Communication method and device, gateway equipment, system and medium

Abstract

The invention provides a communication method and device, gateway equipment, a system and a medium, and relates to the field of network communication, the method is applied to the gateway equipment, and the method comprises the following steps: receiving a request message sent by a client, and extracting a server resource address requested to be accessed by the client from the request message; according to the server resource address and a corresponding server, performing a national secret SSL negotiation process, and determining a national secret SSL negotiation parameter with the server; generating an encrypted request message by using the national secret SSL negotiation parameter and the server resource address, and sending the encrypted request message to the server; receiving an encrypted response message sent by the server, and decrypting the encrypted response message by using the national secret SSL parameter to obtain resource data corresponding to the resource address of the server; packaging the resource data into a response message, and sending the response message to the client; according to the invention, the gateway equipment can provide the national secret SSL proxy service for the client, so that the convenience of accessing national secret network resources by a user can be improved.

Description

Technical Field

[0001] The present invention relates to the field of network communications, and in particular to a communication method, device, gateway equipment, system and medium. Background Art

[0002] With the gradual promotion of the national encryption algorithm, more and more network applications on the market choose to use the national encryption algorithm for encryption, and the typical application is daily web browsing. However, there are currently few browsers that support the national encryption algorithm, which are expensive and not very user-friendly, resulting in users having to pay a lot of costs when accessing network resources that use the national encryption algorithm for transmission encryption. Summary of the invention

[0003] The purpose of the present invention is to provide a communication method, device, gateway device, system and medium, which can provide national secret SSL proxy service for the client based on the gateway device, and can improve the convenience when the user accesses the network resources that adopt the national secret algorithm for transmission encryption.

[0004] In order to solve the above technical problems, the present invention provides a communication method, which is applied to a gateway device, and the method comprises:

[0005] Receive a request message sent by a client, and extract from the request message an address of a server resource that the client requests to access;

[0006] Perform the national secret SSL negotiation process with the corresponding server according to the server resource address, and determine the national secret SSL negotiation parameters between the server and the server;

[0007] Generate an encrypted request message using the national encryption SSL negotiation parameters and the server resource address, and send the encrypted request message to the server;

[0008] Receive the encrypted response message sent by the server, decrypt the encrypted response message using the national secret SSL parameter, and obtain resource data corresponding to the resource address of the server;

[0009] The resource data is encapsulated into a response message, and the response message is sent to the client.

[0010] Optionally, before receiving the request message sent by the client, the method further includes:

[0011] Receiving an international SSL negotiation request sent by the client, and performing an international SSL negotiation process with the client to determine international SSL negotiation parameters between the client and the client;

[0012] The step of extracting the server resource address requested to be accessed by the client from the client request message includes:

[0013] Decrypting the request message according to the international SSL negotiation parameters, and extracting the server resource address from the decrypted request message;

[0014] The encapsulating the resource data into a response message and sending the response message to the client includes:

[0015] The resource data is encapsulated into a response message according to the international SSL negotiation parameters, and the response message is sent to the client.

[0016] Optionally, before performing the national encryption SSL negotiation process with the corresponding server according to the server resource address, it also includes:

[0017] Verify the server resource address to determine whether the server resource address is correct;

[0018] If it is correct, then enter the step of performing the national encryption SSL negotiation process with the corresponding server according to the server resource address;

[0019] If it is incorrect, an error response message indicating that the server resource address is incorrect is generated, and the error response message is sent to the client.

[0020] Optionally, before encapsulating the resource data into a response message, the method further includes:

[0021] Verifying the resource data to determine whether the resource data is complete;

[0022] If the resource data is complete, the step of encapsulating the resource data into a response message is entered;

[0023] If the resource data is incomplete, requesting the server to resend the resource data;

[0024] Upon receiving the resent resource data, determining whether the resent resource data is complete;

[0025] If the resent resource data is complete, entering the step of encapsulating the resource data into a response message;

[0026] If the resent resource data is incomplete, an error response message indicating a package assembly error is generated and the error response message is sent to the client.

[0027] Optionally, the receiving a request message sent by the client includes:

[0028] Configure a public port and listen to the public port;

[0029] The request message sent by the client is received through the public port.

