National password transformation method, device, equipment and medium

Abstract

The invention relates to a national password transformation method, device, equipment and medium, and the method comprises the steps: receiving a login request message which is formed by a national password gateway responding to a first connection request of a browser and comprises network flow data, extracting a User-Agent field from the network flow data, and judging whether the browser is a national password browser or not according to the User-Agent field, if the browser is a national secret browser, redirecting the network flow data to a national secret domain name through a preset rule, sending the national secret domain name to a national secret gateway so as to enable the national secret gateway to be bound with the national secret domain name, and establishing a national secret transmission channel with the national secret browser by adopting a pre-stored national secret algorithm suite and a national secret certificate; and if the browser is a non-cryptographic browser, transmitting the network flow data to the original domain name. Visibly, the application can simultaneously meet the national password requirement and the non-national password requirement, can effectively solve the difficulty in national password transformation in the environment that the national password browser is still popular at present, and reduces the national password work risk and cost.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a national encryption transformation method, device, equipment and medium. Background Art

[0002] In recent years, as financial security has risen to the level of national security, some business systems on the bank side and some financial-related browsers connected to the bank side have undergone national encryption transformation. National encryption transformation generally completes data transmission confidentiality and integrity assurance through the network layer, thereby reducing application data transmission risks.

[0003] However, there are currently a large number of browsers that are connected to the bank side, which means that in addition to some non-national secret browsers, the bank side also needs to connect to some national secret browsers. The current mainstream browsers (IE, Chrome, etc.) do not support national secret certificates and national secret algorithms. They only meet non-national secret requirements and cannot meet national secret requirements. It takes a long time for browsers to deploy national secret certificates and national secret algorithms, which makes national secret transformation difficult. Therefore, how to meet both national secret requirements and non-national secret requirements at the same time, thereby solving the difficulties in national secret transformation, has become an urgent problem to be solved. Summary of the invention

[0004] Based on this, it is necessary to provide a national security transformation method, device, equipment and medium to address the above-mentioned technical problems, so as to solve the problem that the existing technology cannot meet both national security requirements and non-national security requirements, resulting in difficulties in national security transformation.

[0005] A first aspect of an embodiment of the present application provides a national secret modification method, the national secret modification method comprising: Receiving a login request message formed by the national encryption gateway in response to the first connection request of the browser, wherein the login request message includes network traffic data; Extracting a User-Agent field from the network traffic data, and determining whether the browser is a national security browser based on the User-Agent field; If the browser is a national secret browser, the network traffic data is redirected to the national secret domain name according to preset rules; The national secret domain name is sent to the national secret gateway to bind the national secret gateway with the national secret domain name, and a pre-stored national secret algorithm suite and national secret certificate are used to establish a national secret transmission channel with the national secret browser.

[0006] A second aspect of an embodiment of the present application provides a national secret modification device, the national secret modification device comprising: A receiving module, used to receive a login request message formed by the national encryption gateway in response to the first connection request of the browser, wherein the login request message includes network traffic data; A judgment module, used to extract the User-Agent field from the network traffic data, and judge whether the browser is a national secret browser according to the User-Agent field; A redirection module, for redirecting the network traffic data to a national secret domain name according to preset rules if the browser is a national secret browser; A module is established, which is used to send the national secret domain name to the national secret gateway so that the national secret gateway is bound to the national secret domain name, and a pre-stored national secret algorithm suite and national secret certificate are used to establish a national secret transmission channel with the national secret browser.

[0007] In a third aspect, an embodiment of the present invention provides a computer device, comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the national secret transformation control method as described in the first aspect when executing the computer program.

[0008] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the national secret transformation control method as described in the first aspect is implemented.

