Forward proxy communication transmission method and system based on bidirectional authentication and double certificates

Abstract

The invention provides a forward proxy communication transmission method and system based on bidirectional authentication and double certificates, and relates to the technical field of encrypted communication, and the method comprises the steps: a forward proxy server receives an HTTP request of a client, checks whether there is a cache of the request content locally according to the received HTTP request content of the client, and sends the request content to the server; otherwise, forwarding the request content to the target server; the target server returns response data to the forward proxy server after receiving the forwarded request content; after the forward proxy server obtains the response data, the content of the response data is firstly generated into a content cache in a local cache, and then the content cache is returned to the client; wherein the forward proxy server forwards the request content to the target server, which comprises the following steps: the forward proxy server uses a GMTLS protocol and double certificates to carry out bidirectional authentication, establish a communication transmission channel with the target server, and exchange encryption keys for encryption transmission of data.

Description

Technical Field

[0001] The present disclosure relates to the technical field of encrypted communication, and in particular to a forward proxy communication transmission method and system based on two-way authentication and dual certificates. Background Art

[0002] The statements in this section merely provide background information related to the present disclosure and do not necessarily constitute prior art.

[0003] Among the existing encrypted communication transmission methods, most use OpenSSL for HTTPS encrypted communication transmission. And many use a two-way authentication single certificate, or even a one-way authentication single certificate to establish an encrypted connection. If you do not use a forward proxy, use OpenSSL encryption instead of national encryption, and directly transmit communication after encryption, there are the following disadvantages:

[0004] 1) IP address exposure: Without a proxy, the client's real IP address will be recorded by the target server, affecting privacy;

[0005] 2) Inconvenient for supervision: Using one-way authentication and a single certificate or two-way authentication and a single certificate, in theory, except for the individual who can decrypt, no one else can decrypt it, which is inconvenient for supervision by regulatory authorities.

[0006] 3) There are compliance and market access issues: Some industries cannot use OpenSSL and are required to use national encryption standards. Failure to meet the standards may lead to risks. If products use non-national encryption, they may be restricted, affecting market competitiveness. Summary of the invention

[0007] In order to solve the above problems, the present invention proposes a forward proxy communication transmission method and system based on two-way authentication and dual certificates, uses a forward proxy and encryption caching method, adopts the national secret two-way authentication and dual certificate system, uses the SM2 algorithm for asymmetric encryption, and uses the SM3 algorithm to sign and verify certificates. After establishing a communication connection, the data is encrypted and transmitted using the national secret SM4 symmetric encryption algorithm.

[0008] According to some embodiments, the present disclosure adopts the following technical solutions:

[0009] The forward proxy communication transmission method based on two-way authentication and dual certificates includes:

[0010] The forward proxy server receives the HTTP request from the client, and checks whether there is a cache of the request content locally based on the HTTP request content received from the client, otherwise the request content is forwarded to the target server;

[0011] After receiving the forwarded request content, the target server returns the response data to the forward proxy server;

[0012] After the forward proxy server obtains the response data, it first caches the content of the response data locally to generate a content cache, and then returns it to the client;

[0013] Among them, the forward proxy server forwards the request content to the target server, including: the forward proxy server uses the GMTLS protocol, uses dual certificates for two-way authentication, establishes a communication transmission channel with the target server, and exchanges encryption keys for encrypted data transmission.

[0014] According to some embodiments, the present disclosure adopts the following technical solutions:

[0015] A forward proxy communication transmission system based on two-way authentication and dual certificates includes:

[0016] Forward proxy server, client, and target server;

[0017] The forward proxy server receives the HTTP request from the client, and checks whether there is a cache of the request content locally according to the HTTP request content received from the client, otherwise forwards the request content to the target server;

[0018] After receiving the forwarded request content, the target server returns response data to the forward proxy server;

[0019] After receiving the response data from the forward proxy server, the client caches the content of the response data locally to generate content cached return data.

[0020] Among them, the forward proxy server forwards the request content to the target server, including: the forward proxy server uses the GMTLS protocol, uses dual certificates for two-way authentication, establishes a communication transmission channel with the target server, and exchanges encryption keys for encrypted data transmission.

[0021] According to some embodiments, the present disclosure adopts the following technical solutions:

[0022] A non-transitory computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by a processor, the forward proxy communication transmission method based on two-way authentication and dual certificates is implemented.