[0030] Optionally, it also includes:

[0031] Creating a first structure corresponding to the client and a second structure corresponding to the server in memory;

[0032] Creating a first pointer pointing to a memory address of the second structure in the first structure, and creating a second pointer pointing to the memory address of the first structure in the second structure;

[0033] The extracting the server resource address requested to be accessed by the client from the request message includes:

[0034] Adding the request message to the first structure, and parsing the request message in the first structure to obtain the server resource address;

[0035] Add the server resource address to the second structure through the first pointer;

[0036] The step of generating an encrypted request message by using the national encryption SSL negotiation parameters and the server resource address includes:

[0037] Add the national encryption SSL negotiation parameters to the second structure;

[0038] In the second structure, an encrypted request message is generated using the national encryption SSL negotiation parameters and the server resource address;

[0039] The method of decrypting the encrypted response message using the national secret SSL parameter to obtain resource data corresponding to the server resource address includes:

[0040] Adding the encrypted response message to the second structure;

[0041] In the second structure, the encrypted response message is decrypted using the national secret SSL parameter to obtain resource data corresponding to the server resource address;

[0042] Add the resource data to the first structure through the second pointer;

[0043] The encapsulating the resource data into a response message and sending the response message to the client includes:

[0044] The resource data is encapsulated as a response message in the first structure, and the response message is sent to the client.

[0045] The present invention also provides a communication device, applied to a gateway device, the device comprising:

[0046] A first receiving module is used to receive a request message sent by a client, and extract from the request message an address of a server resource that the client requests to access;

[0047] The national secret SSL negotiation module is used to perform the national secret SSL negotiation process with the corresponding server according to the server resource address, and determine the national secret SSL negotiation parameters between the server and the server;

[0048] A first sending module, used to generate an encryption request message using the national encryption SSL negotiation parameters and the server resource address, and send the encryption request message to the server;

[0049] The second receiving module is used to receive the encrypted response message sent by the server, decrypt the encrypted response message using the national secret SSL parameter, and obtain resource data corresponding to the resource address of the server;

[0050] The second sending module is used to encapsulate the resource data into a response message and send the response message to the client.

[0051] The present invention also provides a gateway device, comprising:

[0052] Memory for storing computer programs;

[0053] A processor is used to implement the communication method as described above when executing the computer program.

[0054] The present invention also provides a communication system, comprising:

[0055] A gateway device, used to execute the communication method as described above;

[0056] A client, used to send a request message to the gateway device; and receive a response message sent by the gateway device;

[0057] The server is used to perform the national encryption SSL negotiation process with the gateway device; receive the encrypted request message sent by the gateway device; and send an encrypted response message to the gateway device.

[0058] The present invention also provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are loaded and executed by a processor, the communication method as described above is implemented.

[0059] The present invention provides a communication method, which is applied to a gateway device. The method comprises: receiving a request message sent by a client, and extracting a server resource address that the client requests to access from the request message; performing a national secret SSL negotiation process with a corresponding server according to the server resource address, and determining national secret SSL negotiation parameters with the server; generating an encrypted request message using the national secret SSL negotiation parameters and the server resource address, and sending the encrypted request message to the server; receiving an encrypted response message sent by the server, and decrypting the encrypted response message using the national secret SSL parameters to obtain resource data corresponding to the server resource address; encapsulating the resource data into a response message, and sending the response message to the client.

[0060] It can be seen that in the present invention, the client can send a request message containing the server resource address to the gateway device. When the gateway device receives the request message, it can extract the server resource address, and perform the national secret SSL negotiation process with the corresponding server according to the server resource address, and determine the national secret SSL negotiation parameters between the server and the server. Subsequently, the gateway device can generate an encrypted request message using the national secret SSL negotiation parameters and the server resource address, and send the encrypted request message to the server, so as to proxy the client to request the server resource based on the national secret SSL encryption from the server; subsequently, the gateway device can receive the encrypted response message sent by the server, and use the national secret SSL parameters to decrypt the encrypted response message, obtain the resource data corresponding to the server resource address, and then encapsulate the resource data into a response message, and send the response message to the client. In this way, the present invention can provide the client with a national secret SSL proxy service based on the gateway device, avoid complex adaptation work in the client, and thus improve the convenience when the user accesses the network resources that are encrypted by the national secret algorithm. The present invention also provides a communication device, a gateway device, a communication system and a computer-readable storage medium, which have the above-mentioned beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0062] Figure 1 A flow chart of a communication method provided by an embodiment of the present invention;

[0063] Figure 2 A flow chart of a resource request provided by an embodiment of the present invention;

[0064] Figure 3 A flow chart of resource return provided by an embodiment of the present invention;

[0065] Figure 4 A structural block diagram of a communication device provided by an embodiment of the present invention;

[0066] Figure 5 A structural block diagram of a gateway device provided by an embodiment of the present invention;

[0067] Figure 6 A structural block diagram of a communication system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0068] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0069] In the field of encryption, common national encryption algorithms can be SM2, SM3, SM4, etc. With the gradual promotion of national encryption algorithms, more and more network applications on the market choose to use national encryption algorithms for encryption. For example, in daily web browsing, the client can use the national encryption algorithm to establish an SSL connection (Secure Socket Layer) with the server to encrypt the HTTP messages transmitted between the client and the server based on the national encryption algorithm and the national encryption HTTPS protocol. The SSL connection established using the national encryption algorithm can be called a national encryption SSL connection, and the HTTP protocol based on the national encryption SSL connection can be called a national encryption HTTPS protocol. However, there are currently few browsers that support the national encryption algorithm, which are expensive and not very user-friendly, resulting in users having to pay a lot of costs when accessing network resources that use the national encryption algorithm for transmission encryption.