[0009] In summary, the present invention provides a method, device, equipment and medium for national secret transformation, which receives a login request message formed by a national secret gateway in response to a first connection request of a browser, wherein the login request message includes network traffic data, extracts a User-Agent field from the network traffic data, and judges whether the browser is a national secret browser according to the User-Agent field. If the browser is a national secret browser, the network traffic data is redirected to the national secret domain name through a preset rule, and the national secret domain name is sent to the national secret gateway so that the national secret gateway is bound to the national secret domain name, and a pre-stored national secret algorithm suite and a national secret certificate are used to establish a national secret transmission channel with the national secret browser for encrypted transmission. If the browser is a non-national secret browser, the network traffic data is transmitted to the original domain name, and data transmission is performed. It can be seen that the present application can meet both national secret requirements and non-national secret requirements, and can effectively solve the difficulties in national secret transformation in the current environment where national secret browsers are not yet popular, and reduce the risks and costs of national secret work. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0011] Figure 1 This is an application environment diagram of a national encryption transformation method provided by an embodiment of the present invention; Figure 2 It is a flow chart of a national encryption transformation method provided by an embodiment of the present invention; Figure 3 It is a structural schematic diagram of a national secret transformation device provided by an embodiment of the present invention; Figure 4 It is a structural schematic diagram of a computer device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0012] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0013] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0014] It should also be understood that the term "and / or" used in the present description and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0015] As used in the present specification and the appended claims, the term “if” may be interpreted as “when” or “uponce” or “in response to determining”, depending on the context. Similarly, the phrases “if it is determined” or “if matched to [described condition or event]” may be interpreted as meaning “upon determination” or “in response to determination” or “uponce matched to [described condition or event]” or “in response to matching to [described condition or event]”, depending on the context.

[0016] In addition, in the description of the present specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0017] References to "one embodiment" or "some embodiments" etc. described in the present specification mean that one or more embodiments of the present invention include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0018] It should be understood that the order of execution of the steps in the following embodiments does not imply a precedence of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0019] In order to illustrate the technical solution of the present invention, specific embodiments are provided below for illustration.

[0020] See also Figure 1 , is an application environment diagram of a national secret transformation method provided by an embodiment of the present invention. A national secret transformation method provided by an embodiment of the present invention can be applied in Figure 1 In the application environment, the client communicates with the server. The client includes but is not limited to PDAs, desktop computers, laptops, ultra-mobile personal computers (UMPCs), netbooks, personal digital assistants (PDAs) and other computer devices. The client here is replaced by a browser. The server can be implemented with an independent server or a server cluster composed of multiple servers. Financial data, such as loan information and deposit information, can be uploaded and downloaded through the server.

[0021] See also Figure 2 , is a flow chart of a method for transforming a national secret provided by an embodiment of the present invention, such as Figure 2 As shown, the national secret transformation method can be implemented through the following steps.

[0022] S201: Receive a login request message formed by a national security gateway in response to a first connection request from a browser, wherein the login request message includes network traffic data.

[0023] In step S201, the execution subject of this embodiment should be the server, and the national secret gateway is set between the browser and the server. The national secret gateway is a national secret device certified by the National Cryptography Bureau. The login request message formed by the national secret gateway in response to the first connection request of the browser is received by the pre-configured port on the server, wherein the login request message includes network traffic data, and the network traffic data includes HTTPS (Secure Hypertext Transfer Protocol) and HTTP (HyperText Transfer Protocol). HTTPS is developed by Netscape and built into its browser, and is used to compress and decompress data, and return the result sent back on the national secret gateway. HTTPS actually uses Netscape's full socket layer (SSL) as a sublayer of the HTTP application layer. The national secret gateway can convert between the HTTPS protocol and the HTTP protocol, specifically, by combining with SSL (Secure Socket Layer, secure socket layer), encrypt the communication content, establish a secure communication line to achieve the conversion from HTTP to HTTPS, and achieve the conversion from HTTPS to HTTP through standard decryption operations. It should be noted that the browser does not directly request the web page from the server but sends a request to the national secret gateway. The request information will be sent to the national secret gateway first, and then the national secret gateway will request the information required by the browser from the server and transmit it to the browser. Through the above steps, data can be transmitted efficiently, thus ensuring that the data will not be stolen or tampered with during the transmission process.

[0024] For example, if you want to visit website A, but for some reason you cannot directly access website A or you do not want to allow it to directly access website A, or you want to intercept communication data, you can use the National Secret Gateway. However, you need to make corresponding configurations on the browser (mobile phone, computer or other electronic device) first (write the IP address and port of the proxy server), point to the National Secret Gateway, and when you actually visit website A, enter the same URL as before in the address bar of the browser. The browser will automatically access the National Secret Gateway first, and then the National Secret Gateway will automatically transfer to website A.

[0025] S202: Extracting a User-Agent field from the network traffic data, and determining whether the browser is a national security browser based on the User-Agent field.

