Configuration method of communication network cryptographic algorithm, computer equipment, medium and product

Abstract

The invention relates to the technical field of communication security, and particularly provides a communication network cryptographic algorithm configuration method, computer equipment, a medium and a product, and the method comprises the steps: obtaining a first cryptographic algorithm negotiated between first equipment and second equipment after the establishment of secure connection between the first equipment and the second equipment is detected; when it is determined that the first cryptographic algorithm does not meet the security condition, sending a first message to the first device; wherein the first message comprises at least one of the following: a recommended cryptographic algorithm and a first indication, the recommended cryptographic algorithm is used for indicating a cryptographic algorithm meeting the security condition between the first device and the second device, and the first indication is used for indicating indication information that the first cryptographic algorithm does not meet the security condition.

Description

Technical Field

[0001] The present disclosure relates to the field of communication security technology, and in particular to a configuration method, computer equipment, medium and product of a communication network cryptographic algorithm. Background Art

[0002] With the rapid development of Internet technology, the network security risks of information systems continue to increase, and the threat challenges are becoming increasingly severe. Cryptographic security is an important foundation for information security and can be used to effectively protect the data security of network information systems. Cryptographic technology is the core technology and important means to protect network information systems.

[0003] In the related art, in order to ensure the communication security between network functions, the transport layer security protocol is usually used for encryption protection, so as to configure a secure cryptographic algorithm for the transport layer security protocol; however, the secure cryptographic algorithm has the risk of being cracked. To address this risk, a manual configuration method can be used to configure the secure cryptographic algorithm according to different network functions to avoid the above risk. However, the manual configuration method may lead to problems such as heavy manual load and untimely risk discovery. Summary of the invention

[0004] In view of the above problems, the present disclosure is proposed. The present disclosure provides a configuration method, computer equipment, medium and product of a communication network cryptographic algorithm.

[0005] According to one aspect of the present disclosure, a method for configuring a communication network cryptographic algorithm is provided, which is applied to a network element and includes:

[0006] After detecting that a secure connection is established between the first device and the second device, obtaining a first cryptographic algorithm negotiated between the first device and the second device;

[0007] In the event that it is determined that the first cryptographic algorithm does not meet the security conditions, a first message is sent to the first device; wherein the first message includes at least one of the following: a recommended cryptographic algorithm, a first indication; the recommended cryptographic algorithm is used to indicate a cryptographic algorithm that meets the security conditions between the first device and the second device, and the first indication is used to indicate that the first cryptographic algorithm does not meet the security conditions.

[0008] In addition, according to another embodiment of one aspect of the present disclosure, the obtaining a first cryptographic algorithm negotiated between the first device and the second device includes:

[0009] In a case where a secure connection is established between the first device and the second device, collecting protocol messages transmitted between the first device and the second device;

[0010] Based on the protocol message, the first cryptographic algorithm is determined.

[0011] In addition, in another embodiment according to one aspect of the present disclosure, the method further includes:

[0012] Determining one or more target cryptographic algorithms corresponding to the communication network in which the second device and the first device are located;

[0013] In the case of determining that the first cryptographic algorithm does not belong to the target cryptographic algorithm, determining that the first cryptographic algorithm does not meet the security condition;

[0014] In case it is determined that the first cryptographic algorithm belongs to the target cryptographic algorithm, it is determined that the first cryptographic algorithm meets the security condition.

[0015] In addition, according to another embodiment of one aspect of the present disclosure, the first message also includes: identification information of the second device, identification information of the first device, and identification information of a secure connection established between the second device and the first device.

[0016] In addition, according to another embodiment of one aspect of the present disclosure, after sending the first message to the first device, the method further includes:

[0017] Obtain an update strategy for a second cryptographic algorithm list synchronized by the first device; wherein the second cryptographic algorithm list is a list of cryptographic algorithms supported by the first device, and the update strategy is used to indicate updating the second cryptographic algorithm list according to an intersection algorithm list, wherein the intersection algorithm list is an intersection of the first cryptographic algorithm list, the second cryptographic algorithm list, and the recommended cryptographic algorithm supported by the second device.

[0018] In addition, according to another embodiment of one aspect of the present disclosure, after sending the first message to the first device, the method further includes:

[0019] Obtaining error information sent by the first device; wherein the error information is used to indicate support status of the second device and the first device for the recommended cryptographic algorithm;

[0020] An algorithm update instruction is sent to the first device according to the error information, so that the first device performs corresponding processing according to the algorithm update instruction.

[0021] In addition, according to another embodiment of one aspect of the present disclosure, after sending the first message to the first device, the method further includes:

[0022] A target instruction is issued to the first device, wherein the target instruction is used to instruct the first device to stop the secure connection with the second device and / or stop transmitting sensitive data to the second device.

[0023] According to another aspect of the present disclosure, a method for configuring a communication network cryptographic algorithm is provided, which is applied to a first device and includes:

[0024] In response to a connection request from a second device, determining a first cryptographic algorithm for a secure connection established with the second device;

[0025] Receive a first message sent by a network element; wherein, when the network element determines that the first cryptographic algorithm does not meet the security conditions, the network element sends the first message to the first device; wherein the first message includes at least one of the following: a recommended cryptographic algorithm, a first indication, the recommended cryptographic algorithm is used to indicate a cryptographic algorithm that meets the security conditions between the first device and the second device, and the first indication is used to indicate that the first cryptographic algorithm does not meet the security conditions.

[0026] In addition, according to another embodiment of one aspect of the present disclosure, in response to a connection request from a second device, determining a first cryptographic algorithm for a secure connection established with the second device includes:

[0027] Parsing the connection request to obtain a first cryptographic algorithm list; wherein the first cryptographic algorithm list is a list of cryptographic algorithms supported by the second device;

[0028] The first cryptographic algorithm is determined in the first cryptographic algorithm list, and the first cryptographic algorithm is fed back to the second device.

[0029] In addition, according to another embodiment of one aspect of the present disclosure, after receiving a first message sent by a network element, the method includes:

[0030] Analyze the recommended cryptographic algorithm to obtain algorithm support information of the first device and the second device for the recommended cryptographic algorithm;

[0031] Determine an encryption transmission strategy for a secure connection established with the second device based on the algorithm support information, or send an error message to the network element.

