Network communication method and device, storage medium and electronic device

Abstract

The present application discloses a network communication method and device, a storage medium and an electronic device. It relates to the field of network security and other related technical fields. The method includes: decrypting a communication request according to a preset key to obtain a first decryption result; generating a response message and a first session key according to the first decryption result, and sending the response message to a second application; decrypting the response message according to the preset key to obtain a second decryption result, and generating a second session key according to the second decryption result; establishing network communication between the first application and the second application according to the first session key and the second session key. Through this application, the problem of realizing network communication between applications according to a fixed IP address in the related technology is solved. When the IP address changes, the application needs to be dynamically configured in a plain text communication mode to re-establish the communication channel, which leads to poor security of network communication.

Description

Technical Field

[0001] The present application relates to the field of network security and other related technical fields, and in particular to a network communication method and device, a storage medium and an electronic device. Background Art

[0002] In the current network security field, Internet Protocol Security (IPSec) is a widely used protocol that provides encryption and authentication services for network communications to ensure the security of data transmission on the Internet. The traditional IPSec tunnel establishment method usually relies on static configuration, that is, the fixed IP address of the other party is preset on the devices at both ends of the tunnel. This static configuration mechanism can work effectively in a fixed network environment, but when the IP addresses between the initiator and the responder of the IPSec service change, the original IPSec tunnel will no longer be available. In this case, in order to re-establish a secure communication channel, the application must implement dynamic configuration in plain text communication to update the IP information at both ends of the tunnel and restart the IPSec service to restore communication. This process not only increases the complexity and cost of network operation and maintenance, but also temporarily interrupts communication during the configuration update, affecting the stability of the network and user experience, and also reducing the efficiency of network communication.

[0003] Regarding the related art of implementing network communication between applications based on fixed IP addresses, when the IP address changes, the applications need to be dynamically configured in plain text communication to re-establish the communication channel, which leads to the problem of poor security of network communication. No effective solution has been proposed yet. Summary of the invention

[0004] The main purpose of the present application is to provide a network communication method and device, a storage medium and an electronic device to solve the problem in the related art that network communication between applications is implemented based on a fixed IP address, and when the IP address changes, the application needs to be dynamically configured in plain text communication to re-establish the communication channel, which leads to poor security of network communication.

[0005] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a network communication method is provided. The method includes: after a first application receives a communication request generated by a second application, decrypting the communication request according to a preset key to obtain a first decryption result, wherein the communication request is obtained by encrypting a first random number and the first signature information of the second application; if the first decryption result meets a first preset condition, the first application generates a response message and a first session key according to the first decryption result, and sends the response message to the second application, wherein the response message is obtained by encrypting the first random number, the second random number and the second signature information of the first application; decrypting the response message according to the preset key by the second application to obtain a second decryption result, and if the second decryption result meets a second preset condition, the second application generates a second session key according to the second decryption result; and establishing network communication between the first application and the second application according to the first session key and the second session key.

[0006] Furthermore, before decrypting the communication request according to a preset key to obtain a first decryption result, the method also includes: randomly generating the first random number and obtaining the first signature information through the second application; encrypting the first random number according to the preset key through the second application to obtain a first encryption result; and obtaining the communication request through the second application based on the first encryption result and the first signature information.

[0007] Furthermore, generating a response message and a first session key by the first application according to the first decryption result includes: randomly generating the second random number and obtaining the second signature information by the first application; encrypting the first random number and the second random number in the first decryption result by the first application according to the preset key to obtain a second encryption result; obtaining the response message by the first application according to the second encryption result and the second signature information; and obtaining the first session key by performing an XOR operation on the first random number and the second random number by the first application.

[0008] Furthermore, establishing network communication between the first application and the second application based on the first session key and the second session key includes: determining whether the first session key and the second session key are the same, and obtaining a first determination result; if the first determination result indicates that the first session key and the second session key are the same, obtaining target information of the second application, wherein the target information includes at least: the name, IP address and first communication time range of the second application; encrypting the target information based on the first session key or the second session key, and obtaining a target encryption result; and establishing network communication between the first application and the second application based on the target encryption result.

[0009] Furthermore, based on the target encryption result, establishing network communication between the first application and the second application includes: after the first application receives the target encryption result, decrypting the target encryption result by using the first session key or the second session key to obtain a target decryption result; and establishing network communication between the first application and the second application when the target decryption result meets a third preset condition.

[0010] Furthermore, after establishing network communication between the first application and the second application, the method also includes: obtaining a second communication time range between the first application and the second application after establishing network communication; determining whether the second communication time range is greater than the first communication time range to obtain a second determination result; if the second determination result indicates that the second communication time range is greater than the first communication time range, disconnecting the network communication between the first application and the second application.