[0026] In step S202, the server of this embodiment extracts the User-Agent field from the network traffic data. Due to the http / https protocol specifications, no matter what browser the front-end is, the http / https data packet header will carry a User-Agent field to record what the front-end browser is. The server will pre-interpret the network traffic data and read the User-Agent field, and then determine whether the browser is a national secret browser based on the User-Agent field. If it is a national secret browser, execute step S202, and the server will redirect the network traffic data to the national secret domain name according to preset rules. If it is a non-national secret browser, execute step S205, then transfer the network traffic data to the original domain name, and perform data transmission, thereby meeting both national secret requirements and non-national secret requirements.

[0027] In one embodiment of the invention, determining whether a browser is a national security browser includes: Parsing the network traffic data based on preset rules to obtain a User-Agent field; Determine the type and version information of the browser according to the User-Agent field; According to the type and version information of the browser, determine whether the browser is a national security browser.

[0028] Specifically, the server of this embodiment first caches the acquired network traffic data, then starts one or more processes or threads, and calls the preset rules to synchronously parse the network traffic data. For example, it can be analyzed according to the format of the HTTP hypertext transfer protocol or HTTPS hypertext transfer security protocol message. The data part (message load) of an HTTP or HTTPS message generally includes a general part and a message header (User-Agent field), and the general part includes Request URL (uniform resource locator of request), Request Method (request method), Status Code (status code), Remote Address (remote address) and other fields, and then the User-Agent field is screened to obtain, wherein the User-Agent field is a part of the Http protocol, belongs to the component of the header field, and can provide the identification of the browser type, operating system, browser kernel and other information used by the user. By cleaning the data that does not contain the browser information in the extracted User-Agent field or the field with a chaotic format, and then extracting the key field, obtaining the data related to the browser information in the User-Agent field and parsing it to obtain the corresponding browser type and version information, and then judging whether the browser is a national secret browser according to the browser type and version information. For example, the relevant data that does not contain browser information in the User-Agent field, such as Weiju, Weibo, NetEase Cloud Music, Tiantian Kupao, Tiantian Fuweng, etc., are cleaned. Although the User-Agent field contains some terminal type fields, the format is chaotic and it is not conducive to the automatic extraction of the program. The fields are cleaned. Through big data screening, or combined with manual recognition to identify the part with the highest proportion of data, the User-Agent field contains browser information related fields, and the record type with a regular format is obtained, and then the corresponding type and version information are parsed.

[0029] For example, when the User-Agent field is the browser name: Chrome; version number: 91.0.4472.124; additional information: SM-SecureBrowser / 1.0.0 (which may indicate that this is a national security browser); comparing the browser information: Chrome is known to be a common browser, but "SM-SecureBrowser / 1.0.0" may be a specific national security browser identifier; because the User-Agent field contains the specific identifier "SM-SecureBrowser / 1.0.0", and this identifier matches the known national security browser characteristics, it can be determined that the browser is a national security browser.

[0030] In this embodiment, the type and version information of the browser can be accurately determined based on the User-Agent field, and whether the browser is a national security browser can be further determined, so that timely information support can be provided to better meet national security requirements in the future.

[0031] S203: If the browser is a national secret browser, the network traffic data is redirected to the national secret domain name according to preset rules.

[0032] In step S203, since the national secret gateway is set between the browser and the server, all access requests to the server sent by the browser must be verified and filtered by the national secret gateway. The server is used to manage all browsers, formulate security policies, and connect with the existing identity management system of the enterprise. Therefore, the national secret gateway is deployed on the boundary between the server and the core area of ​​the network, and then the national secret gateway is routed and connected to the server, and the national secret certificate is deployed on the national secret gateway, so that a national secret transmission channel can be established between the national secret browser and the national secret gateway, thereby ensuring the confidentiality and integrity of the data during the communication process. This application establishes a connection with the browser through the national secret gateway, establishes a connection with the server, and interacts with it. To ensure that a national secret transmission channel is established between the national secret browser and the national secret gateway, you only need to re-apply for a new domain name for national secret access on the server. Assuming that the domain name of the original application is: AAA.pingan.com.cn, you can apply for a domain name AAA-encrypt.pingan.com.cn, that is, the national secret domain name is AAA-encrypt.pingan.com.cn, and the original domain name is AAA.pingan.com.cn. After obtaining the User-Agent field, according to the User-Agent field, when it is determined that the browser is a national secret browser, the network traffic data will be redirected to the national secret domain name through preset rules.

