Two-way authentication and double-certificate based forward proxy communication transmission method and system

Abstract

The disclosure provides a two-way authentication and double-certificate-based forward proxy communication transmission method and system, relates to the technical field of encrypted communication, and comprises the following steps: a forward proxy server receives an HTTP request of a client, checks whether a cache of the request content exists locally according to the received HTTP request content of the client, and forwards the request content to a target server if the cache does not exist; the target server returns response data to the forward proxy server after receiving the forwarded request content; and the forward proxy server obtains the response data, first generates a content cache of the response data content locally, and then returns to the client; wherein the forward proxy server forwards the request content to the target server, which comprises the following steps: the forward proxy server uses a GMTLS protocol, performs two-way authentication by using double certificates, establishes a communication transmission channel with the target server, and exchanges an encrypted key for encrypted data transmission.

Description

Technical Field

[0001] The present disclosure relates to the technical field of encrypted communication, and in particular to a forward proxy communication transmission method and system based on two-way authentication and dual certificates. Background Art

[0002] The statements in this section merely provide background information related to the present disclosure and do not necessarily constitute prior art.

[0003] Among existing encrypted communication transmission methods, the vast majority use OpenSSL for HTTPS. Many also employ a single certificate for two-way authentication, or even a single certificate for one-way authentication, to establish encrypted connections. If a forward proxy is not used, and OpenSSL encryption is used instead of national encryption, and communication is transmitted directly after encryption, there are the following drawbacks:

[0004] 1) IP address exposure: Without a proxy, the client's real IP address will be recorded by the target server, affecting privacy;

[0005] 2) Inconvenient for supervision: Using one-way authentication and a single certificate or two-way authentication and a single certificate, in theory, except for the individual who can decrypt it, no one else can decrypt it, which makes it inconvenient for regulatory authorities to supervise.

[0006] 3) Compliance and market access issues: Some industries cannot use OpenSSL and are required to use national encryption standards. Failure to meet the standards may lead to risks. If products use non-national encryption, they may be restricted, affecting market competitiveness. Summary of the Invention

[0007] In order to solve the above problems, the present disclosure proposes a forward proxy communication transmission method and system based on two-way authentication and dual certificates, uses a forward proxy and encryption caching method, adopts the national secret two-way authentication and dual certificate system, uses the SM2 algorithm for asymmetric encryption, and uses the SM3 algorithm for certificate signing and verification. After establishing a communication connection, the data is encrypted and transmitted using the national secret SM4 symmetric encryption algorithm.

[0008] According to some embodiments, the present disclosure adopts the following technical solutions:

[0009] A forward proxy communication transmission method based on two-way authentication and dual certificates includes:

[0010] The forward proxy server receives the HTTP request from the client and checks whether there is a cache of the request content locally based on the HTTP request content received from the client. If not, the request content is forwarded to the target server.

[0011] After receiving the forwarded request content, the target server returns the response data to the forward proxy server;

[0012] After the forward proxy server receives the response data, it first caches the response data locally to generate a content cache, and then returns it to the client;

[0013] Among them, the forward proxy server forwards the request content to the target server, including: the forward proxy server uses the GMTLS protocol, uses dual certificates for two-way authentication, establishes a communication transmission channel with the target server, and exchanges encryption keys for encrypted data transmission.

[0014] According to some embodiments, the present disclosure adopts the following technical solutions:

[0015] A forward proxy communication transmission system based on two-way authentication and dual certificates includes:

[0016] Forward proxy server, client, and target server;

[0017] The forward proxy server receives the HTTP request from the client, and checks whether there is a cache of the request content locally according to the received HTTP request content from the client, and otherwise forwards the request content to the target server;

[0018] After receiving the forwarded request content, the target server returns response data to the forward proxy server;

[0019] After receiving the response data from the forward proxy server, the client caches the content of the response data locally to generate content cached return data.

[0020] Among them, the forward proxy server forwards the request content to the target server, including: the forward proxy server uses the GMTLS protocol, uses dual certificates for two-way authentication, establishes a communication transmission channel with the target server, and exchanges encryption keys for encrypted data transmission.

[0021] According to some embodiments, the present disclosure adopts the following technical solutions:

[0022] A non-transitory computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by a processor, the forward proxy communication transmission method based on two-way authentication and dual certificates is implemented.