[0032] In addition, according to another embodiment of one aspect of the present disclosure, the analyzing the recommended cryptographic algorithm to obtain algorithm support information of the first device and the second device for the recommended cryptographic algorithm includes:

[0033] Determine an intersection of a first cryptographic algorithm list supported by the second device, a second cryptographic algorithm list supported by the first device, and the recommended cryptographic algorithm, and obtain an intersection algorithm list;

[0034] In the case where the intersection algorithm list is an empty table, obtaining first algorithm support information; wherein the first algorithm support information is used to indicate that neither the second device nor the first device supports the recommended cryptographic algorithm;

[0035] When the intersection algorithm list is not an empty table, second algorithm support information is obtained; wherein the second algorithm support information is used to indicate that both the second device and the first device support the recommended cryptographic algorithm.

[0036] In addition, according to another embodiment of one aspect of the present disclosure, the algorithm support information is the second algorithm support information; and determining the encryption transmission strategy for the secure connection established with the second device based on the algorithm support information includes:

[0037] Determining a cryptographic algorithm with the highest priority in the intersection algorithm list;

[0038] Re-establish a secure connection with the second device according to the highest priority cryptographic algorithm.

[0039] In addition, according to another embodiment of one aspect of the present disclosure, after re-establishing the secure connection with the second device according to the highest priority cryptographic algorithm, the method further includes:

[0040] After updating the second cryptographic algorithm list according to the intersection algorithm list, generating an update strategy for the second cryptographic algorithm;

[0041] Synchronize the update policy of the second cryptographic algorithm list to the network element.

[0042] In addition, according to another embodiment of one aspect of the present disclosure, the algorithm support information is the first algorithm support information; and the method further includes:

[0043] Obtaining an algorithm update instruction fed back by the network element; wherein the algorithm update instruction is an instruction sent by the network element when it is determined that both the second device and the first device do not support the recommended cryptographic algorithm;

[0044] Perform corresponding processing according to the algorithm update instruction.

[0045] In addition, according to another embodiment of one aspect of the present disclosure, after sending the error information to the network element, the method further includes:

[0046] Obtaining a target instruction issued by the network element;

[0047] According to the target instruction, the secure connection with the second device is stopped and / or the transmission of sensitive data to the second device is stopped.

[0048] According to another aspect of the present disclosure, a computer device is provided, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of a method for configuring a communication network cryptographic algorithm.

[0049] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program / instruction is stored, and when the computer program / instruction is executed by a processor, the steps of a method for configuring a communication network cryptographic algorithm are implemented.

[0050] According to another aspect of the present disclosure, a computer program product is provided, including a computer program / instruction, which implements the steps of a method for configuring a communication network cryptographic algorithm when the computer program / instruction is executed by a processor.

[0051] As described in detail below, according to a configuration method, computer device, medium and product of a communication network cryptographic algorithm of an embodiment of the present disclosure. Since the connection between the second device and the first device is relatively frequent, it is impossible to timely discover whether the cryptographic algorithm used for the connection between the second device and the first device has security risks. Moreover, in the case of security risks, manually re-determining the encryption transmission strategy of the first device and the second device is not only time-efficient, but also has the possibility of insecurity caused by configuration errors.

[0052] The disclosed embodiment introduces a network element, through which the network element determines whether the first cryptographic algorithm meets the security condition. In the case where the first cryptographic algorithm does not meet the security condition, the network element can send a first message to the first device. Thus, the first device can re-establish a secure connection with the second device using a cryptographic algorithm that meets the security condition based on the recommended cryptographic algorithm in the first message. In addition, the network element can timely discover whether the cryptographic algorithm used by the second device to connect with the first device has a security risk and generate a first indication to notify the first device.

[0053] It is to be understood that both the foregoing general description and the following detailed description are exemplary, and are intended to provide further explanation of the technology as claimed. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] The above and other purposes, features and advantages of the present disclosure will become more apparent by describing the embodiments of the present disclosure in more detail in conjunction with the accompanying drawings. The accompanying drawings are used to provide a further understanding of the embodiments of the present disclosure and constitute a part of the specification. Together with the embodiments of the present disclosure, they are used to explain the present disclosure and do not constitute a limitation of the present disclosure. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0055] Figure 1 A flowchart of a method for configuring a communication network cryptographic algorithm provided by an embodiment of the present disclosure is shown.

[0056] Figure 2 A flowchart of another method for configuring a communication network cryptographic algorithm provided by an embodiment of the present disclosure is shown.

[0057] Figure 3 An interactive diagram of a method for configuring a communication network cryptographic algorithm provided by an embodiment of the present disclosure is shown.

[0058] Figure 4 A schematic diagram of a configuration device for a communication network cryptographic algorithm provided by an embodiment of the present disclosure is shown.

[0059] Figure 5 A schematic diagram of another device for configuring a communication network cryptographic algorithm provided by an embodiment of the present disclosure is shown.

[0060] Figure 6 A schematic diagram of an electronic device provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical solution and advantages of the present disclosure more obvious, the exemplary embodiments according to the present disclosure will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all the embodiments of the present disclosure, and it should be understood that the present disclosure is not limited to the exemplary embodiments described here.

[0062] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0063] The term "and / or" herein only describes an association relationship, indicating that three relationships may exist. For example, A and / or B may represent the following three situations: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "at least one" herein represents any combination of at least two of any one or more of a plurality of. For example, including at least one of A, B, and C may represent including any one or more elements selected from the set consisting of A, B, and C.

[0064] To facilitate understanding of this embodiment, a configuration method of a communication network cryptographic algorithm disclosed in an embodiment of the present disclosure is first introduced in detail. The execution subject of the configuration method of the communication network cryptographic algorithm provided in the embodiment of the present disclosure is generally an electronic device with certain computing capabilities. In some possible implementations, the configuration method of the communication network cryptographic algorithm can be implemented by a processor calling a computer-readable instruction stored in a memory.

[0065] See also Figure 1 As shown, it is a flowchart of another method for configuring a communication network cryptographic algorithm provided by an embodiment of the present disclosure, the method comprising steps S101 to S102, applied to a network element, wherein:

[0066] S101. After detecting that a secure connection is established between a first device and a second device, obtain a first cryptographic algorithm negotiated between the first device and the second device.

[0067] Among them, the first device is a server device, and the second device is a client device.

[0068] In an embodiment of the present disclosure, the connection request sent by the second device to the first device includes a cryptographic algorithm supported by the second device.

[0069] Here, the first device may perform intersection processing on the cryptographic algorithms supported by the first device and the second device to obtain one or more key cryptographic algorithms supported by both the first device and the second device. Then, the first device may determine any key cryptographic algorithm as the first cryptographic algorithm.

[0070] Here, after determining the first cryptographic algorithm, the first device may establish a secure channel with the second device based on the first cryptographic algorithm, and the second device and the first device may perform business interaction based on the secure channel.

