Secure communication method, communication system, electronic equipment and storage medium

Abstract

The embodiment of the invention is applicable to the technical field of computers, and provides a secure communication method, a communication system, electronic equipment and a storage medium, the method comprises the following steps: a user terminal calls a first agent program in the user terminal to obtain a first encrypted address corresponding to a server in response to a first connection instruction about the server; the user terminal sends a connection request message generated based on the first encrypted address to the server; the server receives the connection request message through a second agent program, and establishes an encrypted communication link between the user terminal and the server through the second agent program; the first agent program and the second agent program are constructed based on the same dynamic link library. According to the method provided by the embodiment of the invention, the user terminal and the server can establish the encrypted communication link through the first agent program and the second agent program without additionally deploying and managing communication parameters of secure communication, so that the deployment and management difficulty is relatively low, and the cost is relatively low.

Description

Technical Field

[0001] The embodiments of the present application belong to the field of computer technology, and in particular, relate to a secure communication method, a communication system, an electronic device, and a storage medium. Background Art

[0002] With the rapid development of the Internet, network security issues have become increasingly prominent. Transmission Control Protocol / Internet Protocol (TCP / IP) is the most widely used communication protocol at present, so the security of TCP / IP is particularly important. However, the TCP / IP protocol was not designed with security issues in mind. Therefore, if the TCP / IP protocol is used directly for data transmission, it is vulnerable to various network attacks, such as man-in-the-middle attacks, TCP hijacking, and denial of service attacks. In order to solve the transmission security problem of the TCP / IP protocol, researchers have proposed a variety of secure communication solutions based on the TCP / IP protocol, such as deploying a firewall system on the server, establishing a virtual private network (VPN) between the user device and the server for data transmission, or deploying an intrusion detection system (IDS) on the server. However, the above-mentioned secure communication solutions usually require users to manually configure additional communication parameters for secure communication on the user device and / or server, which is difficult to deploy and manage and has high costs. Summary of the invention

[0003] In view of this, an embodiment of the present application provides a secure communication method, a communication system, an electronic device and a storage medium to reduce the difficulty of deployment and management of secure communication solutions.

[0004] A first aspect of an embodiment of the present application provides a secure communication method, which is applied to a communication system, wherein the communication system includes a user terminal and a server, including:

[0005] The user terminal responds to the first connection instruction about the server by calling the first agent program in the user terminal to obtain the first encrypted address corresponding to the server;

[0006] The user terminal sends a connection request message generated based on the first encrypted address to the server;

[0007] The server receives the connection request message through a second agent program, and establishes an encrypted communication link between the user terminal and the server through the second agent program; the first agent program and the second agent program are constructed based on the same dynamic link library.

[0008] In a possible implementation manner of the first aspect, the user terminal, in response to a first connection instruction about a server, calls a first agent program in the user terminal to obtain a first encrypted address corresponding to the server, including:

[0009] Inputting the actual port number corresponding to the server into a preset first encryption algorithm to generate a first encrypted port number corresponding to the actual port number;

[0010] Generate the first encrypted address based on the protocol address corresponding to the server and the first encrypted port number;

[0011] The first encryption algorithm is as follows:

[0012] portproxy=1024+(port / 65535)×(65535-1024)

[0013] The portproxy is used to represent the first encrypted port number; the port is used to represent the actual port number.

[0014] In a possible implementation manner of the first aspect, before the server receives the connection request message through the second agent program and establishes an encrypted communication link between the user terminal and the server through the second agent program, the method further includes:

[0015] The server creates at least one second subprocess under the second main process of the second agent program when starting;

[0016] The server sends the actual port number to the second sub-process through the second main process, so that the actual port number is converted into a second encrypted address through the second sub-process;

[0017] The server receives each message sent to the second encrypted address through the monitoring function run by the second sub-process; the message includes the connection request message.

[0018] In a possible implementation manner of the first aspect, the server receives the connection request message through a second agent program, and establishes an encrypted communication link between the user terminal and the server through the second agent program, including:

[0019] For a connection request message received by any second sub-process, the server generates a response message based on the first encrypted address in the connection request message, and sends the response message to the user terminal through any second sub-process;

[0020] If the user terminal determines that the received response message is a connection success message, sending protocol information and key information to the server;

[0021] The server receives the protocol information and the key information through any second sub-process, and establishes an encrypted communication link between the user terminal and the server based on the protocol information and the key information.

[0022] In a possible implementation manner of the first aspect, after the server generates a response message based on the first encrypted address in the connection request message for the connection request message received by any second sub-process, and sends the response message to the user terminal through any second sub-process, the method includes:

[0023] If the user terminal determines that the received response message is an address abnormality message, the first encrypted address is updated based on a preset first update algorithm, and the number of address abnormalities is updated;

[0024] The user terminal returns to execute the operation of sending the connection request message generated based on the first encrypted address to the server and its subsequent operations until the number of exceptions is greater than or equal to a preset number threshold, or the response message fed back by the server is a connection success message.