[0023] According to some embodiments, the present disclosure adopts the following technical solutions:

[0024] An electronic device includes: a processor, a memory, and a computer program; wherein the processor is connected to the memory, and the computer program is stored in the memory. When the electronic device is running, the processor executes the computer program stored in the memory to enable the electronic device to implement the forward proxy communication transmission method based on two-way authentication and dual certificates.

[0025] Compared with the prior art, the present invention has the following beneficial effects:

[0026] The present invention discloses a forward proxy communication transmission method based on two-way authentication and dual certificates, which uses forward proxy and encryption cache technology, and adopts national secret two-way authentication and dual certificate system. Compared with one-way authentication, it improves security, and the signature certificate is generally generated by the user, and the encryption certificate is generated by the CA organization according to the signature certificate. Since the CA organization holds the private key of the encryption certificate, it can ensure that the regulatory agency has the ability to supervise the specific content of communication transmission when necessary; it uses the SM2 algorithm for asymmetric encryption, and uses the SM3 algorithm to sign and verify the certificate. After the communication connection is established, the data is encrypted and transmitted using the SM4 symmetric encryption algorithm, thereby realizing anonymity protection in the forward proxy process, hiding the user's real IP, protecting their privacy, increasing content caching, improving access speed, and reducing broadband utilization.

[0027] The present invention discloses a forward proxy communication transmission method based on two-way authentication and dual certificates, which adopts national secret dual certificate communication. The forward proxy can transcend geographical restrictions or firewall shielding, control access to specific websites, and prohibit or allow certain specific content, and perform two-way authentication, further strengthening network security and meeting industry compliance requirements and market standards. When necessary, regulatory authorities can use encryption certificates to strictly supervise the transmitted content. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The accompanying drawings, which constitute a part of the present disclosure, are used to provide a further understanding of the present disclosure. The exemplary embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation to the present disclosure.

[0029] Figure 1 This is a diagram showing the overall framework of a forward proxy for communication transmission according to an embodiment of the present disclosure;

[0030] Figure 2 This is an overall flow chart of the forward proxy for communication transmission according to an embodiment of the present disclosure;

[0031] Figure 3 A sequence diagram is provided for establishing a secure communication transmission channel during the forwarding process of an embodiment of the present disclosure. DETAILED DESCRIPTION

[0032] The present disclosure will be further described below with reference to the accompanying drawings and embodiments.

[0033] It should be noted that the following detailed descriptions are illustrative and intended to provide further explanation of the present disclosure. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which the present disclosure belongs.

[0034] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present disclosure. As used herein, unless the context clearly indicates otherwise, the singular form is intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or combinations thereof.

[0035] Example 1

[0036] In one embodiment of the present disclosure, a forward proxy communication transmission method based on two-way authentication and dual certificates is provided, wherein the forward proxy is a network proxy technology that is located between the client and the target server and acts as an intermediary. Figure 1 ,include:

[0037] Step 1: The forward proxy server receives the HTTP request from the client and checks whether there is a cache of the request content locally. If not, the request content is forwarded to the target server.

[0038] Step 2: After receiving the forwarded request content, the target server returns the response data to the forward proxy server;

[0039] Step 3: After the forward proxy server receives the response data, it first caches the content of the response data locally to generate a content cache, and then returns it to the client;

[0040] Among them, the forward proxy server forwards the request content to the target server, including: the forward proxy server uses the GMTLS protocol, uses dual certificates for two-way authentication, establishes a communication transmission channel with the target server, and exchanges encryption keys for encrypted data transmission.

[0041] As an embodiment, the specific implementation process of a forward proxy communication transmission method based on two-way authentication and dual certificates disclosed herein includes:

[0042] Step 1: Receive a client request. The forward proxy server (Nginx proxy server) receives the HTTP request from the client. The client and the forward proxy server communicate using the HTTP protocol.

[0043] Step 2: Check the cache. After receiving the client's request, the forward proxy server first checks the local cache. If the client's requested content is already cached locally, the cached content is returned to the client based on the cache policy (such as cache duration, maximum cache size, and whether to set an encrypted cache access password, which the user can configure as needed). If the requested content is not cached locally, the access request is forwarded to the target server.

[0044] Step 3: The forward proxy server forwards the access request to the target server. The forward proxy server forwards the request sent by the client to the target server.

[0045] Step 4: Based on Step 3, a GMSSL transmission channel is established between the forward proxy server and the target server. During this phase, the forward proxy server uses the GMTLS protocol, utilizing dual national security certificates for two-way authentication and establishing a secure connection with the target server. It also exchanges national security encryption keys for encrypted data transmission. Forward proxies can protect privacy. Client requests are forwarded by the proxy service, and the client's true IP address is hidden from the target server. This enhances user privacy. During access control, forward proxies can bypass geographic restrictions or firewall shielding, control access to specific websites, and prohibit or allow certain content.