[0071] S102. When it is determined that the first cryptographic algorithm does not meet the security conditions, send a first message to the first device; wherein the first message includes at least one of the following: a recommended cryptographic algorithm and a first indication; the recommended cryptographic algorithm is used to indicate a cryptographic algorithm that meets the security conditions between the first device and the second device, and the first indication is used to indicate that the first cryptographic algorithm does not meet the security conditions.

[0072] In an embodiment of the present disclosure, when the second device and the first device subscribe to the service of the network element, the network element may collect handshake protocol messages of the network security service end through the bus.

[0073] The handshake protocol message includes a cryptographic algorithm (ie, a first cryptographic algorithm) for establishing a secure channel between the second device and the first device.

[0074] Here, the network element may detect whether the first cryptographic algorithm meets the security condition, wherein the security condition is a condition for determining whether the cryptographic algorithm meets the encryption algorithm requirements of the communication network where the second device and the first device are located.

[0075] Here, the network element may determine whether the first cryptographic algorithm meets the security condition by determining whether the first cryptographic algorithm is in a cryptographic algorithm list defined by the operator network.

[0076] First, the network element may determine the operator network (ie, communication network) to which the second device and the first device belong. Then, the network element may determine whether the first cryptographic algorithm is in a cryptographic algorithm list defined by the operator network.

[0077] Here, if the first cryptographic algorithm is in the cryptographic algorithm list, the network element determines that the first cryptographic algorithm meets the security condition. If the first cryptographic algorithm is not in the cryptographic algorithm list, the network element determines that the first cryptographic algorithm does not meet the security condition.

[0078] Here, when the network element determines that the first cryptographic algorithm does not meet the security conditions, it can generate a recommended cryptographic algorithm based on the cryptographic algorithm list and push the recommended cryptographic algorithm to the first device.

[0079] In the embodiments of the present disclosure, the cryptographic algorithm between the first device and the second device may be a cryptographic algorithm supported by the first device or the second device. Here, a cryptographic algorithm that meets the security condition may be determined from the cryptographic algorithms between the first device and the second device, and the cryptographic algorithm may be determined as a recommended cryptographic algorithm.

[0080] Afterwards, the first device may analyze the recommended cryptographic algorithm in combination with the cryptographic algorithms supported by the first device and the second device.

[0081] Here, the first device may determine whether the above-mentioned key cryptographic algorithm exists in the recommended cryptographic algorithms, and determine the algorithm support information of the recommended cryptographic algorithm based on the determination result.

[0082] In an embodiment of the present disclosure, after obtaining the algorithm support information, the first device may perform corresponding processing based on different encryption transmission strategies.

[0083] Here, the encryption transmission strategy includes at least one of the following: whether the first device and the second device can establish a secure connection, the cryptographic algorithm used by the first device and the second device to establish a secure connection, and an update strategy for the first device and the second device.

[0084] In an embodiment of the present disclosure, first, after detecting that a secure connection is established between a first device and a second device, a first cryptographic algorithm negotiated between the first device and the second device is obtained; then, when it is determined that the first cryptographic algorithm does not meet the security conditions, a first message is sent to the first device; wherein the first message includes but is not limited to: one or more recommended cryptographic algorithms and a first indication, the recommended cryptographic algorithm is used to indicate a cryptographic algorithm that meets the security conditions between the first device and the second device, and the first indication is an indication information indicating that the first cryptographic algorithm does not meet the security conditions.

[0085] From the above description, it can be seen that since the connection between the second device and the first device is relatively frequent, it is impossible to timely discover whether the cryptographic algorithm used for the connection between the second device and the first device has security risks. In addition, when there is a security risk, manually re-determining the encryption transmission strategy between the first device and the second device is not only time-inefficient, but also has the possibility of insecurity caused by configuration errors.

[0086] The disclosed embodiment introduces a network element, through which the network element determines whether the first cryptographic algorithm meets the security condition. In the case where the first cryptographic algorithm does not meet the security condition, the network element can send a first message to the first device. Thus, the first device can re-establish a secure connection with the second device using a cryptographic algorithm that meets the security condition based on the recommended cryptographic algorithm in the first message. In addition, the network element can timely discover whether the cryptographic algorithm used by the second device to connect with the first device has a security risk and generate a first indication to notify the first device.

[0087] In an optional implementation, the above step of obtaining the first cryptographic algorithm negotiated between the first device and the second device specifically includes the following steps:

[0088] First, in the case where a secure connection is established between the first device and the second device, a protocol message transmitted between the first device and the second device is collected;

[0089] Then, based on the protocol message, a first cryptographic algorithm is determined.

[0090] In an embodiment of the present disclosure, after the second device sends the first cryptographic algorithm list to the first device, the first device may perform intersection processing on the first cryptographic algorithm list and the cryptographic algorithms supported by the first device to determine one or more key cryptographic algorithms.

[0091] Here, when there is one key cryptographic algorithm, the first device may determine the key cryptographic algorithm as the first cryptographic algorithm. When there are multiple key cryptographic algorithms, the first device may determine the key cryptographic algorithm with the highest priority as the first cryptographic algorithm.

[0092] Here, in the case where the second device and the first device have subscribed to the service of the network element, the network element may collect the handshake protocol message of the network security service end through the bus.

[0093] The handshake protocol message includes a cryptographic algorithm (ie, a first cryptographic algorithm) for establishing a secure channel between the second device and the first device.

[0094] In an optional embodiment, the method further comprises the following steps:

[0095] First, determining one or more target cryptographic algorithms corresponding to the communication network in which the second device and the first device are located;

[0096] Secondly, in the case where it is determined that the first cryptographic algorithm does not belong to the target cryptographic algorithm, it is determined that the first cryptographic algorithm does not meet the security condition;

[0097] Finally, when it is determined that the first cryptographic algorithm belongs to the target cryptographic algorithm, it is determined that the first cryptographic algorithm meets the security condition.

[0098] In an embodiment of the present disclosure, the network element may determine a cryptographic algorithm list defined by a communication network in which the second device and the first device are located, and use a cryptographic algorithm in the cryptographic algorithm list defined by the communication network as a target cryptographic algorithm.

[0099] Here, the cryptographic algorithm list defined by the communication network is a cryptographic algorithm list composed of cryptographic algorithms that the communication network considers to be safe.

[0100] Here, the first cryptographic algorithm does not belong to the target cryptographic algorithm, that is, the first cryptographic algorithm does not exist in the cryptographic algorithm list defined by the communication network. The first cryptographic algorithm belongs to the target cryptographic algorithm, that is, the first cryptographic algorithm exists in the cryptographic algorithm list defined by the communication network.