[0023] According to some embodiments, the present disclosure adopts the following technical solutions:

[0024] An electronic device comprises: a processor, a memory and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to enable the electronic device to implement the forward proxy communication transmission method based on two-way authentication and dual certificates.

[0025] Compared with the prior art, the present invention has the following beneficial effects:

[0026] The present invention discloses a forward proxy communication transmission method based on two-way authentication and dual certificates, which utilizes forward proxy and encryption cache technology, and adopts national secret two-way authentication and dual certificate system. Compared with one-way authentication, the security is improved. The signature certificate is generally generated by the user, and the encryption certificate is generated by the CA organization according to the signature certificate. Since the CA organization holds the encryption certificate private key, it can ensure that the regulatory agency has the ability to supervise the specific content of communication transmission when necessary. The SM2 algorithm is used for asymmetric encryption, and the certificate is signed and verified by the SM3 algorithm. After the communication connection is established, the data is encrypted and transmitted by the SM4 symmetric encryption algorithm, so as to realize anonymity protection in the forward proxy process, hide the user's real IP, protect its privacy, increase content cache, improve access speed, and reduce broadband utilization.

[0027] The present invention discloses a forward proxy communication transmission method based on two-way authentication and dual certificates, which adopts national secret dual certificate communication. The forward proxy can transcend geographical restrictions or firewall shielding, control access to specific websites, and prohibit or allow certain specific content, and perform two-way authentication, further strengthening network security, meeting industry compliance requirements and market standards. When necessary, regulatory authorities can use encryption certificates to conduct strong supervision on transmitted content. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The accompanying drawings constituting a part of the present disclosure are used to provide a further understanding of the present disclosure. The illustrative embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation on the present disclosure.

[0029] Figure 1 The overall framework diagram of the forward proxy for communication transmission of the embodiment of the present disclosure;

[0030] Figure 2 The overall flow chart of the forward proxy for communication transmission of the embodiment of the present disclosure;

[0031] Figure 3 A sequence diagram is established for a communication security transmission channel in the forwarding process of an embodiment of the present disclosure. DETAILED DESCRIPTION

[0032] The present disclosure is further described below in conjunction with the accompanying drawings and embodiments.

[0033] It should be noted that the following detailed descriptions are all illustrative and are intended to provide further explanation of the present disclosure. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present disclosure belongs.

[0034] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present disclosure. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0035] Example 1

[0036] In one embodiment of the present disclosure, a forward proxy communication transmission method based on two-way authentication and dual certificates is provided, wherein the forward proxy is a network proxy technology, which is located between the client and the target server and acts as a middleman, such as Figure 1 ,include:

[0037] Step 1: The forward proxy server receives the HTTP request from the client, and checks whether there is a cache of the request content locally based on the HTTP request content received from the client, otherwise the request content is forwarded to the target server;

[0038] Step 2: After receiving the forwarded request content, the target server returns the response data to the forward proxy server;

[0039] Step 3: After the forward proxy server obtains the response data, it first caches the content of the response data locally to generate a content cache, and then returns it to the client;

[0040] Among them, the forward proxy server forwards the request content to the target server, including: the forward proxy server uses the GMTLS protocol, uses dual certificates for two-way authentication, establishes a communication transmission channel with the target server, and exchanges encryption keys for encrypted data transmission.

[0041] As an embodiment, a specific implementation process of a forward proxy communication transmission method based on two-way authentication and dual certificates disclosed in the present invention includes:

[0042] Step 1: Receive client request. The forward proxy server (Nginx proxy server) receives the HTTP request from the client. The client and the forward proxy server communicate using the HTTP protocol.

[0043] Step 2: Check the cache. After receiving the client's request, the forward proxy server first checks the local cache. If the client's requested content already exists locally, the cache content is returned to the client according to the cache policy (such as cache duration, maximum cache size, and whether to set an encrypted cache access password, etc., which can be configured by the user according to their needs); if there is no cache for the requested content locally, the access request is forwarded to the target server.

[0044] Step 3: The forward proxy server forwards the access request to the target server. The forward proxy server forwards the request sent by the client to the target server.

[0045] Step 4: Based on step 3, a GMSSL transmission channel is established between the forward proxy server and the target server. In this stage, the forward proxy server will use the GMTLS protocol, use the national secret dual certificate, perform two-way authentication, and establish a secure connection with the target server. And complete the exchange of national secret encryption keys for encrypted data transmission. The forward proxy can protect privacy. The client request is forwarded by the proxy service. The client's real IP address is hidden from the target server. The forward proxy can enhance user privacy. During the access control process, the forward proxy can cross geographical restrictions or firewall shielding, control access to specific websites, and prohibit or allow certain specific content.

