TLS certificate can be completed by referring to the JDK tool at the application layer, and the four-layer proxy of Nginx can be implemented, or the seven-layer proxy of Nginx can be implemented. Correspondingly, since the four-layer proxy has a certain invasiveness to the application code, and no explicit support for secure encryption SSL is found during development or running, the seven-layer proxy is a more ideal architecture design. However, in the test process of the seven-layer proxy scheme, the Nginx always has communication errors, and the error log only shows the HTTP brief information. Through the network packet capture tool, the cause is located in the first stage of the SSL / TLS handshake ClientHello error, for example, "TLSv1.2 63 Alert (Level: Fatal, Description: Handshake Failure)". Further analysis shows that the secure encryption communication session process is compatible with the SSL / TLS standard, and considering that there are few possible reasons for the failure of the first stage handshake, generally, the protocol and algorithm suite do not match, so the Nginx configuration of each version of the TLS protocol and the security algorithm suite is tried, but the same error is still reported, and there is no specific troubleshooting guide. Considering that the underlying dependence of Nginx on the security algorithm may affect the compatibility of the security encryption algorithm, other construction ideas need to be sought.

[0066] In some embodiments, the command line tool is obtained by: downloading the source code of a Linux distribution integrated with the openssl library and the command line tool; and compiling the source code to obtain the command line tool.

[0067] In some embodiments, the command line tool is obtained by: downloading the source code of a Linux distribution integrated with the openssl library and the command line tool; and compiling the source code to obtain the command line tool.

[0068] For example, since the current mainstream Linux distributions all integrate the openssl library and command line tools, but do not support the secure and controllable encryption algorithm library gmssl, the source code of the Linux distribution integrating the openssl library and command line tools is downloaded from the open source mirror site, and the command line tool supporting the encryption algorithm library gmssl is obtained by compiling the source code. Further, in the command line tool page, a first command (for example, "openssl s_client -tls -connect X.X.X.X:XXXX") is input to connect with the docking system, and a first result of whether the connection with the docking system is successful is obtained. Wherein, "X.X.X.X:XXXX" is the address and port number of the docking system, and the first command is based on the tls secure encryption protocol.

[0069] S103, if the first result is a connection failure, based on the command line tool, a second command is applied to connect with the docking system to obtain the key information of the docking system, and the second command is based on a second secure encryption protocol.

[0070] Correspondingly, if the first result is a connection failure (for example, returned as empty), the reason for the connection failure is analyzed, for example, from the command line parameter value list, it is found that the gmtls protocol name is single column, then based on the command line tool, a second command (for example, "openssl s_client -gmtls -connect X.X.X.X:XX XX") is applied to connect with the docking system to obtain the key information of the docking system, for example, the key information is Z. Wherein, the second command is based on the gmtls secure encryption protocol.

[0071] S104, the protocol configuration of the communication component is updated to the second secure encryption protocol, and the docking system is connected through loading the communication component, if the key information is displayed after loading, it is determined that the secure communication architecture based on the second secure encryption protocol is applied to the docking system.

[0072] Further, based on the practical conclusion of S102 and S103, the SSL / TLS protocol configuration of the communication component Nginx is updated to GMTLS, and the docking system is connected through loading Nginx, if the key information is displayed after loading, it is determined that the secure communication architecture based on the gmtls secure encryption protocol is applied to the docking system.

[0073] The method for constructing the secure communication architecture provided in the embodiments of the present application can be used to determine the secure encryption protocol supported by the connection with the interfacing system based on the command line tool supporting the encryption algorithm library, and to connect the interfacing system by applying a new secure encryption protocol when the soft encryption faces a communication layer error, so as to determine the secure encryption protocol supported by the connection with the interfacing system, further update the protocol configuration of the communication component to the secure encryption protocol supported by the connection with the interfacing system, and determine the secure communication architecture for the interfacing system if the key information is displayed after the communication component is loaded, so that the secure encryption protocol supported by the connection with the interfacing system can be determined through the command line tool in the test environment, and the feasibility can be verified through the communication component, thereby reducing the development and test cycle and further reducing the project implementation cost of facing new encryption protocols.