[0070] In view of this, in order to solve the technical problem of how users can conveniently access network resources that are encrypted using the national secret algorithm for transmission, the present invention can provide a communication method that can provide the client with the national secret SSL proxy service based on the gateway device, thereby improving the convenience of users accessing network resources encrypted using the national secret algorithm.

[0071] For easier understanding, please refer to Figure 1 , Figure 1 The present invention provides a flow chart of a communication method. The method is applied to a gateway device, and the gateway device is arranged between a client and a server. The method may include:

[0072] S101, receiving a request message sent by a client, and extracting from the request message an address of a server resource that the client requests to access.

[0073] In this embodiment, the gateway device can provide the client with a national SSL proxy service. In other words, the gateway device can establish a national SSL connection with the server on behalf of the client, and perform resource data transmission with the server based on the national SSL connection. Therefore, in this step, when the client needs to access the server resources, it can generate a request message containing the server resource address to be accessed, and send the request message to the gateway device to inform the gateway device which resources in which server need to be accessed.

[0074] Furthermore, to facilitate receiving request messages, the gateway device can configure a public port and monitor the port. The client can send a request message to the gateway device according to the IP address and public port number of the gateway device, and the gateway device can receive the request message sent by the client through the public port.

[0075] Based on this, the receiving of the request message sent by the client may include:

[0076] Step 11: Configure a public port and monitor the public port;

[0077] Step 12: Receive the request message sent by the client through the public port.

[0078] Furthermore, this embodiment does not limit the transmission form of the request message, which can be set according to the transmission protocol between the client and the gateway device. For example, when the HTTP protocol is used between the client and the gateway device, the request message can be a plaintext HTTP message and is transmitted in plaintext form; when the international HTTPS protocol is used between the client and the gateway device, the request message can be an HTTP message encrypted based on an international SSL connection and is transmitted in an encrypted form. Among them, the international SSL connection is an SSL connection constructed based on an international general encryption algorithm (such as the RSA asymmetric encryption algorithm).

[0079] Furthermore, the client may set the gateway device as a proxy server or not, and the setting may be made according to usage requirements.

[0080] S102: Perform the national encryption SSL negotiation process with the corresponding server according to the server resource address, and determine the national encryption SSL negotiation parameters between the server and the server.

[0081] In this step, the gateway device can conduct a national secret SSL negotiation process with the server, determine the national secret SSL negotiation parameters with the server, and establish a national secret SSL connection with the server. Among them, the national secret SSL negotiation parameters refer to the negotiation parameters obtained through negotiation with the server and necessary for national secret SSL communication, such as keys. It is worth pointing out that the gateway device can conduct a national secret SSL negotiation process with the server based on its own information (such as IP address) without using client information, which can effectively hide client information.

[0082] It should be noted that this embodiment does not limit the specific process of the national encryption SSL negotiation process, nor does it limit the specific national encryption SSL negotiation parameters. Please refer to the relevant technologies of SSL negotiation and national encryption.

[0083] Furthermore, in order to detect the correctness of the server resource address, the gateway device can also verify the server resource address and determine whether the server resource address is correct. If it is correct, the national secret SSL negotiation process can be carried out with the server. If it is wrong, an error response message indicating that the server resource address is incorrect can be generated and sent to the client.

[0084] Based on this, before performing the national encryption SSL negotiation process with the corresponding server according to the server resource address, it can also include:

[0085] Step 21: Verify the server resource address to determine whether the server resource address is correct; if correct, proceed to step 22; if incorrect, proceed to step 23;

[0086] Step 22: Enter the step of performing the national encryption SSL negotiation process with the corresponding server according to the server resource address;

[0087] Step 23: Generate an error response message indicating that the server resource address is incorrect, and send the error response message to the client.

[0088] It should be noted that this embodiment does not limit how the gateway device verifies the server resource address. For example, the gateway device may perform DNS domain name resolution (Domain Name System) based on the server resource address, and determine whether the server resource address is correct based on the resolution result; for another example, a server resource address list may be set in the gateway device, and the server resource address requested by the client to be accessed may be verified using the list.