[0046] Specifically, the forward proxy server and the target server use GMSSL's two-way authentication and dual certificate system to establish a secure connection for communication, such as Figure 3 As shown:

[0047] ①Client Hello: The forward proxy server initiates a request to the client. The forward proxy server sends the SSL version (including GMTLS), encryption algorithm (SM2, SM4, etc.), key exchange algorithm (SM2), MAC algorithm (SM3), etc. that it supports.

[0048] ②Server Hello: The target server responds to the request. Determine the SSL version (GMTLS is selected here), the selected encryption suite (such as ECC_SM4_SM3), and the session ID if session reuse is allowed.

[0049] ③Server_Certificate: The target server sends its own signature certificate and encryption certificate.

[0050] ④Client Certificate Request: The target server requests the dual certificates of the forward proxy server.

[0051] ⑤Server Hello Done: The target server responds that the request is complete, notifies that the SSL version negotiation is complete, and can start exchanging keys.

[0052] ⑥Client Certificate: Sending its own signature certificate and encryption certificate to the proxy server

[0053] ⑦Client Key Exchange: Key exchange. The forward proxy server generates a national secret SM4 symmetric encryption key, encrypts it with the SM2 public key of the target server's encryption certificate, and sends it to the target server. The target server decrypts it with the SM2 private key of its own encryption certificate to obtain the key.

[0054] ⑧Client Certificate Verify: Forward proxy server dual certificate verification. The forward proxy server uses the SM2 private key of its own dual certificates to encrypt the exchanged handshake messages, and the target server uses the SM2 public key of the forward proxy server to decrypt them to verify the certificate.

[0055] ⑨Change Cipher Spec: Notify the target server that subsequent messages will use the negotiated SM4 key and encryption suite.

[0056] ⑩Finished: The forward proxy server completes the handshake. The forward proxy server uses the national secret SM3 algorithm to calculate the hash values ​​of all handshake messages that have been exchanged (except ⑨). The target server also calculates and compares the received hash values ​​to verify the integrity of the message and prevent tampering.

[0057] 11Change Cipher Spec: Notifies the forward proxy server that subsequent messages will use the negotiated key and encryption suite.

[0058] 12Finished: The target server handshake is completed and the hash value is calculated, refer to ⑩.

[0059] Furthermore, in the national secret dual certificate system, the signature certificate is generally generated by the user himself, and the encryption certificate is generated by the CA (Certificate Authority) based on the user's signature certificate, and then transmitted to the user using the "digital envelope" mechanism. With the national secret dual certificate, since the CA retains the encryption certificate private key, it can ensure that the regulatory authorities have the ability to monitor certain communication information when necessary.

[0060] Step 5: The forward proxy server receives the target server's response. After the target server receives the request forwarded by the forward proxy server, it processes the request and returns a response, and the forward proxy server receives the response on its behalf. The response data is encrypted and transmitted using the national encryption SM4 algorithm.

[0061] Step 6: Add cache. After receiving the response data, the forward proxy server first caches the response content locally to generate a content cache so that it can directly return to the client when receiving the same request again. By caching the accessed content, the request efficiency is improved and the bandwidth usage is reduced.

[0062] Step 7: Return to the client. The forward proxy server returns the target server's response to the client through the previously established session.

[0063] Step 8: End.

[0064] Example 2

[0065] In one embodiment of the present disclosure, a forward proxy communication transmission system based on two-way authentication and dual certificates is provided, including a forward proxy server, a client, and a target server;

[0066] The forward proxy server receives the HTTP request from the client, and checks whether there is a cache of the request content locally according to the HTTP request content received from the client, otherwise forwards the request content to the target server;

[0067] After receiving the forwarded request content, the target server returns response data to the forward proxy server;

[0068] After receiving the response data from the forward proxy server, the client caches the content of the response data locally to generate content cached return data.

[0069] Among them, the forward proxy server forwards the request content to the target server, including: the forward proxy server uses the GMTLS protocol, uses dual certificates for two-way authentication, establishes a communication transmission channel with the target server, and exchanges encryption keys for encrypted data transmission.