[0074] In some embodiments, the method for constructing the secure communication architecture further includes: if the key information is not displayed after the loading, adding the related code of the secure encryption algorithm in the function code corresponding to the communication component, updating the protocol configuration to the second secure encryption protocol, and obtaining the updated communication component; connecting the interfacing system by loading the updated communication component; and if the key information is displayed after the loading, determining that the secure communication architecture based on the second secure encryption protocol is applied to the interfacing system.

[0075] For example, if the key information is not displayed after the loading, it indicates that the Nginx does not contain or depend on the related library of the secure encryption algorithm, the open source version of the Nginx is modified, the related code of the secure encryption algorithm is added in the function code corresponding to the Nginx, the protocol configuration of the modified Nginx is updated to the GMTLS secure encryption protocol, and the updated communication component Nginx is obtained; further, the interfacing system is connected by loading the updated Nginx, and if the key information is displayed after the loading, it is determined that the secure communication architecture based on the gmtls secure encryption protocol is applied to the interfacing system.

[0076] Considering that the test environment is limited to the virtual private network (VPN) and can only complete the application layer test through soft encryption, the SSL gateway provided by a security vendor needs to be selected in the production environment for the commercial nature and stability. Therefore, on the basis of the above embodiments, in some embodiments, the method for constructing the secure communication architecture further includes: determining the SSL gateway meeting the full link requirement; importing the public key certificate of the interfacing system obtained in advance into the SSL gateway; and performing an update operation on the protocol configuration in the SSL gateway, the update operation including updating the protocol configuration to the second secure encryption protocol, so as to apply the secure communication architecture based on the second secure encryption protocol to the interfacing system in the production environment.

[0077] For example, the protocol in the SSL gateway is updated to GMTLS secure encryption protocol, so as to apply the security communication architecture based on the GMTLS secure encryption protocol to the production environment for the interfacing system.

[0078] Based on the above embodiments, in some embodiments, the security communication architecture includes an application system, an external system and an SSL gateway, wherein: the SSL gateway is configured to establish a communication session between the application system and the interfacing system based on the public key certificate and the protocol and key suite supported by the application system, to obtain the key information of the interfacing system, and to send the key information of the application system to the interfacing system; the application system is configured to capture user data of the application system and send the user data to the external system in a first message format; the external system is configured to convert the message in the first message format into a message in a second format and send the message in the second format to the SSL gateway; and the SSL gateway is further configured to encrypt the message in the second format based on the key information of the application system to obtain a first encrypted message and send the first encrypted message to the interfacing system.

[0079] For example, Figure 3 A security communication architecture schematic diagram is provided for the exemplary embodiments of the present application. As shown in Figure 3 The external system is located in the middle layer in the overall architecture and performs format conversion on the incoming and outgoing messages based on the adapter mode; the SSL gateway is configured to encrypt, decrypt and forward the messages and is mainly responsible for processing the application layer data of the external system and the application system; and the support for the SSL / TLS protocol of the transmission layer of the external system and the application system is implemented through the SSL gateway.

[0080] Correspondingly, the SSL gateway is configured to establish a communication session between the application system and the interfacing system based on the public key certificate and the protocol and key suite supported by the application system, to obtain the key information of the interfacing system, and to send the key information of the application system to the interfacing system; the application system is configured to capture user data of the application system and send the user data to the external system in an HTTP+XML format; the external system is configured to convert the message in the HTTP+XML format into a message in an HTTP+JSON format and send the message in the HTTP+JSON format to the SSL gateway; and the SSL gateway is further configured to encrypt the message in the HTTP+JSON format based on the key information of the application system to obtain a first encrypted message and send the first encrypted message to the interfacing system through a dedicated line+HTTPS channel.

[0081] In some embodiments, the secure communication architecture further comprises a HaProxy cluster, wherein: the SSL gateway is further configured to receive the second encrypted message sent by the interfacing system, decrypt the second encrypted message based on the key information of the interfacing system to obtain a decrypted message, convert the decrypted message into the first message format to obtain a decrypted message in the first format, and send the decrypted message in the first format to the HaProxy cluster; the HaProxy cluster is configured to implement load balancing and send the decrypted message in the first format to the external system; and the external system is configured to convert the decrypted message in the first format into a decrypted message in the second format and send the decrypted message in the second format to the application system.