[0025] In a possible implementation manner of the first aspect, after the server generates a response message based on the first encrypted address in the connection request message for the connection request message received by any second sub-process, and sends the response message to the user terminal through any second sub-process, the method includes:

[0026] For a connection request message received by any second sub-process, if the server determines that the first encrypted address in the connection request message is consistent with the second encrypted address, the server generates a connection success message and sends the connection success message to the user terminal through any second sub-process;

[0027] For a connection request message received by any second sub-process, if the server determines that the first encrypted address in the connection request message is inconsistent with the second encrypted address, the server generates an address exception message and sends the address exception message to the user terminal through any second sub-process.

[0028] In a possible implementation manner of the first aspect, the server sends the actual port number to the second sub-process through the second main process, so that the actual port number is converted into a second encrypted address through the second sub-process, including:

[0029] The second sub-process inputs the actual port number into a preset second encryption algorithm to generate a second encrypted port number corresponding to the actual port number;

[0030] The second sub-process generates a candidate address based on the second encrypted port number and a protocol address corresponding to the server;

[0031] If the second sub-process determines that the candidate address meets the preset address condition, the second sub-process determines that the candidate address is the second encrypted address;

[0032] If the second sub-process determines that the candidate address does not meet the address condition, the second sub-process continues to update the candidate address based on a preset second update algorithm until the updated candidate address meets the address condition, and determines the candidate address that meets the address condition as the second encrypted address.

[0033] A second aspect of an embodiment of the present application provides a communication system, including:

[0034] The user terminal is used to call a first agent program in the user terminal to obtain a first encrypted address corresponding to the server in response to a first connection instruction about the server; and send a connection request message generated based on the first encrypted address to the server;

[0035] The server is used to receive the connection request message through a second agent program, and establish an encrypted communication link between the user terminal and the server through the second agent program; the first agent program and the second agent program are constructed based on the same dynamic link library.

[0036] A third aspect of an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the secure communication method as described in the first aspect above is implemented.

[0037] A fourth aspect of an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the secure communication method as described in the first aspect above is implemented.

[0038] A fifth aspect of the embodiments of the present application provides a computer program product. When the computer program product is run on a computer, the computer is enabled to execute the secure communication method described in the first aspect.

[0039] Compared with the prior art, the embodiments of the present application have the following advantages:

[0040] In this embodiment, since the user terminal can respond to the first connection instruction about the server and call the first agent program to obtain the first encrypted address corresponding to the server; then, the user terminal can send a connection request message generated based on the first encrypted address to the server; the server can receive the connection request message sent by the user terminal through the second agent program, and establish an encrypted communication link between the user terminal and the server through the second agent program; wherein the first agent program in the user terminal and the second agent program in the server are both constructed based on the same dynamic link library. Through the method provided in this embodiment, the user terminal and the server can directly call the agent program in the dynamic link library to establish an encrypted communication link, without the user configuring the communication parameters of secure communication on the user terminal or the server, thereby reducing the difficulty and cost of secure communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments or prior art descriptions. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0042] Figure 1 is a schematic diagram of a secure communication method provided in an embodiment of the present application;

[0043] Figure 2 is a schematic diagram of a dynamic link library provided in an embodiment of the present application;

[0044] Figure 3 is a schematic diagram of another secure communication method provided in an embodiment of the present application;

[0045] Figure 4 It is a schematic diagram of a process for establishing an encrypted communication link provided in an embodiment of the present application;

[0046] Figure 5 This is a schematic diagram of another process of establishing an encrypted communication link provided in an embodiment of the present application;

[0047] Figure 6 is a schematic diagram of a communication system provided in an embodiment of the present application;

[0048] Figure 7 It is a schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0049] In the following description, specific details such as specific system structures, technologies, etc. are proposed for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application can also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from hindering the description of the present application.

[0050] With the rapid development of the Internet, network security issues are becoming increasingly prominent. As the basic protocol of the Internet, the security of TCP / IP protocol is particularly important. In order to solve the network attacks that the TCP / IP protocol may suffer in actual use, such as man-in-the-middle attacks, TCP hijacking and denial of service attacks, researchers and enterprises have proposed a variety of security solutions. However, the existing solutions mainly monitor and filter TCP traffic through the deployment of secure communication systems on client devices and servers to protect network security. This solution usually requires complex communication parameters on the client and server, such as setting firewall rules and configuring VPN. In addition, the deployment and configuration of firewalls and VPNs usually require professional knowledge, which is difficult for ordinary users to operate and prone to errors, increasing the threshold for use. At the same time, the existing secure communication system requires the installation of specific software and configuration rules on the client and server, which increases the complexity of the system and management costs. Due to the complexity of configuration and management, the existing secure communication system usually needs to be regularly maintained and updated by specialized operation and maintenance personnel, which increases the operation and maintenance costs.

[0051] In view of the above problems, the present invention proposes a secure communication method. The method aims to eliminate complex configuration steps and intrusions on the client and server, simplify user operations, and improve the ease of use and management efficiency of the system. Through this innovative method, efficient security protection can be provided without increasing system complexity and management costs, overcoming the shortcomings of the prior art and significantly improving network security and user experience.

[0052] The technical solution of the present application is described below through specific embodiments.