[0033] In this embodiment, network traffic data is redirected to the national secret domain name through preset rules, which can ensure that the data is encrypted using the national secret algorithm during transmission, effectively preventing network eavesdropping, forgery and tampering during information transmission, thereby improving overall network security.

[0034] S204: Send the national secret domain name to the national secret gateway to bind the national secret gateway to the national secret domain name, and use the pre-stored national secret algorithm suite and national secret certificate to establish a national secret transmission channel with the national secret browser.

[0035] In step S204, after the server redirects the network traffic data to the national secret domain name through preset rules, due to the communication connection between the national secret gateway and the server, the server sends the national secret domain name to the national secret gateway to connect and route the national secret gateway with the national secret domain name, and then uses the national secret algorithm suite and national secret certificate pre-stored on the national secret gateway to establish a national secret transmission channel with the national secret browser, so that all subsequent access traffic is transmitted through the national secret transmission channel, thereby meeting the confidentiality and integrity protection requirements of the national secret transmission.

[0036] In one embodiment of the invention, a pre-stored national encryption algorithm suite and a national encryption certificate are used to establish a national encryption transmission channel with a national encryption browser, including: Use the pre-stored national encryption algorithm suite and national encryption certificate to perform SSL handshake with the national encryption browser; During the SSL handshake, a first national secret algorithm is used as a symmetric encryption and decryption algorithm for the national secret certificate; A second national secret algorithm is used to perform a hash operation on the handshake data in the SSL handshake process, and the SSL handshake is completed to establish a national secret transmission channel.

[0037] Specifically, the national secret algorithm suite is pre-installed in the national secret gateway that supports the national secret algorithm. The national secret algorithm is an independent and controllable domestic algorithm formulated by the National Cryptography Administration. The national secret algorithm is applied to the national secret transmission channel, replacing the traditional RSA algorithm, and the establishment speed of the national secret transmission channel is increased as much as possible, and the quality and security of the national secret transmission service are improved, while reducing consumption (such as memory consumption and CPU processing consumption), promoting the application scope of the national secret algorithm and accelerating the deep application of the national secret algorithm. The national secret algorithm suite (SM2, SM3, SM4, etc.) can effectively prevent data leakage and man-in-the-middle attacks. By using the pre-stored national secret algorithm suite and the national secret certificate, and the national secret browser to perform SSL handshake, in the process of SSL handshake, the first national secret algorithm is used as the symmetric encryption and decryption algorithm of the national secret certificate, and the second national secret algorithm is used to perform hash operation on the handshake data in the SSL handshake process, and the SSL handshake is completed to establish the national secret transmission channel. Through the above steps, an efficient SSL handshake process is achieved through the pre-stored national secret algorithm suite and the national secret certificate, as well as the compatible design with the national secret browser. In addition, algorithms such as SM2, SM3, and SM4 have high security and efficiency and can meet the needs of various Internet application scenarios.

[0038] In one embodiment of the invention, before completing the SSL handshake to establish the national secret transmission channel, it includes: A national secret authentication request is sent to the national secret browser, wherein the national secret authentication request includes a national secret certificate, a public key and a private key, so that the national secret browser verifies the national secret certificate based on a preset national secret algorithm library; If the verification is successful, the random value is encrypted using the public key to generate an encrypted random value; Send the encrypted random value to the national secret SSL offloading gateway, so that the national secret SSL offloading gateway uses the private key to decrypt the encrypted random value, generate a session key, and encrypt the session key to generate an encrypted session key; Sending the encrypted session key to the national secret browser, so that the national secret browser uses the random value to decrypt the encrypted session key and extract the session key; The session key is subjected to symmetric encryption communication verification, and when the symmetric encryption communication verification passes, the step of completing the SSL handshake to establish a national encryption transmission channel is executed.