[0011] Furthermore, after determining whether the first session key and the second session key are the same and obtaining a first determination result, the method further includes: if the first determination result indicates that the first session key and the second session key are not the same, repeatedly executing the steps of generating the first session key according to the first decryption result through the first application and generating the second session key according to the second decryption result through the second application, until the first session key and the second session key are the same, or the number of executions exceeds a preset threshold.

[0012] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a network communication device is provided. The device includes: a decryption unit, which is used to decrypt the communication request generated by the second application according to a preset key after the first application receives the communication request generated by the second application, and obtain a first decryption result, wherein the communication request is obtained by encrypting a first random number and the first signature information of the second application; a first generation unit, which is used to generate a response message and a first session key by the first application according to the first decryption result when the first decryption result meets a first preset condition, and send the response message to the second application, wherein the response message is obtained by encrypting the first random number, the second random number and the second signature information of the first application; a second generation unit, which is used to decrypt the response message by the second application according to the preset key to obtain a second decryption result, and generate a second session key by the second application according to the second decryption result when the second decryption result meets a second preset condition; and an establishment unit, which is used to establish network communication between the first application and the second application according to the first session key and the second session key.

[0013] Furthermore, the device also includes: a first determination unit, used to randomly generate the first random number and obtain the first signature information through the second application before decrypting the communication request according to a preset key to obtain a first decryption result; an encryption unit, used to encrypt the first random number according to the preset key through the second application to obtain a first encryption result; and a second determination unit, used to obtain the communication request through the second application based on the first encryption result and the first signature information.

[0014] Further, the first generation unit includes: a first determination module, used to randomly generate the second random number and obtain the second signature information through the first application; a first encryption module, used to encrypt the first random number and the second random number in the first decryption result according to the preset key through the first application to obtain a second encryption result; a second determination module, used to obtain the response information according to the second encryption result and the second signature information through the first application; and an operation module, used to perform an XOR operation on the first random number and the second random number through the first application to obtain the first session key.

[0015] Furthermore, the establishment unit includes: a judgment module, used to judge whether the first session key and the second session key are the same, and obtain a first judgment result; an acquisition module, used to obtain target information of the second application if the first judgment result indicates that the first session key and the second session key are the same, wherein the target information includes at least: the name, IP address and first communication time range of the second application; a second encryption module, used to encrypt the target information according to the first session key or the second session key to obtain a target encryption result; and an establishment module, used to establish network communication between the first application and the second application based on the target encryption result.

[0016] Furthermore, the establishment module includes: a decryption sub-module, used to decrypt the target encryption result by using the first session key or the second session key to obtain the target decryption result after the first application receives the target encryption result; and an establishment sub-module, used to establish network communication between the first application and the second application when the target decryption result meets a third preset condition.

[0017] Furthermore, the device also includes: an acquisition unit, used to obtain a second communication time range between the first application and the second application after the network communication between the first application and the second application is established; a judgment unit, used to judge whether the second communication time range is greater than the first communication time range, and obtain a second judgment result; and a disconnection unit, used to disconnect the network communication between the first application and the second application if the second judgment result indicates that the second communication time range is greater than the first communication time range.

[0018] Furthermore, the device also includes: an execution unit, which is used to, after determining whether the first session key and the second session key are the same and obtaining a first judgment result, if the first judgment result indicates that the first session key and the second session key are not the same, repeatedly execute the steps of generating the first session key according to the first decryption result through the first application and generating the second session key according to the second decryption result through the second application, until the first session key and the second session key are the same, or the number of executions exceeds a preset threshold.

[0019] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a computer-readable storage medium is provided, wherein the storage medium stores a program, wherein when the program is running, the device where the storage medium is located is controlled to execute any one of the network communication methods described above.

[0020] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an electronic device is further provided, the electronic device includes one or more processors and a memory, and the memory is used to store the network communication method implemented by one or more processors as described above.

[0021] Through the present application, the following steps are adopted: after the first application receives the communication request generated by the second application, the communication request is decrypted according to the preset key to obtain a first decryption result, wherein the communication request is obtained by encrypting the first random number and the first signature information of the second application; when the first decryption result meets the first preset condition, the first application generates a response message and a first session key according to the first decryption result, and sends the response message to the second application, wherein the response message is obtained by encrypting the first random number, the second random number and the second signature information of the first application; the response message is decrypted according to the preset key by the second application to obtain a second decryption result, and when the second decryption result meets the second preset condition, the second application generates a second session key according to the second decryption result; network communication between the first application and the second application is established according to the first session key and the second session key. Through the present application, the problem that the network communication between applications is realized according to a fixed IP address in the related art and the application needs to be dynamically configured in a plain text communication mode when the IP address changes to re-establish the communication channel, which leads to poor security of network communication.