[0053] Reference Figure 1 , shows a schematic diagram of a secure communication method provided by an embodiment of the present application. The method can be applied to a communication system including at least one user terminal and a server. The above secure communication method can specifically include the following steps:

[0054] S101: In response to a first connection instruction about a server, a user terminal calls a first agent program in the user terminal to obtain a first encrypted address corresponding to the server.

[0055] In this embodiment, the user terminal can preload the dynamic link library preset by the R&D personnel when it is started. Exemplarily, the user terminal can preload the dynamic link library in the LD_PRELOAD mode when it is started. Among them, the dynamic link library can be configured with a first agent program and a second agent program. Specifically, the first agent program can be configured on the user terminal to establish an encrypted communication link between the user terminal and the server. The second agent program can be configured on the server to establish an encrypted communication link between the user terminal and the server. When a user needs to visit a website, the user can initiate a first connection instruction to the user terminal regarding the server where the website is located. Among them, the first connection instruction initiated by the user may include the protocol address and actual port number corresponding to the server.

[0056] In one possible implementation, the first agent program in the user terminal can be a second connect function stored in a dynamic link library. After the user initiates the first connection instruction, the user terminal can call the second connect function from the dynamic link library, and replace the original first connect function in the user terminal with the second connect function through the use function pointer pre-set by the R&D personnel, such as real_connect=dlsym(RTLD_NEXT,"connect"), so as to establish an encrypted communication link with the server through the first agent program. Among them, the first connect function is a function that comes with the original library of the user terminal or the operating system and is used to establish a communication link with the server.

[0057] In a possible implementation, the first connection instruction initiated by the user may include the protocol address (Internet Protocol Address, IP address for short) and the actual port number corresponding to the server. The specific steps for the user terminal to generate the first encrypted address through the first agent program can be described as follows. The user terminal can input the actual port number in the first connection instruction into the first encryption algorithm pre-set by the R&D personnel to generate the first encrypted port number corresponding to the actual port number through the first encryption algorithm. After generating the first encrypted port number, the user terminal can generate the first encrypted address corresponding to the server according to the protocol address of the server and the first encrypted port number. Exemplarily, the first encrypted address can be the protocol address: the first encrypted port number. Among them, the first encryption algorithm in the first agent program can be any linear mapping algorithm.

[0058] Exemplarily, the first encryption algorithm may be specifically as follows.

[0059] portproxy=1024+(port / 65535)×(65535-1024)

[0060] Among them, portproxy can be used to represent the first encrypted port number; port can be used to represent the actual port number.

[0061] By encrypting the actual port number through the first encryption algorithm provided in the embodiment of the present application, the encrypted first encrypted port number can be located between 1024 and 65535, thereby ensuring the validity of the first encrypted port number.

[0062] In a possible implementation, the specific steps of the user terminal generating the first encrypted address through the first agent program can be described as follows. After running the first agent program, the user terminal can create at least one first sub-process under the first main process of the first agent program in response to the first connection instruction about the server. Specifically, the user terminal can create the first sub-process through the fork system. Among them, the number of first sub-processes created by the user terminal can be the same as the number of first connection instructions initiated by the user, and the different first sub-processes created by the user terminal can be used to establish encrypted communication links with different servers. Exemplarily, when the user initiates three first connection instructions for three different servers, the user terminal can create three first sub-processes under the first main process to establish encrypted communication links with three different servers through the three first sub-processes respectively. After the user terminal creates the first sub-process corresponding to the first connection instruction in response to a certain first connection instruction, the first main process on the user terminal can send the protocol address and the actual port number in the first connection instruction to its corresponding first sub-process, so as to generate the first encrypted address corresponding to the first connection instruction through the first sub-process. Among them, each first sub-process can execute the above encryption method to generate the first encrypted address corresponding to each first connection instruction respectively.

[0063] S102: The user terminal sends a connection request message generated based on the first encrypted address to the server.

[0064] In this embodiment, after generating the connection request message including the first encrypted address, the user terminal may send the generated connection request message to the server according to the first encrypted address.

[0065] In a possible implementation, after generating the first encrypted address, any first subprocess in the user terminal can send a connection request message generated based on the first encrypted address to the server through the first subprocess. Specifically, any first subprocess can send a connection request message to the server through the real_connect function to establish an encrypted communication link with the server represented by the first encrypted address.

[0066] S103, the server receives the connection request message through the second agent program, and establishes an encrypted communication link between the user terminal and the server through the second agent program; the first agent program and the second agent program are constructed based on the same dynamic link library.

[0067] In this embodiment, when the server is started, the dynamic link library preset by the R&D personnel can also be preloaded. After the dynamic link library is loaded, the server can call the second agent program in the dynamic link library, and receive the connection request message sent by each user terminal through the second agent program. The server can establish an encrypted communication link between the user terminal and the server through the second agent program according to the received connection request message. Among them, the first agent program in the user terminal and the second agent program in the server are constructed based on the same dynamic link library.

[0068] Through the method provided in this embodiment, the user terminal and the server can establish an encrypted communication link by calling the proxy program in the dynamic link library. Therefore, the method provided in this embodiment allows the user to configure the communication parameters of the secure communication on the user terminal and the server, and does not need to perform additional management on the secure communication system, thereby reducing the difficulty and cost of secure communication.