[0101] In an optional implementation, the first message further includes: identification information of the second device, identification information of the first device, and identification information of the secure connection established between the second device and the first device.

[0102] In an embodiment of the present disclosure, when the first cryptographic algorithm does not belong to the target cryptographic algorithm, the network element may generate a first message, and may push the first message to the first device.

[0103] Here, after the first device receives the first message, upon determining the first indication in the first message, the first indication may be sent to the second device.

[0104] Here, the recommended cryptographic algorithm may be determined based on a cryptographic algorithm list defined by the communication network.

[0105] In an optional implementation, after sending the first message to the first device, the following steps are further included:

[0106] Obtain an update strategy for a second cryptographic algorithm list synchronized by the first device; wherein the second cryptographic algorithm list is a list of cryptographic algorithms supported by the first device, and the update strategy is used to indicate updating the second cryptographic algorithm list according to an intersection algorithm list, wherein the intersection algorithm list is an intersection of a list of first cryptographic algorithms, a second cryptographic algorithm list, and a recommended cryptographic algorithm supported by the second device.

[0107] In an embodiment of the present disclosure, the first device may perform intersection processing on the above-mentioned key cryptographic algorithm and the recommended cryptographic algorithm to obtain an intersection algorithm list.

[0108] Here, the intersection algorithm list is an empty list, that is, the intersection between the key cryptographic algorithm and the recommended cryptographic algorithm is an empty set. The cryptographic algorithms in the recommended cryptographic algorithm do not include the key cryptographic algorithm.

[0109] Here, the intersection algorithm list is not an empty list, that is, the intersection between the key cryptographic algorithm and the recommended cryptographic algorithm is not an empty set. The cryptographic algorithms in the recommended cryptographic algorithm include at least one key cryptographic algorithm.

[0110] Here, in the case where the cryptographic algorithms in the recommended cryptographic algorithms include a key cryptographic algorithm, the first device may add the key cryptographic algorithm to the second algorithm support information, and the first device may establish a secure connection with the second device through the key cryptographic algorithm.

[0111] Here, after the first device establishes a connection with the second device through the key cryptographic algorithm, the network element can be notified.

[0112] Here, when the cryptographic algorithms in the recommended cryptographic algorithms include multiple key cryptographic algorithms, the key cryptographic algorithm that meets the preset priority condition can be used as the designated cryptographic algorithm. In addition, the first device can establish a secure connection with the second device through the designated cryptographic algorithm.

[0113] Here, in the case where the algorithm support information is the second algorithm support information, the first device may update the second cryptographic algorithm list, or prompt the administrator of the first device to update the second cryptographic algorithm.

[0114] Here, the first device can update the second cryptographic algorithm list with a cryptographic algorithm that is not in the intersection algorithm list in the recommended cryptographic algorithm. For example, the cryptographic algorithm list includes: algorithm 1, algorithm 2, and algorithm 3; the intersection algorithm list includes algorithm 1. Then the second cryptographic algorithm list is updated by algorithm 2 and algorithm 3, that is, the first device supports algorithm 2 and algorithm 3.

[0115] Here, the first device may update the second cryptographic algorithm list using a cryptographic algorithm in the recommended cryptographic algorithm that is not in the intersection algorithm list.

[0116] Here, after the first cryptographic algorithm list and the second cryptographic algorithm list are updated, the second device may send the updated first cryptographic algorithm list to the first device. Then, the first device may send the updated first cryptographic algorithm list and the updated second cryptographic algorithm list to the network element.

[0117] In an optional implementation, after sending the first message to the first device, the following steps are further included:

[0118] First, error information sent by the first device is obtained; wherein the error information is used to indicate the support status of the second device and the first device for the recommended cryptographic algorithm;

[0119] Then, an algorithm update instruction is sent to the first device according to the error information, so that the first device performs corresponding processing according to the algorithm update instruction.

[0120] In an embodiment of the present disclosure, the error information includes a first cryptographic algorithm list and a second cryptographic algorithm list.

[0121] Here, after receiving the error information, the network element may generate an update instruction based on the error information and the recommended cryptographic algorithm.

[0122] Here, first, the network element may determine one or more third cryptographic algorithms that are not in the first cryptographic algorithm list in the recommended cryptographic algorithms. Secondly, the network element may determine one or more fourth cryptographic algorithms that are not in the second cryptographic algorithm list in the recommended cryptographic algorithms.

[0123] Secondly, the network element may generate an algorithm update instruction based on the third cryptographic algorithm and the fourth cryptographic algorithm, and send the algorithm update instruction to the first device.

[0124] Secondly, after receiving the algorithm update instruction, the first device can update the second cryptographic algorithm list by using the fourth cryptographic algorithm in the algorithm update instruction, and can also prompt the administrator corresponding to the first device to update the second cryptographic algorithm list by using the fourth cryptographic algorithm in the algorithm update instruction. After that, the algorithm update instruction is sent to the second device.

[0125] Secondly, after receiving the algorithm update instruction, the second device can update the first cryptographic algorithm list by the third cryptographic algorithm in the algorithm update instruction, and can also prompt the administrator corresponding to the second device to update the first cryptographic algorithm list by the third cryptographic algorithm in the algorithm update instruction. And after the first cryptographic algorithm list is updated, the updated first cryptographic algorithm list is sent to the first device.

[0126] Finally, after receiving the updated first cryptographic algorithm list, the first device may send the updated first cryptographic algorithm list and the updated second cryptographic algorithm list to the network element.

[0127] In an optional implementation, after sending the first message to the first device, the following steps are further included:

[0128] A target instruction is issued to the first device; wherein the target instruction is used to instruct the first device to stop the secure connection with the second device, or to stop transmitting sensitive data to the second device.

[0129] Here, after receiving the error information, the network element may generate a target instruction based on the error information, wherein the target instruction is to stop the secure connection with the second device, or to stop transmitting sensitive data to the second device.

[0130] Here, when the network element determines that the second device and the first device are not allowed to establish a communication connection using an unsafe cryptographic algorithm, the target instruction is to stop the secure connection with the second device.

[0131] Here, in the case where the network element determines that the second device and the first device are allowed to establish a communication connection using an unsafe cryptographic algorithm, the target instruction is to stop transmitting sensitive data to the second device.

[0132] See also Figure 2 As shown, it is a flowchart of another method for configuring a communication network cryptographic algorithm provided by an embodiment of the present disclosure, the method comprising steps S201 to S202, applied to a first device, wherein:

[0133] S201. In response to a connection request from a second device, determine a first cryptographic algorithm for a secure connection established with the second device.