[0089] S103: Generate an encryption request message using the national encryption SSL negotiation parameters and the server resource address, and send the encryption request message to the server.

[0090] In this step, the gateway device can request resources from the server on behalf of the client. Specifically, the gateway device can use the negotiated national secret SSL negotiation parameters and the server resource address to generate an encrypted request message, and send the encrypted request message to the server, so that the server obtains the corresponding resource data according to the server resource address and returns it. Among them, the encrypted request message is an HTTP message encrypted using the national secret algorithm. It is worth pointing out that the gateway device can request resources from the server based on its own information (such as IP address) without using client information, so it can effectively hide client information.

[0091] S104, receiving the encrypted response message sent by the server, decrypting the encrypted response message using the national secret SSL parameters, and obtaining resource data corresponding to the resource address of the server.

[0092] S105: Encapsulate the resource data into a response message, and send the response message to the client.

[0093] In steps S104 to S105, when the gateway device receives the encrypted response message returned by the server, it can use the national secret SSL parameters to decrypt the encrypted response message to obtain the resource data corresponding to the resource address of the server. Subsequently, the gateway device can repackage the resource data according to the message format requested by the client to obtain a response message, and send the response message to the client. For example, when the HTTP protocol is used between the gateway device and the client, the resource data can be repackaged into a plaintext HTTP message and returned; when the international HTTPS protocol is used between the gateway device and the client, the resource data can be repackaged into an encrypted HTTP message and returned.

[0094] Of course, to ensure that the data is correct, the gateway device can also verify the integrity of the resource data. If the resource data is complete, the resource data can be returned to the client. If the resource data is incomplete, the resource data can be re-requested from the server. The gateway device can also verify the integrity of the resent resource data. If the resent resource data is complete, the resource data can be returned to the client. If the resent resource data is incomplete, an error response message indicating a package assembly error can be generated and sent to the client.

[0095] Based on this, before encapsulating the resource data into a response message, the following may also be included:

[0096] Step 31: verify the resource data to determine whether the resource data is complete; if the resource data is complete, proceed to step 32; if the resource data is incomplete, proceed to step 33;

[0097] Step 32: Entering the step of encapsulating the resource data into a response message;

[0098] Step 33: Request the server to resend the resource data;

[0099] Step 34: upon receiving the resent resource data, determining whether the resent resource data is complete; if the resent resource data is complete, proceeding to step 32; if the resent resource data is incomplete, proceeding to step 35;

[0100] Step 35: Generate an error response message indicating a package assembly error, and send the error response message to the client.

[0101] Based on the above embodiments, in the present invention, the client can send a request message containing a server resource address to a gateway device. When the gateway device receives the request message, it can extract the server resource address, and perform a national secret SSL negotiation process with the corresponding server according to the server resource address, and determine the national secret SSL negotiation parameters between the server and the server. Subsequently, the gateway device can generate an encrypted request message using the national secret SSL negotiation parameters and the server resource address, and send the encrypted request message to the server, so as to proxy the client to request the server resources based on the national secret SSL encryption from the server; subsequently, the gateway device can receive the encrypted response message sent by the server, and use the national secret SSL parameters to decrypt the encrypted response message, obtain the resource data corresponding to the server resource address, and then encapsulate the resource data into a response message, and send the response message to the client. In this way, the present invention can provide a national secret SSL proxy service for the client based on the gateway device, avoid complex adaptation work in the client, and thus improve the convenience when the user accesses the network resources that are encrypted by the national secret algorithm.

[0102] Based on the above embodiment, in order to further improve the communication security between the client and the gateway device, an international SSL connection can be established between the client and the gateway device, and data transmission is performed based on the international SSL connection. This situation is introduced below. Based on this, the method can also include:

[0103] S201, receiving an international SSL negotiation request sent by the client, and performing an international SSL negotiation process with the client to determine international SSL negotiation parameters with the client.

[0104] In this embodiment, since common browser clients usually support the international SSL protocol, the client can establish an international SSL connection with the gateway device to ensure data transmission security. Specifically, the gateway device receives the international SSL negotiation request sent by the client, performs the international SSL negotiation process with the client, determines the international SSL negotiation parameters with the client, and establishes the international SSL connection with the client.

[0105] It can be seen that the gateway device can establish an international SSL connection with the client, and can establish a national SSL connection with the server. It should be noted that the above international SSL connection and national SSL connection are not related, and the gateway device can establish the above connection with the client and the server separately.