[0069] See also Figure 2 , shows a schematic diagram of a dynamic link library provided in an embodiment of the present application. Figure 2 As shown, the user terminal and the server may both be preloaded with the same dynamic link library. Among them, the dynamic link library may be configured with a first agent program and a second agent program. Specifically, the first agent program can be called by the user terminal to establish an encrypted communication link between the user terminal and the server. The second agent program can be called by the server to establish an encrypted communication link between the user terminal and the server. When a user needs to visit a website or use an application, the user can initiate a first connection instruction through the user-side program on the user terminal. The user terminal can call the first agent program from the dynamic link library in response to the first connection instruction initiated by the user, and send a connection request instruction to the server through the first agent program. After the server is started, the second agent program can be called from the dynamic link library, and the connection request instructions sent by each user terminal can be continuously received through the second agent program, so as to establish an encrypted communication link between the user terminal and the server through the first agent program and the second agent program.

[0070] Figure 3 FIG. 2 shows a specific implementation flow chart of another secure communication method provided by the second embodiment of the present application. Figure 3 , compared to Figure 1 The embodiment provides a secure communication method including: S301 to S307, which are described in detail as follows:

[0071] S301. When starting up, the server creates at least one second sub-process under a second main process of a second agent program.

[0072] In this embodiment, the server can call the second agent program from the dynamic link library when it is started. Then, after the server runs the second agent program, the server-side program can send the protocol address and actual port number corresponding to the server to the second main process of the second agent program. After the second agent program runs, at least one second sub-process can be created under the second main process. Among them, the server can simultaneously create multiple second sub-processes under the second main process, and each second sub-process in the server can be used to establish an encrypted communication link with different user terminals, so as to realize parallel communication with multiple different user terminals.

[0073] In a possible implementation, when the server is started, the second agent can create multiple second sub-processes under the second main process according to the initial number preset by the developer. In the running state of the server, the server can also continue to create new second sub-processes according to the number of second sub-processes in the second main process that are in an idle state and the number of surpluses preset by the developer. Among them, the second sub-process in the idle state can be used to represent any second sub-process in the second main process that has not received a connection request message and has not established an encrypted communication link with the user terminal. In addition, the server can also continue to determine whether the total number of second sub-processes in the second main process is greater than or equal to the number threshold preset by the developer. When the total number of second sub-processes in the second main process is greater than or equal to the number threshold, the server can stop creating a new second sub-process. When the total number of second sub-processes in the second main process is less than the number threshold, the server can continue to create a new second sub-process according to the number of second sub-processes in the idle state and the number of surpluses.

[0074] For example, if the number of second sub-processes currently in an idle state of the server is 2, and the remaining number preset by the developer is 5, the server may create two new second sub-processes under the second main process of the second agent program.

[0075] In a possible implementation, the second agent in the server can be a second bind function stored in a dynamic link library. When the server is started, the server can call the second bind function from the dynamic link library, and replace the original first bind function in the server with the second bind function through the use function pointer pre-set by the R&D personnel, such as real_bind=dlsym(RTLD_NEXT,"bind"), so as to establish an encrypted communication link with the user terminal through the second bind function. Among them, the first bind function is a function that comes with the original library of the server or the operating system and is used to establish a communication link with the user terminal.

[0076] S302: The server sends the actual port number to the second sub-process through the second main process, so that the actual port number is converted into a second encrypted address through the second sub-process.

[0077] In this embodiment, after the server runs the second agent program, the server-side program can send the protocol address and actual port number corresponding to the server to the second main process of the second agent program. After each second sub-process is created, the second main process can send the actual port number of the server to the second sub-process through the second main process, so as to convert the actual port number of the server into the second encrypted address through the second sub-process.

[0078] In a possible implementation, after receiving the actual port number sent by the second main process, any second sub-process in the server can input the actual port number of the server into the second encryption algorithm pre-set by the R&D personnel to generate a second encrypted port number corresponding to the actual port number through the second encryption algorithm. Then, the second sub-process in the server can generate a candidate address based on the second encrypted port number and the protocol address corresponding to the server. Among them, the specific method for the server to generate the candidate address is similar to the specific method for the user terminal to generate the first encrypted address. The reader can refer to the content of the user terminal generating the first encrypted address in the first embodiment of the present application, and replace the first encryption algorithm with the second encryption algorithm, replace the first encrypted port number with the second encrypted port number, and replace the first encrypted address with the candidate address to understand the specific method for the server to generate the candidate address.

[0079] In one possible implementation, after generating a candidate address, any second sub-process can determine whether the currently generated candidate address meets the address condition pre-set by the R&D personnel. Specifically, the second sub-process can call the real_bind function to bind the currently generated candidate address. If the binding is successful, the second sub-process can determine that the current candidate address meets the address condition. At this time, the second sub-process can determine that the current candidate address is the second encrypted address of the server. If the binding fails, the second sub-process can determine that the current candidate address does not meet the address condition. At this time, the second sub-process can continue to update the candidate address through the second update algorithm pre-set by the R&D personnel until the updated candidate address meets the address condition. The second sub-process can stop updating the candidate address and determine the candidate address that currently meets the address condition as the second encrypted address.