[0082] For example, the SSL gateway is configured to receive the second encrypted message sent by the interfacing system, decrypt the second encrypted message based on the key information of the interfacing system to obtain a decrypted message, convert the decrypted message into an HTTP+JSON format to obtain a decrypted message in the HTTP+JSON format, and send the decrypted message in the HTTP+JSON format to the HaProxy cluster; the HaProxy cluster is configured to implement load balancing and send the decrypted message in the HTTP+JSON format to the external system; and the external system is configured to convert the decrypted message in the HTTP+JSON format into a decrypted message in the HTTP+XML format and send the decrypted message in the HTTP+XML format to the application system.

[0083] In some embodiments, the method for constructing the secure communication architecture further comprises: deploying the HaProxy cluster in an isolated area of an internal network where the application system is located, and performing URL mapping on the internal network address of the application system through the HaProxy cluster.

[0084] The HaProxy is a proxy that can provide high availability, load balancing, and TCP and HTTP application-based proxying, and is suitable for web sites with large concurrency (e.g., more than 1w concurrent users). These sites usually require session persistence or seven-layer processing. The running mode of the HaProxy makes it easy and safe to integrate into the current architecture, and at the same time, it can protect the web server from being exposed to the network.

[0085] For example, the HaProxy cluster is deployed in an isolated area of an internal network where the application system is located, and URL mapping is performed on the internal network address of the application system through the HaProxy cluster, so as to prevent the internal network address of the application system from being exposed, thereby improving the security of the communication architecture.

[0086] In summary, the application has at least the following advantages: in an environment without a hard encryption infrastructure, a command line tool supporting an encryption algorithm library is applied to connect to a system through a secure encryption protocol, and when the soft encryption encounters a communication layer error, a new secure encryption protocol is applied to connect to the system, to determine the secure encryption protocol that supports the connection to the system, to further update the protocol configuration of the communication component to the secure encryption protocol that supports the connection to the system, and if the key information is displayed after loading the communication component, it is determined that the secure communication architecture for the system is supported, so that the command line tool in the test environment can determine the secure encryption protocol that supports the connection to the system, and the feasibility is verified through the communication component, thereby reducing the development and test cycle, and further reducing the project implementation cost of facing new encryption protocols.

[0087] The following is an apparatus embodiment of the application, which can be used to execute the method embodiments of the application. For details not disclosed in the apparatus embodiments of the application, please refer to the method embodiments of the application.

[0088] Figure 4 A structural schematic diagram of a construction apparatus of a secure communication architecture according to an exemplary embodiment of the application is shown in FIG. 4. As shown in FIG. 4, the construction apparatus 40 of the secure communication architecture includes an identification module 41, a first processing module 42, a second processing module 43, and a third processing module 44. Figure 4 The identification module 41 is configured to identify the full-link requirement of the system for secure encryption, and the full-link requirement includes a secure and controllable encryption algorithm library.

[0089] The first processing module 42 is configured to apply a first command based on a command line tool supporting an encryption algorithm library to connect to the system, to obtain a first result of whether the connection to the system is successful, and the first command is based on a first secure encryption protocol.

[0090] The second processing module 43 is configured to, when the first result is a connection failure, apply a second command based on the command line tool to connect to the system, to obtain key information of the system, and the second command is based on a second secure encryption protocol.

[0091] The third processing module 44 is configured to update the protocol configuration of the communication component to the second secure encryption protocol, and to connect to the system by loading the communication component, and if the key information is displayed after loading, it is determined that the secure communication architecture based on the second secure encryption protocol is applied to the system.

[0092]

[0093] ​In a possible implementation, the third processing module 44 can be specifically configured to: if the key information is not displayed after being loaded, add the related code of the secure encryption algorithm in the function code corresponding to the communication component, update the protocol configuration to the second secure encryption protocol, and obtain an updated communication component; and connect with the docking system by loading the updated communication component; and if the key information is displayed after being loaded, determine to apply the secure communication architecture based on the second secure encryption protocol to the docking system.