[0106] S202: Receive a request message sent by the client, decrypt the request message according to the international SSL negotiation parameters, and extract the server resource address that the client requests to access from the decrypted request message.

[0107] In this embodiment, the client can send an encrypted request message to the gateway device based on the international SSL connection. When the gateway device receives the request message sent by the client, it can decrypt the request message according to the international SSL negotiation parameters and extract the server resource address that the client requests to access from the decrypted request message.

[0108] S203: Perform the national encryption SSL negotiation process with the corresponding server according to the server resource address, and determine the national encryption SSL negotiation parameters with the server.

[0109] S204: Generate an encryption request message using the national encryption SSL negotiation parameters and the server resource address, and send the encryption request message to the server.

[0110] S205. Receive the encrypted response message sent by the server, decrypt the encrypted response message using the national secret SSL parameters, and obtain resource data corresponding to the resource address of the server.

[0111] S206. Encapsulate the resource data into a response message according to the international SSL negotiation parameters, and send the response message to the client.

[0112] In this embodiment, the gateway device can return resource data to the client based on the international SSL connection. Specifically, the gateway device encapsulates the resource data into an encrypted response message based on the international SSL negotiation parameters between the gateway device and the client, and sends the response message to the client. The client will decrypt the response message according to the international SSL negotiation parameters to obtain the resource data.

[0113] Based on the above embodiment, in order to improve the internal processing efficiency, the gateway device can create corresponding structures for the client and the server in the local memory, and use memory pointers to associate the structures to process the data transmission between the client and the server based on these structures. The function and creation method of the structure are introduced below. Based on this, the method can also include:

[0114] S301, creating a first structure corresponding to the client and a second structure corresponding to the server in a memory;

[0115] S302: Create a first pointer pointing to the memory address of the second structure in the first structure, and create a second pointer pointing to the memory address of the first structure in the second structure.

[0116] In this embodiment, the gateway device can create a first structure corresponding to the client in the memory, and create a second structure corresponding to the server. In addition, a first pointer pointing to the memory address of the second structure can be created in the first structure, and a second pointer pointing to the memory address of the first structure can be created in the second structure. In this way, client information can be stored and processed in the first structure, such as storing international SSL negotiation data negotiated with the client, request messages sent by the client, etc., and processing the parsing of request messages and repackaging of resource data. In addition, service information can also be stored and processed in the second structure, such as storing national secret SSL negotiation data negotiated with the server, and processing the encrypted encapsulation of encrypted request data and the decryption of encrypted response data. In addition, pointers in the two structures can also be used to transfer data between the two structures, such as transferring the server resource address to the second structure through the first pointer in the first structure, and transferring resource data to the first structure through the second pointer in the second structure. In this way, the storage and processing of related data can be standardized, and the internal processing efficiency of the gateway device can be improved at the same time.

[0117] The following is an introduction to the specific process of the gateway device processing data transmission between the client and the server based on the structure. Based on this, the method may also include:

[0118] S401. Receive a request message sent by a client, add the request message to the first structure, and parse the request message in the first structure to obtain a server resource address that the client requests to access.

[0119] S402: Add the server resource address to the second structure through the first pointer.

[0120] In steps S401 and S402, the request message sent by the client can be written into the first structure, and the request message is parsed in the first structure, such as parsing the request message according to the international SSL negotiation parameters between the client and the client to obtain the server resource address requested by the client. Subsequently, the server resource address can be moved to the second structure through the first pointer in the first structure.

[0121] S403: Perform the national encryption SSL negotiation process with the corresponding server according to the server resource address, and determine the national encryption SSL negotiation parameters between the server and the server.

[0122] S404: Add the national encryption SSL negotiation parameters to the second structure.

[0123] S405: Generate an encryption request message in the second structure using the national encryption SSL negotiation parameters and the server resource address, and send the encryption request message to the server.

[0124] In steps S404 and S405, the national encryption SSL negotiation parameters with the server can be written into the second structure, and the national encryption SSL negotiation parameters and the server resource address can be used in the second structure to generate an encrypted request message, and then the encrypted request message can be sent to the server.

[0125] S406: Receive the encrypted response message sent by the server, and add the encrypted response message to the second structure.

[0126] S407. Decrypt the encrypted response message using the national secret SSL parameters in the second structure to obtain resource data corresponding to the server resource address.

[0127] S408. Add the resource data to the first structure through the second pointer.

[0128] In steps S406-S408, the encrypted response message sent by the server can be written into the second structure, and the encrypted response message can be parsed in the second structure to obtain resource data. Subsequently, the resource data can be moved to the first structure through the second pointer in the second structure.