[0039] Specifically, when the network traffic data is mapped to the national secret gateway through the national secret domain name for the first time, the gateway automatically sends the national secret certificate to the front end and completes the national secret trust authentication with the front-end national secret browser. That is, this is a communication process using the national secret algorithm, which involves the interaction between the national secret browser and the national secret gateway. First, it is necessary to authenticate the national secret browser and the national secret gateway to ensure that the national secret gateway accesses the correct national secret browser, and send a national secret authentication request to the national secret browser, where the national secret authentication request includes the national secret certificate, public key and private key, so that the national secret browser verifies the national secret certificate based on the preset national secret algorithm library. If the verification is successful, the national secret browser will automatically extract the public key from the national secret gateway. This step is required by the HTTPS protocol specification, and in this case, the public key encryption algorithm (such as SM2) in the national secret algorithm is used. Since the national secret browser generates a random value (usually called a "pre-master key" or "client random number"), the national secret gateway's public key (SM2 public key extracted from the SSL certificate) is used to encrypt this random value to generate an encrypted random value, and the generated encrypted random value is sent to the national secret gateway. The national secret gateway uses the private key (SM2 private key) to decrypt the encrypted random value sent by the national secret browser. After decryption, the national secret gateway uses this random value (or combines other information, such as random numbers generated by the server, session ID, etc.) to generate a session key. Then, the national secret gateway uses the original random value (or a value after some transformation) sent by the national secret browser to encrypt this session key, generate an encrypted session key, and send the encrypted session key to the national secret browser. The national secret browser uses the random value (or the corresponding transformation value) generated by itself to decrypt the encrypted session key received from the national secret gateway. After decryption, both the national secret browser and the national secret gateway have the same session key. With a common session key, the national secret browser and the national secret gateway can use this session key to perform symmetric encryption communication verification. When the symmetric encryption communication verification passes, the pre-stored national secret algorithm suite and national secret certificate are used to establish a national secret transmission channel between the national secret browser and the national secret gateway and perform encrypted transmission. Among them, the symmetric encryption algorithm should also be a national secret algorithm (such as SM4). Throughout the process, the encryption algorithm is based on China's national cryptographic algorithm standard (SM algorithm), including public key encryption algorithm (SM2), symmetric encryption algorithm (SM4), etc. This communication process using national secret algorithms is designed to improve the security of data transmission, thereby achieving the confidentiality and integrity protection requirements of national secret transmission, and complying with China's cryptographic policy requirements.

[0040] It should be noted that although this process describes a communication process using a national secret algorithm, the specific implementation details (such as random value generation, session key generation algorithm, encryption and decryption process, etc.) may vary depending on different software implementations. In addition, with the development of technology and the update of standards, these algorithms and processes may also change, and this application does not make any restrictions on this.

[0041] In one embodiment of the invention, after establishing a national secret transmission channel with a national secret browser, the following steps are included: Based on the national secret transmission channel, the network traffic data is encrypted and transmitted using a third national secret algorithm.

[0042] Specifically, due to the high security and scalability of the SM9 algorithm, it can ensure the confidentiality and integrity of data. Based on the national secret transmission channel, the identity authentication and key negotiation functions of the SM9 algorithm are used to encrypt and transmit network traffic data, which can further enhance the security and reliability of data transmission and achieve the confidentiality and integrity protection requirements of national secret transmission.

[0043] S205: If the browser is a non-national secret browser, the network traffic data is transferred to the original domain name and the data is transmitted.

[0044] In step S205, when the browser is determined to be a non-national secret browser according to the User-Agent field, no redirection is performed, and the network traffic data is transferred to the original domain name and data is transmitted, thereby maintaining the stable operation of the system. It can be seen that as the national secret work is fully promoted, browsers will gradually be popularized, and application access will smoothly complete the national secret transmission switch, achieving the confidentiality and integrity protection requirements of the national secret transmission.

[0045] In summary, the present invention provides a method, device, equipment and medium for national secret transformation, which receives a login request message formed by a national secret gateway in response to a first connection request of a browser, wherein the login request message includes network traffic data, extracts a User-Agent field from the network traffic data, and judges whether the browser is a national secret browser according to the User-Agent field. If the browser is a national secret browser, the network traffic data is redirected to the national secret domain name through a preset rule, and the national secret domain name is sent to the national secret gateway so that the national secret gateway is bound to the national secret domain name, and a pre-stored national secret algorithm suite and a national secret certificate are used to establish a national secret transmission channel with the national secret browser for encrypted transmission. If the browser is a non-national secret browser, the network traffic data is transmitted to the original domain name, and data transmission is performed. It can be seen that the present application can meet both national secret requirements and non-national secret requirements, and can effectively solve the difficulties in national secret transformation in the current environment where national secret browsers are not yet popular, and reduce the risks and costs of national secret work.