[0094] In a possible implementation, the third processing module 44 can be further configured to: determine an SSL gateway that meets the full-link requirement; import the public key certificate of the docking system obtained in advance into the SSL gateway; and perform an update operation on the protocol configuration in the SSL gateway, the update operation including updating the protocol configuration to the second secure encryption protocol, so as to apply the secure communication architecture based on the second secure encryption protocol to the docking system in a production environment.

[0095] In a possible implementation, the secure communication architecture includes an application system, an external system, and an SSL gateway, where: the SSL gateway is configured to establish a communication session between the application system and the docking system based on the public key certificate and the protocol and key suite supported by the application system, to obtain the key information of the docking system, and to send the key information of the application system to the docking system; the application system is configured to capture user data of the application system and send the user data to the external system in a first message format; the external system is configured to convert the message in the first message format into a message in a second format, and send the message in the second format to the SSL gateway; and the SSL gateway is further configured to encrypt the message in the second format based on the key information of the application system, to obtain a first encrypted message, and send the first encrypted message to the docking system.

[0096] In a possible implementation, the secure communication architecture further includes an HaProxy cluster, where: the SSL gateway is further configured to receive the second encrypted message sent by the docking system, decrypt the second encrypted message based on the key information of the docking system to obtain a decrypted message, convert the decrypted message into the first message format to obtain a decrypted message in the first format, and send the decrypted message in the first format to the HaProxy cluster; the HaProxy cluster is configured to implement load balancing and send the decrypted message in the first format to the external system; and the external system is configured to convert the decrypted message in the first format into a decrypted message in the second format, and send the decrypted message in the second format to the application system.

[0097] In a possible implementation, the third processing module 44 is further configured to: deploy the HaProxy cluster in an isolated area of an internal network where the application system is located, and perform URL mapping on the internal network address of the application system through the HaProxy cluster.

[0098] In a possible implementation, the first processing module 42 can be specifically configured to download source code of a Linux distribution integrated with the openssl library and the command line tool; and compile the source code to obtain the command line tool.

[0099] The construction apparatus of the secure communication architecture provided by the embodiments of the present application can perform the technical solutions shown in the method embodiments, and the implementation principles and the beneficial effects are similar, which will not be repeated here.

[0100] It should be noted that the division of each module of the above apparatus is only a logical functional division, and all or part of the modules can be integrated into one physical entity, or can be physically separated. The modules can all be implemented in the form of software called by a processing element; or all be implemented in the form of hardware; or part of the modules are implemented in the form of software called by a processing element, and part of the modules are implemented in the form of hardware. For example, the processing module can be a separately established processing element, or can be integrated in a chip of the above apparatus, and in addition, the processing module can be stored in the form of program code in the memory of the above apparatus, and the functions of the above processing module are called and executed by a processing element of the above apparatus. The implementation of other modules is similar. In addition, all or part of the modules can be integrated together, or can be independently implemented. The processing element herein can be an integrated circuit having a signal processing capability. In the implementation process, each step of the above method or each of the above modules can be completed by the integrated logic circuit of hardware or the instruction of software in the processing element.

[0101] For example, the above modules can be one or more integrated circuits configured to implement the above method, such as one or more application specific integrated circuits (ASICs), or one or more digital signal processors (DSPs), or one or more field programmable gate arrays (FPGAs), etc. For another example, when a certain module above is implemented in the form of scheduling program code by a processing element, the processing element can be a general-purpose processor, such as a central processing unit (CPU) or other processor that can call program code. For another example, the modules can be integrated together to be implemented in the form of a system on a chip (SOC).

[0102] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the processes or functions according to the embodiments of the present application are generated. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer readable storage medium, or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (Digital Subscriber Line, DSL)) or wireless (such as infrared, wireless, microwave, etc.) mode. The computer readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be magnetic media (such as floppy disk, hard disk, magnetic tape), optical media (such as digital versatile disc (Digital Video Disc, DVD)) or semiconductor media (such as solid state disk (solid state disk, SSD)) and the like.