[0134] Among them, the first device is a server device, and the second device is a client device.

[0135] In an embodiment of the present disclosure, the connection request sent by the second device to the first device includes a cryptographic algorithm supported by the second device.

[0136] Here, the first device may perform intersection processing on the cryptographic algorithms supported by the first device and the second device to obtain one or more key cryptographic algorithms supported by both the first device and the second device. Then, the first device may determine any key cryptographic algorithm as the first cryptographic algorithm.

[0137] Here, after determining the first cryptographic algorithm, the first device may establish a secure channel with the second device based on the first cryptographic algorithm, and the second device and the first device may perform business interaction based on the secure channel.

[0138] S202. Receive a first message sent by a network element; wherein, when the network element determines that the first cryptographic algorithm does not meet the security conditions, the network element sends the first message to the first device; the first message includes at least one of the following: a recommended cryptographic algorithm and a first indication, the recommended cryptographic algorithm is used to indicate a cryptographic algorithm that meets the security conditions between the first device and the second device, and the first indication is used to indicate that the first cryptographic algorithm does not meet the security conditions.

[0139] In an embodiment of the present disclosure, when the second device and the first device subscribe to the service of the network element, the network element may collect handshake protocol messages of the network security service end through the bus.

[0140] The handshake protocol message includes a cryptographic algorithm (ie, a first cryptographic algorithm) for establishing a secure channel between the second device and the first device.

[0141] Here, the network element may detect whether the first cryptographic algorithm meets the security condition, wherein the security condition is a condition for determining whether the cryptographic algorithm meets the encryption algorithm requirements of the communication network where the second device and the first device are located.

[0142] Here, the network element may determine whether the first cryptographic algorithm meets the security condition by determining whether the first cryptographic algorithm is in a cryptographic algorithm list defined by the operator network.

[0143] First, the network element may determine the operator network (ie, communication network) to which the second device and the first device belong. Then, the network element may determine whether the first cryptographic algorithm is in a cryptographic algorithm list defined by the operator network.

[0144] Here, if the first cryptographic algorithm is in the cryptographic algorithm list, the network element determines that the first cryptographic algorithm meets the security condition. If the first cryptographic algorithm is not in the cryptographic algorithm list, the network element determines that the first cryptographic algorithm does not meet the security condition.

[0145] Here, when the network element determines that the first cryptographic algorithm does not meet the security conditions, it can generate a recommended cryptographic algorithm based on the cryptographic algorithm list and push the recommended cryptographic algorithm to the first device.

[0146] In the embodiments of the present disclosure, the cryptographic algorithm between the first device and the second device may be a cryptographic algorithm supported by the first device or the second device. Here, a cryptographic algorithm that meets the security condition may be determined from the cryptographic algorithms between the first device and the second device, and the cryptographic algorithm may be determined as a recommended cryptographic algorithm.

[0147] Afterwards, the first device may analyze the recommended cryptographic algorithm in combination with the cryptographic algorithms supported by the first device and the second device.

[0148] Here, the first device may determine whether the above-mentioned key cryptographic algorithm exists in the recommended cryptographic algorithms, and determine the algorithm support information of the recommended cryptographic algorithm based on the determination result.

[0149] From the above description, it can be seen that since the connection between the second device and the first device is relatively frequent, it is impossible to timely discover whether the cryptographic algorithm used for the connection between the second device and the first device has security risks. In addition, when there is a security risk, manually re-determining the encryption transmission strategy between the first device and the second device is not only time-inefficient, but also has the possibility of insecurity caused by configuration errors.

[0150] The disclosed embodiment introduces a network element, through which the network element determines whether the first cryptographic algorithm meets the security condition. In the case where the first cryptographic algorithm does not meet the security condition, the network element can send a first message to the first device. Thus, the first device can re-establish a secure connection with the second device using a cryptographic algorithm that meets the security condition based on the recommended cryptographic algorithm in the first message. In addition, the network element can timely discover whether the cryptographic algorithm used by the second device to connect with the first device has a security risk and generate a first indication to notify the first device.

[0151] In an optional implementation, the above step of determining the first cryptographic algorithm for establishing a secure connection with the second device in response to a connection request from the second device specifically includes the following steps:

[0152] First, the connection request is parsed to obtain a first cryptographic algorithm list; wherein the first cryptographic algorithm list is a list of cryptographic algorithms supported by the second device;

[0153] Then, the first cryptographic algorithm is determined in the first cryptographic algorithm list, and the first cryptographic algorithm is fed back to the second device.

[0154] In an embodiment of the present disclosure, after the second device sends the first cryptographic algorithm list to the first device, the first device may perform intersection processing on the first cryptographic algorithm list and the cryptographic algorithms supported by the first device to determine one or more key cryptographic algorithms.

[0155] Here, when there is one key cryptographic algorithm, the first device may determine the key cryptographic algorithm as the first cryptographic algorithm. When there are multiple key cryptographic algorithms, the first device may determine the key cryptographic algorithm with the highest priority as the first cryptographic algorithm.

[0156] In an optional implementation manner, after receiving the first message sent by the network element, the following steps are also included:

[0157] First, the recommended cryptographic algorithm is analyzed to obtain algorithm support information of the first device and the second device for the recommended cryptographic algorithm;

[0158] Then, an encryption transmission strategy for the secure connection established with the second device is determined based on the algorithm support information, or an error message is sent to the network element.

[0159] In the embodiment of the present disclosure, after obtaining the algorithm support information, the first device can perform corresponding processing based on different encryption transmission strategies. Here, the encryption transmission strategy includes: determining the encryption transmission strategy for the secure connection established with the second device, and sending error information to the network element.

[0160] Here, the encryption transmission strategy includes at least one of the following: whether the first device and the second device can establish a secure connection, the cryptographic algorithm used by the first device and the second device to establish a secure connection, and an update strategy for the first device and the second device.

[0161] In an optional implementation, the above steps analyze the recommended cryptographic algorithm to obtain algorithm support information of the first device and the second device for the recommended cryptographic algorithm, specifically including the following steps:

[0162] First, determine the intersection of a first cryptographic algorithm list supported by the second device, a second cryptographic algorithm list supported by the first device, and a list of recommended cryptographic algorithms to obtain an intersection algorithm list;

[0163] Secondly, when the intersection algorithm list is an empty list, first algorithm support information is obtained; wherein the first algorithm support information is used to indicate that both the second device and the first device do not support the recommended cryptographic algorithm;

[0164] Finally, when the intersection algorithm list is not an empty list, the second algorithm support information is obtained; wherein the second algorithm support information is used to indicate that both the second device and the first device support the recommended cryptographic algorithm.