[0080] In a possible implementation, when the candidate address does not meet the address condition, the second subprocess in the server may add one to the second encrypted port number in the candidate address to update the candidate address.

[0081] In a possible implementation, after any second subprocess in the server generates the second encrypted address, the second agent in the server can create a secure communication interface between the second subprocess and the server-side program under the second main process, so as to send and receive messages with the server-side program through the secure communication interface. Exemplarily, the second main process can create a secure communication interface between the server-side program and any second subprocess by calling the real_bind and listen functions. The secure communication interface created by the second main process can be a Unix Domain Socket interface, such as / tmp / safetcp_x.sock, where x can represent the actual port number of the server.

[0082] S303: The first agent program on the user terminal creates at least one first sub-process under the first main process of the first agent program in response to the first connection instruction.

[0083] S304: The first main process in the first agent program sends the protocol address and the actual port number in the first connection instruction to the first sub-process, so as to generate a first encrypted address corresponding to the first connection instruction through the first sub-process.

[0084] S305. The user terminal sends a connection request message generated based on the first encrypted address to the server through the first subprocess.

[0085] In this embodiment, the specific method of the user terminal generating the first encrypted address and sending the connection request message is the same as the method in the first embodiment. Readers can refer to the contents of S101 to S102 in the first embodiment to understand the contents of S303 to S305 in this embodiment, which will not be repeated here.

[0086] S306: The server receives each message sent to the second encrypted address through the monitoring function executed by the second subprocess, wherein the message includes the connection request message.

[0087] In this embodiment, after creating the second sub-process, the server can continue to run the monitoring function through each second sub-process to receive messages sent to each second encrypted address through the monitoring function. The messages received by the second sub-process may include a connection request message for establishing an encrypted communication link, and other messages for sending and receiving data with the user terminal after the encrypted communication link is successfully established.

[0088] S307: For a connection request message received by any second sub-process, the server generates a response message based on the first encrypted address in the connection request message, and sends the response message to the user terminal through any second sub-process.

[0089] In this embodiment, when any second sub-process in the server receives a connection request message sent by a user terminal, the second sub-process can generate a response message according to the first encrypted address in the connection request message, and send the response message to the user terminal through the second sub-process.

[0090] In one possible implementation, for any connection request message received by a second sub-process, if the second sub-process determines that the first encrypted address in the current connection request message is consistent with the second encrypted address generated by the second sub-process, the second sub-process can generate a connection success message and send the connection success message to the user terminal to establish a Transmission Control Protocol (TCP) connection between the second sub-process and the first sub-process that sends the connection request message on the user terminal.

[0091] In a possible implementation, after the second sub-process sends a connection success message to the user terminal, it can perform a series of handshake interactions with the first sub-process that sends the connection request message in the user terminal according to the transport layer protocol preset by the R&D personnel, such as the Transport Layer Security Protocol (TLS for short), to establish an encrypted communication link between the first sub-process and the second sub-process. Among them, the handshake interaction performed by the second sub-process may include sending a connection success message to the user terminal. In the embodiment of the present application, the second sub-process in the server can perform a handshake interaction with the first sub-process in the user terminal by any method known to those skilled in the art, and this embodiment is not used to limit the specific process of the handshake interaction. After the handshake interaction is successful, the second agent program can call the connection function preset by the R&D personnel, such as the connect function, to enable the secure communication interface corresponding to the second sub-process to connect to the server-side program, so as to perform conventional message sending and receiving with the server-side program.

[0092] Among them, after the secure communication interface is enabled, the second sub-process in the second agent program can receive the message initiated by the server program through the secure communication interface, and transmit the received message to the secure transport layer to send the message to the first sub-process in the user terminal. The second sub-process in the second agent program can also receive the message initiated by the user terminal through the first sub-process in the first agent program from the secure transport layer, and send the received message to the server program through the secure communication interface.

[0093] In one possible implementation, for any connection request message received by the second sub-process, if the second sub-process determines that the first encrypted address in the current connection request message is inconsistent with the second encrypted address generated by the second sub-process, the second sub-process can generate an address exception message and send the address exception message to the user terminal.

[0094] S308: The user terminal receives a response message fed back by the server based on the connection request message.

[0095] In this embodiment, after the user terminal sends a connection request message to the server through the first sub-process, the user terminal can continuously receive a response message fed back by the server based on the connection request message through the first sub-process.

[0096] In this embodiment, since multiple second sub-processes can be established on the server and parallel communication with different user terminals can be performed through each second sub-process, the method provided in this embodiment can improve the efficiency of encrypted communication between the server and the user terminal and has high feasibility.