[0103] Figure 5 The structural schematic diagram of the electronic device provided in the exemplary embodiments of the present application is shown in the figure. Figure 5 As shown in the figure, the electronic device 50 of the present embodiment includes:

[0104] at least one processor 51; and a memory 52 connected in communication with the at least one processor;

[0105] The memory 52 stores instructions executable by the at least one processor 51, and the instructions are executed by the at least one processor 51 to enable the electronic device to perform the method according to any one of the above embodiments.

[0106] Optionally, the memory 52 can be independent or integrated with the processor 51.

[0107] The memory 52 can include a high-speed random access memory (Random Access Memory, RAM), and can also include a non-volatile memory, such as at least one disk memory.

[0108] The processor 51 can be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to perform the embodiments of the present application. Specifically, when implementing the construction method of the secure communication architecture described in the foregoing method embodiments, the electronic device can be, for example, a server or other electronic device having a processing function.

[0109] Optionally, the electronic device can further include a communication interface 53. In a specific implementation, if the communication interface 53, the memory 52, and the processor 51 are implemented independently, the communication interface 53, the memory 52, and the processor 51 can be connected to each other through a bus and complete communication therebetween. The bus can be an industry standard architecture (ISA) bus, a peripheral component (PCI) bus, an extended industry standard architecture (EISA) bus, or the like. The bus can be divided into an address bus, a data bus, a control bus, and the like, but does not mean that there is only one bus or only one type of bus.

[0110] Optionally, in a specific implementation, if the communication interface 53, the memory 52, and the processor 51 are integrated on a chip, the communication interface 53, the memory 52, and the processor 51 can complete communication through an internal interface.

[0111] The implementation principle and technical effects of the electronic device provided by the embodiments of the present application can be referred to the foregoing embodiments, which will not be described here.

[0112] The embodiments of the present application further provide a computer readable storage medium, which stores computer execution instructions. When the computer execution instructions are executed, the computer execution instructions are used to implement the method steps in the foregoing method embodiments, and the specific implementation manners and technical effects are similar, which will not be described here.

[0113] The computer readable storage medium described above can be realized by any type of volatile or nonvolatile storage devices or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read only memory (EEPROM), erasable programmable read only memory (EPROM), programmable read only memory (PROM), read only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special purpose computer.

[0114] An exemplary computer readable storage medium is coupled to the processor such that the processor can read information from the computer readable storage medium and the computer readable storage medium can write information to the processor. Of course, the computer readable storage medium can be a part of the processor. The processor and the computer readable storage medium can be located in an application specific integrated circuit for an apparatus of secure communication architecture. Of course, the processor and the computer readable storage medium can exist as discrete components in an apparatus of secure communication architecture.

[0115] The embodiments of the present application also provide a computer program product, comprising a computer program which, when executed, implements the method steps of the above method embodiments, and the specific implementation manners and technical effects are similar, which will not be described here.

[0116] Other embodiments of the present application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. The application is intended to cover any variations, uses or adaptations of the application following, in general, the principles of the application and including such departures from the present disclosure as come within known or customary practice in the art to which the application pertains or can relate. The specification and examples are to be regarded as illustrative only, and the true scope and spirit of the application are indicated by the following claims.

[0117] It should be understood that the application is not limited to the precise construction that has been described above and illustrated in the accompanying drawings, and that various modifications and changes can be made by those skilled in the art without departing from the scope of the application. The scope of the application is limited only by the appended claims.