[0165] In an optional implementation, when the algorithm support information is the second algorithm support information; the above step of determining the encryption transmission strategy for the secure connection established with the second device based on the algorithm support information specifically includes the following steps:

[0166] First, determine the highest priority cryptographic algorithm in the intersection algorithm list;

[0167] Then, a secure connection with the second device is reestablished according to the highest priority cryptographic algorithm.

[0168] In an embodiment of the present disclosure, the first device may determine the priority of each cryptographic algorithm in the encryption recommended cryptographic algorithms.

[0169] Here, after determining the priority of each cryptographic algorithm in the intersection algorithm list, the cryptographic algorithm with the highest priority can be obtained, and the cryptographic algorithm with the highest priority is used as the designated cryptographic algorithm.

[0170] Here, the first device may use a specified cryptographic algorithm to re-establish a secure connection with the second device.

[0171] In an optional implementation, after re-establishing the secure connection with the second device according to the highest priority cryptographic algorithm, the following steps are further included:

[0172] First, after updating the second cryptographic algorithm according to the intersection algorithm list, an update strategy for the second cryptographic algorithm is generated;

[0173] Then, the update strategy of the second cryptographic algorithm list is synchronized to the network element.

[0174] In the disclosed embodiment, the first device may update the second cryptographic algorithm list with a cryptographic algorithm that is not in the intersection algorithm list in the recommended cryptographic algorithm. For example, the cryptographic algorithm list includes: Algorithm 1, Algorithm 2, and Algorithm 3; the intersection algorithm list includes Algorithm 1. Then the second cryptographic algorithm list is updated with Algorithm 2 and Algorithm 3, that is, Algorithm 2 and Algorithm 3 are supported by the first device.

[0175] Here, the first device may update the second cryptographic algorithm list using a cryptographic algorithm in the recommended cryptographic algorithm that is not in the intersection algorithm list.

[0176] Here, after the first cryptographic algorithm list and the second cryptographic algorithm list are updated, the second device may send the updated first cryptographic algorithm list to the first device. Then, the first device may send the updated first cryptographic algorithm list and the updated second cryptographic algorithm list to the network element.

[0177] In an optional implementation manner, when the algorithm support information is the first algorithm support information, the method further includes the following steps:

[0178] First, an algorithm update instruction fed back by the network element is obtained; wherein the algorithm update instruction is an instruction sent by the network element when it is determined that both the second device and the first device do not support the recommended cryptographic algorithm;

[0179] Then, perform corresponding processing according to the algorithm update instructions.

[0180] In an embodiment of the present disclosure, the error information includes a first cryptographic algorithm list and a second cryptographic algorithm list.

[0181] Here, after receiving the error information, the network element may generate an update instruction based on the error information and the recommended cryptographic algorithm.

[0182] Here, first, the network element may determine one or more third cryptographic algorithms that are not in the first cryptographic algorithm list in the recommended cryptographic algorithms. Secondly, the network element may determine one or more fourth cryptographic algorithms that are not in the second cryptographic algorithm list in the recommended cryptographic algorithms.

[0183] Secondly, the network element may generate an algorithm update instruction based on the third cryptographic algorithm and the fourth cryptographic algorithm, and may update the first cryptographic algorithm list and the second cryptographic algorithm list through the algorithm update instruction. The algorithm update instruction may also be sent to the first device.

[0184] Secondly, after receiving the algorithm update instruction, the first device can update the second cryptographic algorithm list by using the fourth cryptographic algorithm in the algorithm update instruction, and can also prompt the administrator corresponding to the first device to update the second cryptographic algorithm list by using the fourth cryptographic algorithm in the algorithm update instruction. After that, the algorithm update instruction is sent to the second device.

[0185] Secondly, after receiving the algorithm update instruction, the second device can update the first cryptographic algorithm list by the third cryptographic algorithm in the algorithm update instruction, and can also prompt the administrator corresponding to the second device to update the first cryptographic algorithm list by the third cryptographic algorithm in the algorithm update instruction. And after the first cryptographic algorithm list is updated, the updated first cryptographic algorithm list is sent to the first device.

[0186] Finally, after receiving the updated first cryptographic algorithm list, the first device may send the updated first cryptographic algorithm list and the updated second cryptographic algorithm list to the network element.

[0187] In an optional implementation manner, after sending the error information to the network element, the following steps are further included:

[0188] First, obtain the target instruction issued by the network element;

[0189] Then, according to the target instruction, the secure connection with the second device is stopped and / or the transmission of sensitive data to the second device is stopped.

[0190] In an embodiment of the present disclosure, after receiving the error information, the network element may generate a target instruction based on the error information, wherein the target instruction is to stop the secure connection with the second device, or to stop transmitting sensitive data to the second device.

[0191] Here, when the network element determines that the second device and the first device are not allowed to establish a communication connection using an unsafe cryptographic algorithm, the target instruction is to stop the secure connection with the second device.

[0192] Here, in the case where the network element determines that the second device and the first device are allowed to establish a communication connection using an unsafe cryptographic algorithm, the target instruction is to stop transmitting sensitive data to the second device.

[0193] See also Figure 3 As shown, it is an interactive diagram of a configuration method of a communication network cryptographic algorithm provided by an embodiment of the present disclosure, wherein:

[0194] S10. The second device and the first device subscribe to services of the network element.

[0195] S20. The second device sends a first cryptographic algorithm list to the first device.

[0196] S30. The first device determines a first cryptographic algorithm for establishing a secure connection with the second device based on the first cryptographic algorithm list and the second cryptographic algorithm list.

[0197] S40. The first device establishes a secure connection with the second device based on a first cryptographic algorithm.

[0198] S50. The network element collects protocol messages to determine a first cryptographic algorithm, and determines whether the first cryptographic algorithm meets security conditions.

[0199] S60. When the network element determines that the first cryptographic algorithm does not meet security conditions, the network element generates a first message and pushes the first message to the first device.

[0200] S70. The first device performs intersection processing based on the first cryptographic algorithm list, the second cryptographic algorithm list supported by the first device, and the recommended cryptographic algorithm in the first message to obtain an intersection algorithm list.

[0201] S80. When the first device determines that the intersection algorithm list is not an empty set, it determines a cryptographic algorithm with the highest priority in the intersection algorithm list, and re-establishes a secure connection with the second device according to the cryptographic algorithm with the highest priority.

[0202] S90: When the first device determines that the intersection algorithm list is an empty set, it sends an error message to the network element.