[0129] S409: Encapsulate the resource data into a response message in the first structure, and send the response message to the client.

[0130] In this step, the resource data is encapsulated as a response message in the first structure, such as encapsulating the resource data as an encrypted response message according to the international SSL negotiation parameters between the client and the client. Subsequently, the response message can be returned to the client.

[0131] Based on the above embodiment, the above communication method is fully introduced below based on a specific schematic diagram. Figure 2 and Figure 3 , Figure 2 A flowchart of a resource request provided by an embodiment of the present invention, Figure 3 A flowchart of a resource return provided by an embodiment of the present invention. The method specifically includes:

[0132] 1. Send the client's data to the proxy service in the gateway device. The proxy service performs corresponding data processing and converts it into the IP address of the actual resource to be accessed based on the client's access address. During this period, the address accessed by the client can be verified, and an error message is returned to the client when it is determined that the client's access address is unreasonable; in addition, some data header information can be added and some header information can be repaired according to the client's requirements to better hide the client information.

[0133] 2. When receiving the request from the client, parse the address that needs to be accessed, and initiate a national secret SSL negotiation request with the remote real national secret resource end based on its address.

[0134] 3. After the client data is completely encapsulated, a national seal packaging request is sent to the remote resource end through the result negotiated in the previous second step, and the remote resource sends the request resource result.

[0135] 4. According to the negotiation result in the second step, the remote resource end key is used to decrypt the requested resource data sent by the server. After the decryption is successful, the data is sent to the client to complete the forward national secret proxy access. During this period, the resource data can be checked for integrity. If it is incomplete, the resource end can be requested to resend it.

[0136] In the above process, the gateway device can use two peer structures, one for the client and one for the server. When the two structures are established, a strong binding relationship is generated and the internal relationship pointers point to each other's memory address. The cache data structures in the two structures A and B are used to store the data that each needs to process. The client information is collected and stored in the A structure, and the processed data A is transferred to another structure B to continue to process the encrypted data with the national secret algorithm at high speed. After the processing is completed, it is sent to the remote server through the network transmission through the maintained link information. Conversely, after obtaining the data from the remote server, it is cached locally in the strongly bound structure B. After the data is processed from B, the data is transferred to the structure A through the pointer of the structure A that stores the strong binding relationship in the structure. After the encrypted data is processed in A into HTTP plain text or HTTPS international ciphertext, the data is sent to the client through the network through the maintained link information to complete the data transmission.

[0137] The communication device, gateway device, communication system, computer program product, and computer-readable storage medium provided in the embodiments of the present invention are introduced below. The communication device, gateway device, communication system, computer program product, and computer-readable storage medium described below can be referenced to each other with the communication method described above.

[0138] Please refer to Figure 4 , Figure 4 A structural block diagram of a communication device provided by an embodiment of the present invention, which is applied to a gateway device, may include:

[0139] The first receiving module 401 is used to receive a request message sent by a client, and extract from the request message an address of a server resource that the client requests to access;

[0140] The national SSL negotiation module 402 is used to perform the national SSL negotiation process with the corresponding server according to the server resource address, and determine the national SSL negotiation parameters between the server and the server;

[0141] The first sending module 403 is used to generate an encryption request message using the national encryption SSL negotiation parameters and the server resource address, and send the encryption request message to the server;

[0142] The second receiving module 404 is used to receive the encrypted response message sent by the server, decrypt the encrypted response message using the national secret SSL parameter, and obtain resource data corresponding to the resource address of the server;

[0143] The second sending module 405 is used to encapsulate the resource data into a response message and send the response message to the client.

[0144] Optionally, the device may further include:

[0145] An international SSL negotiation module, used for receiving an international SSL negotiation request sent by the client, and performing an international SSL negotiation process with the client to determine international SSL negotiation parameters with the client;

[0146] The first receiving module 401 may include:

[0147] An international SSL decryption submodule, used to decrypt the request message according to the international SSL negotiation parameters, and extract the server resource address from the decrypted request message;

[0148] The second sending module 405 may include:

[0149] The international SSL encryption submodule is used to encapsulate the resource data into a response message according to the international SSL negotiation parameters, and send the response message to the client.

[0150] Optionally, the device may further include:

[0151] The address verification module is used to verify the server resource address and determine whether the server resource address is correct; if correct, enter the step of performing the national encryption SSL negotiation process with the corresponding server based on the server resource address; if incorrect, generate an error response message indicating that the server resource address is incorrect, and send the error response message to the client.