[0046] Specifically, the forward proxy server and the target server use GMSSL's two-way authentication and dual certificate system to establish a secure connection for communication, such as Figure 3 As shown:

[0047] ①Client Hello: The forward proxy server initiates a request to the client. The forward proxy server sends the SSL version (including GMTLS), encryption algorithm (SM2, SM4, etc.), key exchange algorithm (SM2), MAC algorithm (SM3), etc. that it supports.

[0048] ②Server Hello: The target server responds to the request. It specifies the SSL version (GMTLS is selected here), the selected cipher suite (e.g., ECC_SM4_SM3), and, if session reuse is allowed, the session ID.

[0049] ③Server_Certificate: The target server sends its own signature certificate and encryption certificate.

[0050] ④Client Certificate Request: The target server requests the dual certificates of the forward proxy server.

[0051] ⑤Server Hello Done: The target server responds that the request is complete, notifying the server that the SSL version negotiation is complete and that key exchange can begin.

[0052] ⑥Client Certificate: Sending its own signature certificate and encryption certificate to the proxy server

[0053] ⑦Client Key Exchange: Key exchange, the forward proxy server generates a national secret SM4 symmetric encryption key, encrypts it with the SM2 public key of the target server's encryption certificate, and sends it to the target server. The target server decrypts it with the SM2 private key of its own encryption certificate to obtain the key.

[0054] ⑧Client Certificate Verify: Forward proxy server dual certificate verification. The forward proxy server encrypts the exchanged handshake messages with the SM2 private keys of its own dual certificates. The target server decrypts the messages with the SM2 public key of the forward proxy server to verify the certificates.

[0055] ⑨Change Cipher Spec: Notifies the target server that subsequent messages will use the negotiated SM4 key and cipher suite.

[0056] ⑩Finished: The forward proxy server completes the handshake. The forward proxy server uses the national secret SM3 algorithm to calculate the hash value of all handshake messages that have been exchanged (except ⑨). The target server also calculates and compares the received hash value to verify the integrity of the message and prevent tampering.

[0057] 11Change Cipher Spec: Notifies the forward proxy server that subsequent messages will use the negotiated key and encryption suite.

[0058] 12Finished: The handshake with the target server is completed and the hash value is calculated. See step ⑩.

[0059] Furthermore, in the dual-certificate system, the signature certificate is typically generated by the user, while the encryption certificate is generated by the CA (Certificate Authority) based on the user's signature certificate and then transmitted to the user using a "digital envelope" mechanism. With dual-certificate systems, since the CA retains the encryption certificate's private key, regulatory authorities can be assured of the ability to monitor certain communications when necessary.

[0060] Step 5: The forward proxy server receives the target server's response. After receiving the request forwarded by the forward proxy server, the target server processes the request and returns a response, which the forward proxy server receives on its behalf. The response data is encrypted using the national encryption algorithm SM4.

[0061] Step 6: Add caching. After receiving the response data, the forward proxy server first caches the response content locally to generate a content cache. When the same request is received again, it is directly returned to the client. Caching accessed content improves request efficiency and reduces bandwidth usage.

[0062] Step 7: Return to the client. The forward proxy server returns the target server's response to the client through the previously established session.

[0063] Step 8: End.

[0064] Example 2

[0065] In one embodiment of the present disclosure, a forward proxy communication transmission system based on two-way authentication and dual certificates is provided, including a forward proxy server, a client, and a target server;

[0066] The forward proxy server receives the HTTP request from the client, and checks whether there is a cache of the request content locally based on the HTTP request content received from the client, and if not, forwards the request content to the target server;

[0067] After receiving the forwarded request content, the target server returns response data to the forward proxy server;

[0068] After receiving the response data from the forward proxy server, the client caches the content of the response data locally to generate content cached return data.

[0069] Among them, the forward proxy server forwards the request content to the target server, including: the forward proxy server uses the GMTLS protocol, uses dual certificates for two-way authentication, establishes a communication transmission channel with the target server, and exchanges encryption keys for encrypted data transmission.

[0070] Example 3

[0071] In one embodiment of the present disclosure, a non-transitory computer-readable storage medium is provided, which is used to store computer instructions. When the computer instructions are executed by a processor, the forward proxy communication transmission method based on two-way authentication and dual certificates is implemented.