[0203] S100: When the network element determines that the intersection algorithm list is an empty set and the network element has a response strategy set, the network element generates a target instruction.

[0204] S110. The network element sends a target instruction to the first device.

[0205] S120: The first device performs a corresponding operation based on the target instruction.

[0206] From the above description, it can be seen that since the connection between the second device and the first device is relatively frequent, it is impossible to timely discover whether the cryptographic algorithm used for the connection between the second device and the first device has security risks. In addition, when there is a security risk, manually re-determining the encryption transmission strategy between the first device and the second device is not only time-inefficient, but also has the possibility of insecurity caused by configuration errors.

[0207] The disclosed embodiment introduces a network element, through which the network element determines whether the first cryptographic algorithm meets the security condition. In the case where the first cryptographic algorithm does not meet the security condition, the network element can send a first message to the first device. Thus, the first device can re-establish a secure connection with the second device using a cryptographic algorithm that meets the security condition based on the recommended cryptographic algorithm in the first message. In addition, the network element can timely discover whether the cryptographic algorithm used by the second device to connect with the first device has a security risk and generate a first indication to notify the first device.

[0208] Those skilled in the art will appreciate that, in the above method of specific implementation, the order in which the steps are written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of the steps should be determined by their functions and possible internal logic.

[0209] Based on the same inventive concept, the embodiments of the present disclosure also provide a configuration device for a communication network cryptographic algorithm corresponding to the configuration method of the communication network cryptographic algorithm. Since the principle of solving the problem by the device in the embodiments of the present disclosure is similar to the configuration method of the communication network cryptographic algorithm in the embodiments of the present disclosure, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0210] See also Figure 4 As shown, it is a schematic diagram of a configuration device of a communication network cryptographic algorithm provided by an embodiment of the present disclosure, the device comprises: a detection module 11, a first determination module 12; wherein,

[0211] A detection module, configured to obtain a first cryptographic algorithm negotiated between the first device and the second device after detecting that a secure connection is established between the first device and the second device;

[0212] A first determination module is used to send a first message to the first device when it is determined that the first cryptographic algorithm does not meet the security conditions; wherein the first message includes at least one of the following: a recommended cryptographic algorithm and a first indication, the recommended cryptographic algorithm is used to indicate a cryptographic algorithm that meets the security conditions between the first device and the second device, and the first indication is used to indicate that the first cryptographic algorithm does not meet the security conditions.

[0213] See also Figure 5As shown, it is a schematic diagram of another communication network cryptographic algorithm configuration device provided by an embodiment of the present disclosure, the device includes: a second determination module 21, a receiving module 22; wherein,

[0214] A second determination module, configured to determine, in response to a connection request from a second device, a first cryptographic algorithm for establishing a secure connection with the second device;

[0215] A receiving module, used for receiving a first message sent by a network element; wherein, when the network element determines that the first cryptographic algorithm does not meet the security conditions, the network element sends the first message to the first device; the first message includes at least one of the following: a recommended cryptographic algorithm, a first indication, the recommended cryptographic algorithm is used to indicate a cryptographic algorithm that meets the security conditions between the first device and the second device, and the first indication is used to indicate that the first cryptographic algorithm does not meet the security conditions.

[0216] From the above description, it can be seen that since the connection between the second device and the first device is relatively frequent, it is impossible to timely discover whether the cryptographic algorithm used for the connection between the second device and the first device has security risks. In addition, when there is a security risk, manually re-determining the encryption transmission strategy between the first device and the second device is not only time-inefficient, but also has the possibility of insecurity caused by configuration errors.

[0217] The disclosed embodiment introduces a network element, through which the network element determines whether the first cryptographic algorithm meets the security condition. In the case where the first cryptographic algorithm does not meet the security condition, the network element can send a first message to the first device. Thus, the first device can re-establish a secure connection with the second device using a cryptographic algorithm that meets the security condition based on the recommended cryptographic algorithm in the first message. In addition, the network element can timely discover whether the cryptographic algorithm used by the second device to connect with the first device has a security risk and generate a first indication to notify the first device.

[0218] For descriptions of the processing flow of each module in the device and the interaction flow between each module, reference may be made to the relevant descriptions in the above method embodiment, which will not be described in detail here.

[0219] Corresponds to Figure 1 The present disclosure also provides an electronic device 600, such as Figure 6 FIG. 6 is a schematic diagram of the structure of an electronic device 600 provided in an embodiment of the present disclosure, including:

[0220] Processor 61, memory 62, and bus 63; memory 62 is used to store execution instructions, including internal memory 621 and external memory 622; the internal memory 621 is also called internal memory, which is used to temporarily store the operation data in the processor 61 and the data exchanged with the external memory 622 such as a hard disk. The processor 61 exchanges data with the external memory 622 through the internal memory 621. When the electronic device 600 is running, the processor 61 communicates with the memory 62 through the bus 63, so that the processor 61 executes the following instructions:

[0221] After detecting that a secure connection is established between the first device and the second device, obtaining a first cryptographic algorithm negotiated between the first device and the second device;

[0222] In the event that it is determined that the first cryptographic algorithm does not meet the security conditions, a first message is sent to the first device; wherein the first message includes but is not limited to: one or more recommended cryptographic algorithms and a first indication, the recommended cryptographic algorithm is used to indicate a cryptographic algorithm that meets the security conditions between the first device and the second device, and the first indication is used to indicate that the first cryptographic algorithm does not meet the security conditions.

[0223] The processor 61 may also execute the following instructions:

[0224] In response to a connection request from a second device, determining a first cryptographic algorithm for a secure connection established with the second device;

[0225] Receive a first message sent by a network element; wherein, the network element sends the first message to the first device when determining that the first cryptographic algorithm does not meet security conditions; the first message includes but is not limited to: one or more recommended cryptographic algorithms and a first indication, the recommended cryptographic algorithm is used to indicate a cryptographic algorithm that meets security conditions between the first device and the second device, and the first indication is used to indicate that the first cryptographic algorithm does not meet security conditions.

[0226] The basic principles of the present disclosure are described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, effects, etc. mentioned in the present disclosure are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. are required by each embodiment of the present disclosure. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, and are not limitations. The above details do not limit the present disclosure to the necessity of adopting the above specific details to be implemented.

[0227] The block diagrams of the devices, apparatuses, equipment, and systems involved in this disclosure are only illustrative examples and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, apparatuses, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including," "comprising," "having," and the like are open words, referring to "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or," and can be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and can be used interchangeably therewith.

[0228] Additionally, as used herein, "or" used in a list of items beginning with "at least one" indicates a separate list, so that, for example, a list of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not mean that the example described is preferred or better than other examples.