[0022] In this solution, when the first application receives a communication request generated by the second application, it uses a preset key to decrypt the request to obtain the decrypted first random number and first signature information. If the decrypted first random number and first signature information meet the first preset condition, the first application will generate a response message and create a first session key. Then, after receiving the response message, the second application uses the preset key to decrypt it to obtain the first random number, the second random number and the second signature information to form a second decryption result. If the second decryption result meets the second preset condition, the second application will generate a matching second session key based on the second decryption result. Finally, based on the first session key and the second session key, network communication between the first application and the second application is established.

[0023] Through the first session key and the second session key, a dynamic and secure network communication channel is established without human intervention, which can adapt to the dynamic changes of the public IP address. At the same time, it also ensures the communication efficiency of data transmission and effectively solves the problems of poor communication security caused by plain text communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0025] Figure 1 is a flow chart of a network communication method provided according to an embodiment of the present application;

[0026] Figure 2 is a schematic diagram of a network communication method provided according to an embodiment of the present application;

[0027] Figure 3 is a schematic diagram of a network communication device provided according to an embodiment of the present application;

[0028] Figure 4 is a schematic diagram of an electronic device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0029] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0030] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this application.

[0031] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0032] For the convenience of description, some nouns or terms involved in the embodiments of the present application are explained below:

[0033] Internet Protocol Security (IPSec): is a security protocol framework widely used in the Internet and private networks. Its main function is to provide confidentiality, data integrity and authentication for data packets transmitted in the network, thereby ensuring the security of network communications.

[0034] IPSec consists of a set of related protocols, including but not limited to: Authentication Header (AH): The AH protocol provides data packet integrity and identity authentication, but does not provide data encryption. It verifies the content and source IP address of the data packet to ensure that the data has not been tampered with during transmission and to verify the identity of the sender of the data packet.

[0035] Encapsulating Security Payload (ESP): The ESP protocol provides data encryption and optional data integrity and identity authentication services. It encrypts the content and part of the header information of the data packet, and adds additional header information in addition to the encrypted data to achieve data confidentiality and security.

[0036] Internet Key Exchange (IKE): The IKE protocol is responsible for securely establishing and managing IPSec session keys between two devices. It uses the Diffie-Hellman algorithm to negotiate keys and provides identity authentication and key management functions.

[0037] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties. For example, an interface is set between this system and the relevant user or organization. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0038] The present invention is described below in conjunction with preferred implementation steps. Figure 1 is a flow chart of a network communication method provided according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0039] Step S101, after the first application receives the communication request generated by the second application, the communication request is decrypted according to a preset key to obtain a first decryption result, wherein the communication request is obtained by encrypting a first random number and a first signature information of the second application.

[0040] Optionally, a preset key (i.e., a preset key) is pre-written in the built-in encryption card of the VPN device, and then the IPSec service (i.e., the first application) starts the local network monitoring mode to receive the connection and communication request message (i.e., the communication request) of the external application (i.e., the second application). After receiving the communication request message of the external application, it is decrypted by the preset key to obtain a first decryption result.

[0041] It should be noted that the communication request message is encrypted by the random number randomLeft (i.e., the first random number) generated by the external application and the signature of the external application (i.e., the first signature information). Therefore, the first decryption result mainly includes: the random number randomLeft generated by the external application and the signature of the external application.

[0042] Step S102, when the first decryption result meets the first preset condition, the first application generates a response message and a first session key based on the first decryption result, and sends the response message to the second application, wherein the response message is obtained by encrypting the first random number, the second random number and the second signature information of the first application.

[0043] Optionally, verify whether the signature of the external application in the first decryption result passes. If passed, the IPSec service generates a random number randomRight (i.e., a second random number), and encrypts it according to the random number randomLeft in the first decryption result and the signature of the IPSec service (i.e., the second signature information), generates a response message and a first temporary session key (i.e., the first session key), and replies the response message to the external application.

[0044] It should be noted that the IPSec service can use the public key and signature algorithm to re-sign the signature in the first decryption result, and compare the regenerated signature with the original signature value in the first decryption result. If the two signatures match, the verification is successful, indicating that the data has not been tampered with during transmission and is indeed generated by an external application holding the corresponding private key; if they do not match, it is considered that the signature verification has failed, and the data may have been tampered with or come from an unauthorized source. In some cases, it may also be necessary to check the timestamp of the signature to ensure the timeliness of the data and prevent replay attacks.