Claims

1. A method of constructing a secure communication architecture, characterized by, The application relates to a secure communication architecture. The application comprises: identifying full-link requirements of a docking system for secure encryption, the full-link requirements comprising a secure and controllable encryption algorithm library; applying a first command to connect with the docking system based on a command line tool supporting the encryption algorithm library, to obtain a first result of whether the connection with the docking system is successful, the first command being based on a first secure encryption protocol; if the first result is a connection failure, applying a second command to connect with the docking system based on the command line tool, to obtain key information of the docking system, the second command being based on a second secure encryption protocol; 2. The method of claim 1, wherein, updating a protocol configuration of a communication component to the second secure encryption protocol, and connecting with the docking system by loading the communication component, if key information is displayed after loading, it is determined that the secure communication architecture based on the second secure encryption protocol is applied to the docking system. The application further comprises: if key information is not displayed after loading, adding related code of a secure encryption algorithm in a function code corresponding to the communication component, updating the protocol configuration to the second secure encryption protocol, to obtain an updated communication component; connecting with the docking system by loading the updated communication component; 3. The method of constructing a secure communication architecture according to claim 1 or 2, wherein, if key information is displayed after loading, it is determined that the secure communication architecture based on the second secure encryption protocol is applied to the docking system. The application further comprises: determining a secure socket layer (SSL) gateway meeting the full-link requirements; importing a public key certificate of the docking system obtained in advance into the SSL gateway; 4. The method of claim 3, wherein, updating a protocol configuration in the SSL gateway, the updating operation comprising updating the protocol configuration to the second secure encryption protocol, to apply the secure communication architecture based on the second secure encryption protocol to the docking system in a production environment. The secure communication architecture comprises an application system, an external system and the SSL gateway, wherein: the SSL gateway is configured to establish a communication session between the application system and the docking system based on the public key certificate, a protocol and a key suite supported by the application system, to obtain key information of the docking system, and send the key information of the application system to the docking system; the application system is configured to capture user data of the application system and send the user data in a first message format to the external system; the external system is configured to convert a message in the first message format into a message in a second format, and send the message in the second format to the SSL gateway; 5. The method of claim 4, wherein, the SSL gateway is further configured to encrypt the message in the second format based on the key information of the application system, to obtain a first encrypted message, and send the first encrypted message to the docking system. The secure communication architecture further comprises a HaProxy cluster, wherein: The SSL gateway is further configured to receive a second encrypted message sent by the interfacing system, decrypt the second encrypted message based on the key information of the interfacing system to obtain a decrypted message, convert the decrypted message into a first message format to obtain a decrypted message in the first format, and send the decrypted message in the first format to the HaProxy cluster. The HaProxy cluster is configured to implement load balancing and send the decrypted message in the first format to the external system. The external system is configured to convert the decrypted message in the first format into a decrypted message in a second format and send the decrypted message in the second format to the application system.

6. The method of claim 5, wherein, Further comprising: The HaProxy cluster is deployed in an isolated area of an internal network where the application system is located, and the internal network address of the application system is mapped by the HaProxy cluster through a uniform resource locator (URL).

7. The method of constructing a secure communication architecture according to claim 1 or 2, wherein, The command line tool is obtained by: Downloading source code of a Linux distribution integrated with an openssl library and a command line tool; Compiling the source code to obtain the command line tool.

8. A construction apparatus of a secure communication architecture, characterized by Comprise: An identification module configured to identify a full-link requirement for secure encryption of an interfacing system, the full-link requirement including a secure and controllable encryption algorithm library; A first processing module configured to connect to the interfacing system based on a command line tool supporting the encryption algorithm library by applying a first command, obtain a first result of whether the connection to the interfacing system is successful, and the first command is based on a first secure encryption protocol; A second processing module configured to, when the first result is a connection failure, connect to the interfacing system based on the command line tool by applying a second command, and obtain key information of the interfacing system, and the second command is based on a second secure encryption protocol; A third processing module configured to update a protocol configuration of a communication component to the second secure encryption protocol, and connect to the interfacing system by loading the communication component, and if key information is displayed after loading, determine to apply a secure communication architecture based on the second secure encryption protocol to the interfacing system.

9. An electronic device, comprising: Comprise: A processor and a memory in communication with the processor; The memory stores computer execution instructions; The processor executes the computer execution instructions stored in the memory to implement the construction method of the secure communication architecture according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to implement the construction method of the secure communication architecture according to any one of claims 1 to 7.

11. A computer program product comprising a computer program, characterized in that, The computer program is executed to implement the construction method of the secure communication architecture according to any one of claims 1 to 7.

Images