[0070] Example 3

[0071] In one embodiment of the present disclosure, a non-transitory computer-readable storage medium is provided, wherein the non-transitory computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by a processor, the forward proxy communication transmission method based on two-way authentication and dual certificates is implemented.

[0072] Example 4

[0073] In one embodiment of the present disclosure, an electronic device is provided, comprising: a processor, a memory and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory, so that the electronic device executes the forward proxy communication transmission method based on two-way authentication and dual certificates.

[0074] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0075] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0076] Although the above describes the specific implementation methods of the present disclosure in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present disclosure. Technical personnel in the relevant field should understand that on the basis of the technical solution of the present disclosure, various modifications or variations that can be made by those skilled in the art without creative work are still within the scope of protection of the present disclosure.

Claims

1. A forward proxy communication transmission method based on two-way authentication and dual certificates, characterized in that: include: The forward proxy server receives the HTTP request from the client, and checks whether there is a cache of the request content locally based on the HTTP request content received from the client, otherwise the request content is forwarded to the target server; After receiving the forwarded request content, the target server returns the response data to the forward proxy server; After the forward proxy server obtains the response data, it first caches the content of the response data locally to generate a content cache, and then returns it to the client; Among them, the forward proxy server forwards the request content to the target server, including: the forward proxy server uses the GMTLS protocol, uses dual certificates for two-way authentication, establishes a communication transmission channel with the target server, and exchanges encryption keys for encrypted data transmission.

2. The forward proxy communication transmission method based on two-way authentication and dual certificates as claimed in claim 1, characterized in that: The client communicates with the forward proxy server via HTTP protocol.

3. The forward proxy communication transmission method based on two-way authentication and dual certificates as claimed in claim 1, characterized in that: The HTTP request of the client is forwarded by the forward proxy server, and the real IP address of the client is hidden from the target server and is open to the forward proxy server.

4. The forward proxy communication transmission method based on two-way authentication and dual certificates as claimed in claim 1, characterized in that: When the forward proxy server receives the HTTP request content from the client, it checks the local cache based on the request content. If there is already a cache of the client's request content locally, the forward proxy server returns the cached content directly to the client according to the cache strategy. If there is no cache of the request content locally, the access request is forwarded to the target server.

5. The forward proxy communication transmission method based on two-way authentication and dual certificates as claimed in claim 1, characterized in that: After receiving the forwarded request content, the target server uses the national encryption SM4 algorithm to encrypt the response data, and returns the encrypted response data to the forward proxy server.

6. The forward proxy communication transmission method based on two-way authentication and dual certificates as claimed in claim 1, characterized in that: The forward proxy server uses the GMTLS protocol and dual certificates for two-way authentication to establish a communication transmission channel with the target server, including: the forward proxy server forwards the request to the target server and sends its own SSL version and encryption method; the target server responds to the request, determines the SSL version and encryption method, carries the session ID, returns the signature certificate and encryption certificate, and requests the dual certificates of the forward proxy server; after receiving the response, the forward proxy server exchanges keys with the target server.

7. The forward proxy communication transmission method based on two-way authentication and dual certificates as claimed in claim 6, characterized in that: The forward proxy server sends its own signature certificate and encryption certificate to the target server for key exchange. The forward proxy server generates a national secret SM4 symmetric encryption key, encrypts it using the SM2 public key of the encryption certificate of the target server, and then sends it to the target server. The target server uses the SM2 private key of its own encryption certificate to decrypt it to obtain the exchanged key.

8. A forward proxy communication transmission system based on two-way authentication and dual certificates, characterized in that: Includes forward proxy server, client and target server; The forward proxy server receives the HTTP request from the client, and checks whether there is a cache of the request content locally according to the HTTP request content received from the client, otherwise forwards the request content to the target server; After receiving the forwarded request content, the target server returns response data to the forward proxy server; After receiving the response data from the forward proxy server, the client caches the content of the response data locally to generate content cached return data. Among them, the forward proxy server forwards the request content to the target server, including: the forward proxy server uses the GMTLS protocol, uses dual certificates for two-way authentication, establishes a communication transmission channel with the target server, and exchanges encryption keys for encrypted data transmission.

9. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by the processor, the forward proxy communication transmission method based on two-way authentication and dual certificates as described in any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: include: A processor, a memory and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to enable the electronic device to implement the forward proxy communication transmission method based on two-way authentication and dual certificates as described in any one of claims 1-7.

Images