[0229] It should also be noted that in the system and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0230] Various changes, substitutions, and modifications of the techniques described herein may be made without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of the present disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of events, means, methods, and actions described above. Currently existing or later to be developed processes, machines, manufactures, compositions of events, means, methods, or actions that perform substantially the same functions or achieve substantially the same results as the corresponding aspects described herein may be utilized. Thus, the appended claims include such processes, machines, manufactures, compositions of events, means, methods, or actions within their scope.

[0231] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

[0232] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

Claims

1. A method for configuring a communication network cryptographic algorithm, characterized in that: Applied to network elements, including: After detecting that a secure connection is established between the first device and the second device, obtaining a first cryptographic algorithm negotiated between the first device and the second device; In the event that it is determined that the first cryptographic algorithm does not meet the security conditions, a first message is sent to the first device; wherein the first message includes at least one of the following: a recommended cryptographic algorithm, a first indication; the recommended cryptographic algorithm is used to indicate a cryptographic algorithm that meets the security conditions between the first device and the second device, and the first indication is used to indicate that the first cryptographic algorithm does not meet the security conditions.

2. The method according to claim 1, characterized in that The obtaining a first cryptographic algorithm negotiated between the first device and the second device includes: In a case where a secure connection is established between the first device and the second device, collecting protocol messages transmitted between the first device and the second device; Based on the protocol message, the first cryptographic algorithm is determined.

3. The method according to claim 1, characterized in that The method further comprises: Determining one or more target cryptographic algorithms corresponding to the communication network in which the second device and the first device are located; In the case of determining that the first cryptographic algorithm does not belong to the target cryptographic algorithm, determining that the first cryptographic algorithm does not meet the security condition; In case it is determined that the first cryptographic algorithm belongs to the target cryptographic algorithm, it is determined that the first cryptographic algorithm meets the security condition.

4. The method according to claim 1, characterized in that The first message also includes: identification information of the second device, identification information of the first device, and identification information of a secure connection established between the second device and the first device.

5. The method according to claim 1, characterized in that After sending the first message to the first device, the method further includes: Obtain an update strategy for a second cryptographic algorithm list synchronized by the first device; wherein the second cryptographic algorithm list is a list of cryptographic algorithms supported by the first device, and the update strategy is used to indicate updating the second cryptographic algorithm list according to an intersection algorithm list, wherein the intersection algorithm list is an intersection of the first cryptographic algorithm list, the second cryptographic algorithm list, and the recommended cryptographic algorithm supported by the second device.

6. The method according to claim 1, characterized in that After sending the first message to the first device, the method further includes: Obtaining error information sent by the first device; wherein the error information is used to indicate support status of the second device and the first device for the recommended cryptographic algorithm; An algorithm update instruction is sent to the first device according to the error information, so that the first device performs corresponding processing according to the algorithm update instruction.

7. The method according to claim 6, characterized in that After sending the first message to the first device, the method further includes: A target instruction is issued to the first device, wherein the target instruction is used to instruct the first device to stop the secure connection with the second device and / or stop transmitting sensitive data to the second device.

8. A method for configuring a communication network cryptographic algorithm, characterized in that: Applied to a first device, comprising: In response to a connection request from a second device, determining a first cryptographic algorithm for a secure connection established with the second device; Receive a first message sent by a network element; wherein, when the network element determines that the first cryptographic algorithm does not meet the security conditions, the network element sends the first message to the first device; wherein the first message includes at least one of the following: a recommended cryptographic algorithm, a first indication, the recommended cryptographic algorithm is used to indicate a cryptographic algorithm that meets the security conditions between the first device and the second device, and the first indication is used to indicate that the first cryptographic algorithm does not meet the security conditions.

9. The method according to claim 8, characterized in that The step of determining, in response to a connection request from a second device, a first cryptographic algorithm for establishing a secure connection with the second device comprises: Parsing the connection request to obtain a first cryptographic algorithm list; wherein the first cryptographic algorithm list is a list of cryptographic algorithms supported by the second device; The first cryptographic algorithm is determined in the first cryptographic algorithm list, and the first cryptographic algorithm is fed back to the second device.

10. The method according to claim 8, characterized in that After receiving the first message sent by the network element, the method further includes: Analyze the recommended cryptographic algorithm to obtain algorithm support information of the first device and the second device for the recommended cryptographic algorithm; Determine an encryption transmission strategy for a secure connection established with the second device based on the algorithm support information, or send an error message to the network element.

11. The method according to claim 10, characterized in that The analyzing the recommended cryptographic algorithm to obtain algorithm support information of the first device and the second device for the recommended cryptographic algorithm includes: Determine an intersection of a first cryptographic algorithm list supported by the second device, a second cryptographic algorithm list supported by the first device, and the recommended cryptographic algorithm, and obtain an intersection algorithm list; In the case where the intersection algorithm list is an empty table, obtaining first algorithm support information; wherein the first algorithm support information is used to indicate that neither the second device nor the first device supports the recommended cryptographic algorithm; When the intersection algorithm list is not an empty table, second algorithm support information is obtained; wherein the second algorithm support information is used to indicate that both the second device and the first device support the recommended cryptographic algorithm.

12. The method according to claim 11, characterized in that The algorithm support information is the second algorithm support information; and determining the encryption transmission strategy for the secure connection established with the second device based on the algorithm support information includes: Determining a cryptographic algorithm with the highest priority in the intersection algorithm list; Re-establish a secure connection with the second device according to the highest priority cryptographic algorithm.

13. The method according to claim 12, characterized in that After re-establishing the secure connection with the second device according to the highest priority cryptographic algorithm, the method further includes: After updating the second cryptographic algorithm list according to the intersection algorithm list, generating an update strategy for the second cryptographic algorithm; Synchronize the update policy of the second cryptographic algorithm list to the network element.

14. The method according to claim 11, characterized in that The algorithm support information is the first algorithm support information; the method further includes: Obtaining an algorithm update instruction fed back by the network element; wherein the algorithm update instruction is an instruction sent by the network element when it is determined that both the second device and the first device do not support the recommended cryptographic algorithm; Perform corresponding processing according to the algorithm update instruction.

15. The method according to claim 10, characterized in that After sending the error information to the network element, the method further includes: Obtaining a target instruction issued by the network element; According to the target instruction, the secure connection with the second device is stopped and / or the transmission of sensitive data to the second device is stopped.

16. A computer device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the method according to claim 1 or claim 8.

17. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to claim 1 or claim 8 are implemented.

18. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to claim 1 or claim 8 are implemented.

Images