[0097] In one possible implementation, see Figure 4 , shows a schematic diagram of the process of establishing an encrypted communication link provided by an embodiment of the present application. Figure 4 As shown, if any first sub-process in the user terminal determines that the received response message is an address exception message, that is, the TCP connection between the first sub-process and the second sub-process in the server fails to be established, then the first sub-process can update the first encrypted address according to the first update algorithm, and update the number of address exceptions. The first sub-process can return to execute the operation of sending a connection request message generated based on the first encrypted address to the server and its subsequent operations until the number of exceptions is greater than or equal to the preset number threshold, or the response message fed back by the server is a connection success message. Specifically, when the number of first sub-process exceptions is greater than or equal to the preset number threshold, the first sub-process can determine that the TCP connection between the first sub-process and the second sub-process on the server has failed to be established. At this time, the first sub-process can send a connection failure message to the user-side program.

[0098] When executing the first update algorithm, the first sub-process may add one to the first encrypted port number in the first encrypted address to update the first encrypted address.

[0099] In one possible implementation, Figure 4 As shown, if the user terminal determines that the received response message is a connection success message, that is, after the first sub-process successfully establishes a TCP connection with the second sub-process in the server that sends the connection success message, the user terminal sends protocol information and key information to the server through the first sub-process after establishing the TCP connection to perform a handshake interaction operation with the server. Specifically, in the process of performing a handshake interaction operation, the information that needs to be sent by the user terminal can be determined according to the transport layer protocol pre-set by the R&D personnel. The information sent by the user terminal through the second sub-process may include but is not limited to protocol information, key information, session identification and other information. The second sub-process on the server that has established a TCP connection with the first sub-process can use the protocol information and key information sent by the user terminal through the first sub-process, and perform a handshake interaction operation with the user terminal according to the received protocol information and key information to establish an encrypted communication link between the user terminal and the server.

[0100] Specifically, after a first sub-process in a user terminal sends a connection request message to a server, the first sub-process may continue to receive response messages from the server based on the connection request message. If any first sub-process determines that the currently received response message is a connection success message, the first sub-process may send protocol information and key information to the server to perform a handshake interaction operation with the server. If the handshake interaction operation fails, the first sub-process may send a connection failure message to the user-side program. Figure 4As shown, if the handshake interaction operation is successful, the first sub-process can create a secure communication interface for data transmission with the user-side program. The first sub-process in the first agent program can send and receive messages with the user-side program through the secure communication interface. Exemplarily, the secure communication interface created by the first sub-process can be a Unix Domain Socket interface, such as / tmp / safetcp_x.sock, where x can represent the actual port number of the server. After the first sub-process creates the secure communication interface, the first main process on the user terminal can call the connection function pre-set by the R&D personnel to establish a TCP connection between the secure communication interface and the user-side program to achieve the message sending and receiving between the first sub-process and the user-side program. Exemplarily, the first main process can establish a TCP connection between the first sub-process and the user-side program through the real_connect function. If the TCP connection is successfully established, the first agent program on the user terminal can send a connection success message to the user-side program that initiated the first connection instruction through the first main process. If the TCP connection fails to be established, the first agent program on the user terminal can send a connection failure message to the user-side program that initiated the first connection instruction through the first main process.

[0101] Specifically, after creating the secure communication interface, the first sub-process can call a preset function, such as a recv function, to receive a message initiated by the user-end program through the secure communication interface, and transmit the received message to the secure transport layer, so as to send the message to the second sub-process in the server through the secure transport layer. The first sub-process in the first agent program can also receive a message sent by the server through the second sub-process in the second agent program from the secure transport layer, and send the received message to the user-end program through the secure communication interface.

[0102] In a possible implementation, after the encrypted communication link is established, if the user closes the website or exits the client program, that is, when the client program needs to terminate the current connection, the client program can directly close the secure communication interface to disconnect the connection between the client program and the first sub-process. When the first sub-process detects that the secure communication interface is closed, that is, when the first sub-process detects that a data transmission error occurs, the first sub-process can delete the secure communication interface between the client program and the client program, and send a termination message to the second sub-process in the server to disconnect the encrypted communication link with the second sub-process of the server. When the second sub-process in the server receives the termination message sent by the first sub-process on the client side, that is, when an error occurs when the second sub-process in the server receives the message through the recv function, the second sub-process can close the secure communication interface used to connect the second sub-process to the server program and delete the secure communication interface.

[0103] See also Figure 5, shows another schematic diagram of the process of establishing an encrypted communication link provided by an embodiment of the present application. Figure 5 As shown, in a possible implementation, the user terminal can call the first agent program from the dynamic link library when starting up, and create at least one first sub-process in the first main process of the first agent program. After the user terminal creates the second sub-process, any first sub-process in the user terminal can continue to receive messages sent by the server through the monitoring function. When the server needs to actively establish an encrypted communication link with a certain user terminal, for example, the server-side program needs to actively push notification information to the user-side program, the server can send a connection request message to the first sub-process on the user terminal through the second sub-process to establish an encrypted communication link.

[0104] The specific method for the server to actively establish an encrypted communication link with the user terminal is similar to the method for the user terminal to actively establish an encrypted communication link with the server in the above embodiment. Readers can refer to the content of the above embodiment and replace the user terminal in the above embodiment with the server, the user-side program with the server-side program, the first agent program with the second agent program, the first main process with the second main process, and the first subprocess with the second subprocess to understand the process of the server and the user terminal actively establishing an encrypted communication link in this embodiment to push messages to the user terminal.