[0152] Optionally, the device may further include:

[0153] A resource data verification module, used to verify the resource data and determine whether the resource data is complete; if the resource data is complete, then enter the step of encapsulating the resource data into a response message; if the resource data is incomplete, then request the server to resend the resource data;

[0154] The resource data duplication verification module is used to determine whether the resent resource data is complete when receiving the resent resource data; if the resent resource data is complete, enter the step of encapsulating the resource data into a response message; if the resent resource data is incomplete, generate an error response message indicating a package error, and send the error response message to the client.

[0155] Optionally, the first receiving module 401 may include:

[0156] A configuration submodule, used to configure a public port and monitor the public port;

[0157] The receiving submodule is used to receive the request message sent by the client through the common port.

[0158] Optionally, the device may further include:

[0159] A structure creation module, used to create a first structure corresponding to the client and a second structure corresponding to the server in a memory;

[0160] A pointer creation module, used to create a first pointer pointing to the memory address of the second structure in the first structure, and to create a second pointer pointing to the memory address of the first structure in the second structure;

[0161] The first receiving module 401 may include:

[0162] A first parsing submodule, used for adding the request message to the first structure, and parsing the request message in the first structure to obtain the server resource address;

[0163] A first moving submodule, used for adding the server resource address to the second structure through the first pointer;

[0164] The first sending module 403 may include:

[0165] A first adding submodule, used for adding the national encryption SSL negotiation parameters to the second structure;

[0166] A first encapsulation submodule, used to generate an encrypted request message in the second structure using the national encryption SSL negotiation parameters and the server resource address;

[0167] The second receiving module 404 may include:

[0168] A second adding submodule, used for adding the encrypted response message to the second structure;

[0169] A decryption submodule, used to decrypt the encrypted response message using the national secret SSL parameters in the second structure to obtain resource data corresponding to the server resource address;

[0170] A second moving submodule, used for adding the resource data to the first structure through the second pointer;

[0171] The second sending module 405 may include:

[0172] The second encapsulation submodule is used to encapsulate the resource data into a response message in the first structure, and send the response message to the client.

[0173] Please refer to Figure 5 , Figure 5 This is a structural block diagram of a gateway device provided in an embodiment of the present invention. The embodiment of the present invention provides a gateway device 10, including a processor 11 and a memory 12; wherein the memory 12 is used to store a computer program; and the processor 11 is used to execute the communication method provided in the aforementioned embodiment when executing the computer program.

[0174] For the specific process of the above communication method, please refer to the corresponding content provided in the above embodiments, which will not be repeated here.

[0175] Furthermore, the memory 12 as a carrier for storing resources may be a read-only memory, a random access memory, a magnetic disk or an optical disk, etc., and the storage method may be temporary storage or permanent storage.

[0176] In addition, the gateway device 10 also includes a power supply 13, a communication interface 14, an input / output interface 15 and a communication bus 16; wherein the power supply 13 is used to provide working voltage for each hardware device on the gateway device 10; the communication interface 14 can create a data transmission channel between the gateway device 10 and external devices, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present invention, and is not specifically limited here; the input / output interface 15 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0177] The embodiment of the present invention further provides a communication system, which may include:

[0178] A gateway device, used to execute the communication method as described above;

[0179] A client, used to send a request message to the gateway device; and receive a response message sent by the gateway device;

[0180] The server is used to perform the national encryption SSL negotiation process with the gateway device; receive the encrypted request message sent by the gateway device; and send an encrypted response message to the gateway device.

[0181] For easier understanding, please refer to Figure 6 , Figure 6 This is a structural block diagram of a communication system provided by an embodiment of the present invention, where a gateway device can be shared by multiple clients. Since the embodiments of the communication system part correspond to the embodiments of the communication method part, the embodiments of the communication system part refer to the description of the embodiments of the communication method part, and will not be repeated here.

[0182] An embodiment of the present invention further provides a computer program product, including a computer program / instruction, wherein the computer program / instruction implements the communication method described in the above embodiment when executed by a processor.

[0183] Since the embodiments of the computer program product part correspond to the embodiments of the communication method part, please refer to the description of the embodiments of the communication method part for the embodiments of the computer program product part, which will not be repeated here.

[0184] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the communication method described in the above embodiment is implemented.

[0185] Since the embodiments of the computer-readable storage medium part correspond to the embodiments of the communication method part, the embodiments of the storage medium part refer to the description of the embodiments of the communication method part and will not be repeated here.

[0186] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0187] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0188] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0189] The above is a detailed introduction to a communication method, device, gateway device, system and medium provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present invention, several improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the scope of protection of the present invention.