[0072] Example 4

[0073] In one embodiment of the present disclosure, an electronic device is provided, comprising: a processor, a memory, and a computer program; wherein the processor is connected to the memory, and the computer program is stored in the memory. When the electronic device is running, the processor executes the computer program stored in the memory, so that the electronic device executes the forward proxy communication transmission method based on two-way authentication and dual certificates.

[0074] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0075] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0076] Although the above describes the specific implementation methods of the present disclosure in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present disclosure. Those skilled in the art should understand that on the basis of the technical solution of the present disclosure, various modifications or variations that can be made by those skilled in the art without creative work are still within the scope of protection of the present disclosure.

Claims

1. A forward proxy communication transmission method based on two-way authentication and dual certificates, characterized in that: include: The forward proxy server receives the HTTP request from the client and checks whether there is a cache of the request content locally based on the HTTP request content received from the client. If not, the request content is forwarded to the target server. After receiving the forwarded request content, the target server returns the response data to the forward proxy server; After the forward proxy server receives the response data, it first caches the response data locally to generate a content cache, and then returns it to the client; Among them, the forward proxy server forwards the request content to the target server, including: the forward proxy server uses the GMTLS protocol, uses dual certificates for two-way authentication, establishes a communication transmission channel with the target server, and exchanges encryption keys for encrypted data transmission.

2. The forward proxy communication transmission method based on two-way authentication and dual certificates according to claim 1, characterized in that: The client communicates with the forward proxy server via the HTTP protocol.

3. The forward proxy communication transmission method based on two-way authentication and dual certificates according to claim 1, characterized in that: The HTTP request of the client is forwarded by the forward proxy server, and the real IP address of the client is hidden from the target server and is public to the forward proxy server.

4. The forward proxy communication transmission method based on two-way authentication and dual certificates according to claim 1, characterized in that: When the forward proxy server receives the HTTP request content from the client, it checks the local cache based on the request content. If the client's request content already exists in the local cache, the forward proxy server returns the cached content directly to the client according to the cache strategy. If the request content is not cached locally, the access request is forwarded to the target server.

5. The forward proxy communication transmission method based on two-way authentication and dual certificates according to claim 1, characterized in that: After receiving the forwarded request content, the target server uses the national encryption SM4 algorithm to encrypt the response data, and then returns the encrypted response data to the forward proxy server.

6. The forward proxy communication transmission method based on two-way authentication and dual certificates according to claim 1, characterized in that: The forward proxy server uses the GMTLS protocol and dual certificates for two-way authentication to establish a communication transmission channel with the target server, including: the forward proxy server forwards the request to the target server and sends its own SSL version and encryption method. The target server responds to the request, determines the SSL version and encryption method, and carries the session ID, returns the signature certificate and encryption certificate, and requests the dual certificates of the forward proxy server. After receiving the response, the forward proxy server exchanges secret keys with the target server.

7. The forward proxy communication transmission method based on two-way authentication and dual certificates according to claim 6, characterized in that: The forward proxy server sends its own signature certificate and encryption certificate to the target server for key exchange. The forward proxy server generates a national secret SM4 symmetric encryption key, encrypts it using the SM2 public key of the encryption certificate of the target server, and sends it to the target server. The target server uses the SM2 private key of its own encryption certificate to decrypt it to obtain the exchanged key.

8. A forward proxy communication transmission system based on two-way authentication and dual certificates, characterized in that: Including forward proxy server, client and target server; The forward proxy server receives the HTTP request from the client, and checks whether there is a cache of the request content locally according to the received HTTP request content from the client, and otherwise forwards the request content to the target server; After receiving the forwarded request content, the target server returns response data to the forward proxy server; After receiving the response data from the forward proxy server, the client caches the content of the response data locally to generate content cached return data; Among them, the forward proxy server forwards the request content to the target server, including: the forward proxy server uses the GMTLS protocol, uses dual certificates for two-way authentication, establishes a communication transmission channel with the target server, and exchanges encryption keys for encrypted data transmission.

9. A non-transitory computer-readable storage medium, characterized in that The non-transitory computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by the processor, the forward proxy communication transmission method based on two-way authentication and dual certificates is implemented as described in any one of claims 1 to 7.

10. An electronic device, characterized in that: include: A processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to enable the electronic device to implement the forward proxy communication transmission method based on two-way authentication and dual certificates as described in any one of claims 1 to 7.

Images