[0105] It should be noted that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0106] Reference Figure 6 , shows a schematic diagram of a communication system provided in an embodiment of the present application, which may specifically include a user terminal 601 and a server 602, wherein:

[0107] The user terminal 601 is used to respond to a first connection instruction about a server, call a first agent program in the user terminal to obtain a first encrypted address corresponding to the server; and send a connection request message generated based on the first encrypted address to the server;

[0108] The server 601 is used to receive the connection request message through a second agent program, and establish an encrypted communication link between the user terminal and the server through the second agent program; the first agent program and the second agent program are constructed based on the same dynamic link library.

[0109] The user terminal may also be used to input the actual port number corresponding to the server into a preset first encryption algorithm to generate a first encrypted port number corresponding to the actual port number; and generate the first encrypted address based on the protocol address corresponding to the server and the first encrypted port number;

[0110] The first encryption algorithm is as follows:

[0111] portproxy=1024+(port / 65535)×(65535-1024)

[0112] The portproxy is used to represent the first encrypted port number; the port is used to represent the actual port number.

[0113] The server can also be used to create at least one second sub-process under the second main process of the second agent program when it is started; the server sends the actual port number to the second sub-process through the second main process, so as to convert the actual port number into a second encrypted address through the second sub-process; the server receives each message sent to the second encrypted address through the listening function run by the second sub-process; the message includes the connection request message.

[0114] The server may also be configured to generate a response message based on the first encrypted address in the connection request message for a connection request message received by any second sub-process, and send the response message to the user terminal through any second sub-process;

[0115] The user terminal may also be used to determine that the received response message is a connection success message, and then send protocol information and key information to the server;

[0116] The server may also be used to receive the protocol information and the key information through any second sub-process, and to establish an encrypted communication link between the user terminal and the server based on the protocol information and the key information.

[0117] The user terminal can also be used to update the first encrypted address based on a preset first update algorithm and update the number of address exceptions if the user terminal determines that the received response message is an address exception message; the user terminal returns to execute the operation of sending a connection request message generated based on the first encrypted address to the server and its subsequent operations until the number of exceptions is greater than or equal to a preset number threshold, or the response message fed back by the server is a connection success message.

[0118] The server can also be used to, for a connection request message received by any second sub-process, if the server determines that the first encrypted address in the connection request message is consistent with the second encrypted address, the server generates a connection success message and sends the connection success message to the user terminal through the any second sub-process; for a connection request message received by any second sub-process, if the server determines that the first encrypted address in the connection request message is inconsistent with the second encrypted address, the server generates an address exception message and sends the address exception message to the user terminal through the any second sub-process.

[0119] The server can also be used to input the actual port number into a preset second encryption algorithm through the second sub-process to generate a second encrypted port number corresponding to the actual port number; the second sub-process generates a candidate address based on the second encrypted port number and the protocol address corresponding to the server; if the second sub-process determines that the candidate address meets the preset address condition, the second sub-process determines that the candidate address is the second encrypted address; if the second sub-process determines that the candidate address does not meet the address condition, the second sub-process continuously updates the candidate address based on a preset second update algorithm until the updated candidate address meets the address condition, and the candidate address that meets the address condition is determined as the second encrypted address.

[0120] As for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment part.

[0121] Reference Figure 7 , shows a schematic diagram of an electronic device provided by an embodiment of the present application. Figure 7 As shown, the electronic device 700 in the embodiment of the present application includes: a processor 710, a memory 720, and a computer program 721 stored in the memory 720 and executable on the processor 710. When the processor 710 executes the computer program 721, the steps in each embodiment of the above-mentioned secure communication method are implemented. For example, when the electronic device is a user terminal, the electronic device can be used to execute Figure 1 In the steps S101 to S102 shown in FIG. 1 , when the electronic device is a server, the electronic device can be used to execute Figure 1 Alternatively, when the processor 710 executes the computer program 721, the functions of each module / unit in the above-mentioned device embodiments are realized, for example, Figure 6 The function of the module 601 shown or Figure 6 The functionality of module 602 is shown.

[0122] Exemplarily, the computer program 721 may be divided into one or more modules / units, which are stored in the memory 720 and executed by the processor 710 to complete the present application. The one or more modules / units may be a series of computer program instruction segments capable of completing specific functions, which may be used to describe the execution process of the computer program 721 in the electronic device 700.

[0123] The electronic device 700 may be a user terminal or a server in the above-mentioned embodiments. The user terminal may be a computing device such as a desktop computer or a cloud server. The electronic device 700 may include, but is not limited to, a processor 710 and a memory 720. Those skilled in the art will appreciate that Figure 7 It is only an example of the electronic device 700 and does not constitute a limitation of the electronic device 700. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the electronic device 700 may also include input and output devices, network access devices, buses, etc.

[0124] The processor 710 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0125] The memory 720 may be an internal storage unit of the electronic device 700, such as a hard disk or memory of the electronic device 700. The memory 720 may also be an external storage device of the electronic device 700, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the electronic device 700. Further, the memory 720 may also include both an internal storage unit of the electronic device 700 and an external storage device. The memory 720 is used to store the computer program 721 and other programs and data required by the electronic device 700. The memory 720 may also be used to temporarily store data that has been output or is to be output.