[0046] See also Figure 3 , Figure 3 Schematic diagram of the structure of the national encryption transformation device provided by the embodiment of the present invention. In this embodiment, the terminal includes various units for executing Figure 2 For details, please refer to the steps in the corresponding embodiment. Figure 2as well as Figure 2 For the convenience of explanation, only the parts related to this embodiment are shown. Figure 3 The national encryption transformation device 30 includes: a receiving module 31, a judging module 32, a redirecting module 33, and an establishing module 34.

[0047] The receiving module 31 is used to receive a login request message formed by the national encryption gateway in response to the first connection request of the browser, wherein the login request message includes network traffic data; A judgment module 32 is used to extract a User-Agent field from the network traffic data, and judge whether the browser is a national security browser according to the User-Agent field; A redirection module 33, for redirecting the network traffic data to a national secret domain name according to preset rules if the browser is a national secret browser; Establish module 34, which is used to send the national secret domain name to the national secret gateway to bind the national secret gateway with the national secret domain name, and use the pre-stored national secret algorithm suite and national secret certificate to establish a national secret transmission channel with the national secret browser.

[0048] Optionally, the judgment module 32 is specifically used for: Parsing the network traffic data based on preset rules to obtain a User-Agent field; Determine the type and version information of the browser according to the User-Agent field; According to the type and version information of the browser, determine whether the browser is a national security browser.

[0049] Optionally, the establishment module 34 is specifically used for: Use the pre-stored national encryption algorithm suite and national encryption certificate to perform SSL handshake with the national encryption browser; During the SSL handshake, a first national secret algorithm is used as a symmetric encryption and decryption algorithm for the national secret certificate; A second national secret algorithm is used to perform a hash operation on the handshake data in the SSL handshake process, and the SSL handshake is completed to establish a national secret transmission channel.

[0050] Optionally, the establishment module 34 is further used for: A national secret authentication request is sent to the national secret browser, wherein the national secret authentication request includes a national secret certificate, a public key and a private key, so that the national secret browser verifies the national secret certificate based on a preset national secret algorithm library; If the verification is successful, the random value is encrypted using the public key to generate an encrypted random value; Sending the encrypted random value to the national secret gateway, so that the national secret gateway uses the private key to decrypt the encrypted random value to generate a session key, and encrypts the session key to generate an encrypted session key; Sending the encrypted session key to the national secret browser, so that the national secret browser uses the random value to decrypt the encrypted session key and extract the session key; The session key is subjected to symmetric encryption communication verification, and when the symmetric encryption communication verification passes, the SSL handshake is completed to establish a national secret transmission channel.

[0051] Optionally, the establishment module 34 is specifically used to: Based on the national secret transmission channel, the network traffic data is encrypted and transmitted using a third national secret algorithm.

[0052] It should be noted that the information interaction, execution process and other contents between the above-mentioned units are based on the same concept as the embodiment of the method of the present invention. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0053] Figure 4 Schematic diagram of the structure of a computer device provided by an embodiment of the present invention. Figure 4 As shown, the computer device of this embodiment includes: at least one processor ( Figure 4 Only one is shown), a memory, and a computer program stored in the memory and executable on at least one processor. When the processor executes the computer program, the steps in any of the above-mentioned national secret transformation method embodiments are implemented.

[0054] The computer device may include, but is not limited to, a processor and a memory. Those skilled in the art will appreciate that Figure 4 These are merely examples of computer devices and do not constitute limitations on the computer devices. The computer devices may include more or fewer components than those shown in the figure, or a combination of certain components, or different components. For example, they may also include a network interface, a display screen, and an input system.

[0055] In one embodiment, a computer-readable storage medium is provided. When the instructions in the computer-readable storage medium are executed by a processor in a computer device, the computer device can perform the steps of any embodiment of a national secret transformation method disclosed in the present invention, which will not be repeated here. The computer-readable storage medium can be non-volatile or volatile.

[0056] The processor may be a CPU, or other general-purpose processors, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0057] The memory includes a readable storage medium, an internal memory, etc., wherein the internal memory may be the memory of a computer device, and the internal memory provides an environment for the operation of the operating system and computer-readable instructions in the readable storage medium. The readable storage medium may be a hard disk of a computer device, and in other embodiments, it may also be an external storage device of the computer device, for example, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the computer device. Further, the memory may also include both an internal storage unit of the computer device and an external storage device. The memory is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as the program code of a computer program, etc. The memory may also be used to temporarily store data that has been output or is to be output.