Claims

1. A communication method, characterized in that: Applied to a gateway device, the method comprises: Receive a request message sent by a client, and extract from the request message an address of a server resource that the client requests to access; Perform the national secret SSL negotiation process with the corresponding server according to the server resource address, and determine the national secret SSL negotiation parameters between the server and the server; Generate an encrypted request message using the national encryption SSL negotiation parameters and the server resource address, and send the encrypted request message to the server; Receive the encrypted response message sent by the server, decrypt the encrypted response message using the national secret SSL parameter, and obtain resource data corresponding to the resource address of the server; The resource data is encapsulated into a response message, and the response message is sent to the client.

2. The communication method according to claim 1, characterized in that: Before receiving the request message sent by the client, it also includes: Receiving an international SSL negotiation request sent by the client, and performing an international SSL negotiation process with the client to determine international SSL negotiation parameters between the client and the client; The step of extracting the server resource address requested to be accessed by the client from the client request message includes: Decrypting the request message according to the international SSL negotiation parameters, and extracting the server resource address from the decrypted request message; The encapsulating the resource data into a response message and sending the response message to the client includes: The resource data is encapsulated into a response message according to the international SSL negotiation parameters, and the response message is sent to the client.

3. The communication method according to claim 2, characterized in that: Before performing the national secret SSL negotiation process with the corresponding server according to the server resource address, it also includes: Verify the server resource address to determine whether the server resource address is correct; If it is correct, then enter the step of performing the national encryption SSL negotiation process with the corresponding server according to the server resource address; If it is incorrect, an error response message indicating that the server resource address is incorrect is generated, and the error response message is sent to the client.

4. The communication method according to claim 1, characterized in that: Before encapsulating the resource data into a response message, the method further includes: Verifying the resource data to determine whether the resource data is complete; If the resource data is complete, the step of encapsulating the resource data into a response message is entered; If the resource data is incomplete, requesting the server to resend the resource data; Upon receiving the resent resource data, determining whether the resent resource data is complete; If the resent resource data is complete, entering the step of encapsulating the resource data into a response message; If the resent resource data is incomplete, an error response message indicating a package assembly error is generated and the error response message is sent to the client.

5. The communication method according to claim 1, characterized in that: The receiving a request message sent by the client includes: Configure a public port and listen to the public port; The request message sent by the client is received through the public port.

6. The communication method according to any one of claims 1 to 5, characterized in that: Also includes: Creating a first structure corresponding to the client and a second structure corresponding to the server in memory; Creating a first pointer pointing to a memory address of the second structure in the first structure, and creating a second pointer pointing to the memory address of the first structure in the second structure; The extracting the server resource address requested to be accessed by the client from the request message includes: Adding the request message to the first structure, and parsing the request message in the first structure to obtain the server resource address; Add the server resource address to the second structure through the first pointer; The step of generating an encrypted request message by using the national encryption SSL negotiation parameters and the server resource address includes: Add the national encryption SSL negotiation parameters to the second structure; In the second structure, an encrypted request message is generated using the national encryption SSL negotiation parameters and the server resource address; The method of decrypting the encrypted response message using the national secret SSL parameter to obtain resource data corresponding to the server resource address includes: Adding the encrypted response message to the second structure; In the second structure, the encrypted response message is decrypted using the national secret SSL parameter to obtain resource data corresponding to the server resource address; Add the resource data to the first structure through the second pointer; The encapsulating the resource data into a response message and sending the response message to the client includes: The resource data is encapsulated as a response message in the first structure, and the response message is sent to the client.

7. A communication device, characterized in that: Applied to a gateway device, the device comprises: A first receiving module is used to receive a request message sent by a client, and extract from the request message an address of a server resource that the client requests to access; The national secret SSL negotiation module is used to perform the national secret SSL negotiation process with the corresponding server according to the server resource address, and determine the national secret SSL negotiation parameters between the server and the server; A first sending module, used to generate an encryption request message using the national encryption SSL negotiation parameters and the server resource address, and send the encryption request message to the server; The second receiving module is used to receive the encrypted response message sent by the server, decrypt the encrypted response message using the national secret SSL parameter, and obtain resource data corresponding to the resource address of the server; The second sending module is used to encapsulate the resource data into a response message and send the response message to the client.

8. A gateway device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the communication method according to any one of claims 1 to 6 when executing the computer program.

9. A communication system, characterized in that: include: A gateway device, configured to execute the communication method according to any one of claims 1 to 6; A client, used to send a request message to the gateway device; Receiving a response message sent by the gateway device; The server is used to conduct the national encryption SSL negotiation process with the gateway device; Receiving an encrypted request message sent by the gateway device; Send an encrypted response message to the gateway device.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are loaded and executed by a processor, the communication method according to any one of claims 1 to 6 is implemented.

Images