[0126] An embodiment of the present application also discloses an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the secure communication method as described in the aforementioned embodiments is implemented.

[0127] An embodiment of the present application further discloses a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the secure communication method as described in the above-mentioned embodiments is implemented.

[0128] An embodiment of the present application further discloses a computer program product. When the computer program product is run on a computer, the computer is enabled to execute the secure communication method described in the aforementioned embodiments.

[0129] The above-described embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application is described in detail with reference to the above-mentioned embodiments, a person skilled in the art should understand that the technical solutions described in the above-mentioned embodiments can still be modified, or some of the technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A secure communication method, characterized in that: Applied to a communication system, the communication system includes a user terminal and a server, and the secure communication method includes: The user terminal responds to the first connection instruction about the server and calls the first agent program in the user terminal to obtain the first encrypted address corresponding to the server; The user terminal sends a connection request message generated based on the first encrypted address to the server; The server receives the connection request message through a second agent program, and establishes an encrypted communication link between the user terminal and the server through the second agent program; the first agent program and the second agent program are constructed based on the same dynamic link library.

2. The method according to claim 1, characterized in that The user terminal, in response to a first connection instruction about a server, calls a first agent program in the user terminal to obtain a first encrypted address corresponding to the server, including: Inputting the actual port number corresponding to the server into a preset first encryption algorithm to generate a first encrypted port number corresponding to the actual port number; Generate the first encrypted address based on the protocol address corresponding to the server and the first encrypted port number; The first encryption algorithm is as follows: portproxy=1024+(port / 65535)×(65535-1024) The portproxy is used to represent the first encrypted port number; the port is used to represent the actual port number.

3. The method according to claim 1 or 2, characterized in that: Before the server receives the connection request message through the second agent program and establishes an encrypted communication link between the user terminal and the server through the second agent program, the method further includes: The server creates at least one second subprocess under the second main process of the second agent program when starting; The server sends the actual port number to the second sub-process through the second main process, so that the actual port number is converted into a second encrypted address through the second sub-process; The server receives each message sent to the second encrypted address through the monitoring function run by the second sub-process; the message includes the connection request message.

4. The method according to claim 3, characterized in that The server receives the connection request message through the second agent program, and establishes an encrypted communication link between the user terminal and the server through the second agent program, including: For a connection request message received by any second sub-process, the server generates a response message based on the first encrypted address in the connection request message, and sends the response message to the user terminal through any second sub-process; If the user terminal determines that the received response message is a connection success message, sending protocol information and key information to the server; The server receives the protocol information and the key information through any second sub-process, and establishes an encrypted communication link between the user terminal and the server based on the protocol information and the key information.

5. The method according to claim 4, characterized in that After the server generates a response message based on the first encrypted address in the connection request message for the connection request message received by any second sub-process, and sends the response message to the user terminal through any second sub-process, the method further comprises: If the user terminal determines that the received response message is an address abnormality message, the first encrypted address is updated based on a preset first update algorithm, and the number of address abnormalities is updated; The user terminal returns to execute the operation of sending the connection request message generated based on the first encrypted address to the server and its subsequent operations until the number of exceptions is greater than or equal to a preset number threshold, or the response message fed back by the server is a connection success message.

6. The method according to claim 4, characterized in that After the server generates a response message based on the first encrypted address in the connection request message for the connection request message received by any second sub-process, and sends the response message to the user terminal through any second sub-process, the method further comprises: For a connection request message received by any second sub-process, if the server determines that the first encrypted address in the connection request message is consistent with the second encrypted address, the server generates a connection success message and sends the connection success message to the user terminal through any second sub-process; For a connection request message received by any second sub-process, if the server determines that the first encrypted address in the connection request message is inconsistent with the second encrypted address, the server generates an address exception message and sends the address exception message to the user terminal through any second sub-process.

7. The method according to claim 3, characterized in that The server sends the actual port number to the second sub-process through the second main process, so that the actual port number is converted into a second encrypted address through the second sub-process, including: The second sub-process inputs the actual port number into a preset second encryption algorithm to generate a second encrypted port number corresponding to the actual port number; The second sub-process generates a candidate address based on the second encrypted port number and a protocol address corresponding to the server; If the second sub-process determines that the candidate address meets the preset address condition, the second sub-process determines that the candidate address is the second encrypted address; If the second sub-process determines that the candidate address does not meet the address condition, the second sub-process continues to update the candidate address based on a preset second update algorithm until the updated candidate address meets the address condition, and determines the candidate address that meets the address condition as the second encrypted address.

8. A communication system, characterized in that: include: The user terminal is used to call a first agent program in the user terminal to obtain a first encrypted address corresponding to the server in response to a first connection instruction about the server; Sending a connection request message generated based on the first encrypted address to the server; The server is used to receive the connection request message through a second agent program, and establish an encrypted communication link between the user terminal and the server through the second agent program; the first agent program and the second agent program are constructed based on the same dynamic link library.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the secure communication method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the secure communication method according to any one of claims 1 to 7 is implemented.

Images