[0058] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0059] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the system is divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically alone, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the above-mentioned method embodiment, which will not be repeated here. If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.

[0060] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A national secret transformation method, characterized in that: include: Receiving a login request message formed by the national encryption gateway in response to the first connection request of the browser, wherein the login request message includes network traffic data; Extracting a User-Agent field from the network traffic data, and determining whether the browser is a national security browser based on the User-Agent field; If the browser is a national secret browser, the network traffic data is redirected to the national secret domain name according to preset rules; The national secret domain name is sent to the national secret gateway to bind the national secret gateway with the national secret domain name, and a pre-stored national secret algorithm suite and national secret certificate are used to establish a national secret transmission channel with the national secret browser.

2. The national secret transformation method according to claim 1 is characterized in that: Also includes: If the browser is a non-national secret browser, the network traffic data is transferred to the original domain name and the data is transmitted.

3. The national secret transformation method according to claim 1 is characterized in that: The extracting the User-Agent field from the network traffic data and judging whether the browser is a national security browser according to the User-Agent field includes: Parsing the network traffic data based on preset rules to obtain a User-Agent field; Determine the type and version information of the browser according to the User-Agent field; According to the type and version information of the browser, determine whether the browser is a national security browser.

4. The national secret transformation method according to claim 1 is characterized in that: The method of using the pre-stored national encryption algorithm suite and the national encryption certificate to establish a national encryption transmission channel with the national encryption browser includes: Use the pre-stored national encryption algorithm suite and national encryption certificate to perform SSL handshake with the national encryption browser; During the SSL handshake, a first national secret algorithm is used as a symmetric encryption and decryption algorithm for the national secret certificate; A second national secret algorithm is used to perform a hash operation on the handshake data in the SSL handshake process, and the SSL handshake is completed to establish a national secret transmission channel.

5. The national secret transformation method according to claim 4 is characterized in that: Before completing the SSL handshake to establish the national secret transmission channel, it includes: A national secret authentication request is sent to the national secret browser, wherein the national secret authentication request includes a national secret certificate, a public key and a private key, so that the national secret browser verifies the national secret certificate based on a preset national secret algorithm library; If the verification is successful, the random value is encrypted using the public key to generate an encrypted random value; Sending the encrypted random value to the national secret gateway so that the national secret gateway uses the private key to decrypt the encrypted random value to generate a session key, and encrypts the session key to generate an encrypted session key; Sending the encrypted session key to the national secret browser so that the national secret browser decrypts the encrypted session key using the random value to extract the session key; The session key is subjected to symmetric encryption communication verification, and when the symmetric encryption communication verification passes, the step of completing the SSL handshake to establish a national encryption transmission channel is executed.

6. The national secret transformation method according to claim 1 is characterized in that: After the national secret transmission channel with the national secret browser is established, it includes: Based on the national secret transmission channel, the network traffic data is encrypted and transmitted using a third national secret algorithm.

7. A national secret transformation device, characterized in that: include: A receiving module, used to receive a login request message formed by the national encryption gateway in response to the first connection request of the browser, wherein the login request message includes network traffic data; A judgment module, used to extract the User-Agent field from the network traffic data, and judge whether the browser is a national secret browser according to the User-Agent field; A redirection module, for redirecting the network traffic data to a national secret domain name according to preset rules if the browser is a national secret browser; A module is established, which is used to send the national secret domain name to the national secret gateway so that the national secret gateway is bound to the national secret domain name, and a pre-stored national secret algorithm suite and national secret certificate are used to establish a national secret transmission channel with the national secret browser.

8. The national secret transformation device according to claim 1 is characterized in that: The judging module further includes: Parsing the network traffic data based on preset rules to obtain a User-Agent field; Determine the type and version information of the browser according to the User-Agent field; According to the type and version information of the browser, determine whether the browser is a national security browser.

9. A computer device, characterized in that: The computer device includes a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the national encryption transformation method as described in any one of claims 1 to 6 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the national encryption transformation method as described in any one of claims 1 to 6 is implemented.

Images