[0045] Step S103, decrypting the response information according to the preset key through the second application to obtain a second decryption result, and generating a second session key according to the second decryption result through the second application when the second decryption result meets the second preset condition.

[0046] Optionally, after receiving the response information, the external application uses the preset key to decrypt it, obtains the plain text of the random number randomLeft and the random number randomRight, and compares the random number randomRight with the random number randomLeft sent by itself to see if they are consistent: if the two are inconsistent, the response information is discarded and the communication is interrupted; if the two are consistent, the signature of the IPSec service is verified. If the signature verification of the IPSec service passes, an XOR operation is performed on the random number randomLeft and the random number randomRight in the second decryption result to generate a second temporary session key (i.e., the second session key).

[0047] Step S104: establishing network communication between the first application and the second application based on the first session key and the second session key.

[0048] Optionally, after the first application and the second application successfully generate the first temporary session key and the second temporary session key, it can be considered that a secure channel (i.e., network communication) is established between the first application and the second application. Afterwards, the second application will send the new IP address or the changed IP address to the first application through the secure channel (sent in the form of ciphertext and signature to ensure security and prevent tampering by a third party), and the first application will establish an IPSec tunnel based on the new IP address to ensure subsequent business communications.

[0049] In summary, when the first application receives the communication request generated by the second application, it uses the preset key to decrypt the request to obtain the decrypted first random number and the first signature information. If the decrypted first random number and the first signature information meet the first preset condition, the first application will generate a response message and create a first session key at the same time. Then, after receiving the response message, the second application uses the preset key to decrypt it to obtain the first random number, the second random number and the second signature information, forming a second decryption result after decryption. If the second decryption result meets the second preset condition, the second application will generate a matching second session key based on the second decryption result. Finally, based on the first session key and the second session key, the network communication between the first application and the second application is established.

[0050] Through the first session key and the second session key, a dynamic and secure network communication channel is established without human intervention, which can adapt to the dynamic changes of the public IP address. At the same time, it also ensures the communication efficiency of data transmission and effectively solves the problems of poor communication security caused by plain text communication.

[0051] Optionally, in the network communication method provided in an embodiment of the present application, before decrypting the communication request according to a preset key to obtain a first decryption result, the method also includes: randomly generating a first random number and obtaining first signature information through a second application; encrypting the first random number according to the preset key through the second application to obtain a first encryption result; obtaining a communication request through the second application based on the first encryption result and the first signature information.

[0052] In an optional embodiment, after the external application monitors the change of the public network IP of the peer device through network technology means (including but not limited to: OSPF and NHRP, etc.), it generates a random number randomLeft (i.e., the first random number), and encrypts the random number randomLeft through a preset key to obtain a first encryption result. The external application signs the random number randomLeft based on a preset security policy and signature algorithm (e.g.: RSA, ECDSA, etc.) to generate a first signature information to prove that the random number randomLeft is generated by the external application and remains untampered during transmission. The first encryption result and the signature of the external application (i.e., the first signature information) are integrated to obtain a communication request, which is sent to the IPSec service and waits for a reply.

[0053] Through the above steps, not only the security of the communication link is enhanced, but also the automatic adaptability of the tunnel when the public network IP address changes is achieved, which significantly improves the efficiency and flexibility of network communication.

[0054] Optionally, in the network communication method provided in the embodiment of the present application, generating a response message and a first session key by the first application based on the first decryption result includes: randomly generating a second random number and obtaining second signature information by the first application; encrypting the first random number and the second random number in the first decryption result by the first application based on a preset key to obtain a second encryption result; obtaining a response message by the first application based on the second encryption result and the second signature information; and obtaining the first session key by the first application by performing an XOR operation on the first random number and the second random number.

[0055] In an optional embodiment, after the signature verification is passed, the IPSec service generates a random number randomRight, concatenates the random number randomLeft in the first decryption result and the random number randomRight, and encrypts it using a preset key to obtain a second encryption result. The IPSec service program signs the second encryption result based on a preset security policy and signature algorithm (for example: RSA, ECDSA, etc.), and generates a second signature information to prove that the second encryption result remains untampered during the transmission process. The second encryption result and the second signature information are integrated to obtain a response message, which is sent to the external application and waits for a reply. At the same time, the random number randomLeft and the random number randomRight are XORed, and the result is used as the first session key for subsequent messages.

[0056] It should be noted that the XOR operation is a common key generation method that ensures that even if the random number of one party is leaked, the attacker cannot easily infer the session key because a new random number is generated for each communication.

[0057] Through the above steps, IPSec tunnels can be dynamically created and deleted, ensuring automatic adjustments without manual intervention when the network environment changes, while also maintaining the security and efficiency of communications.

[0058] Optionally, in the network communication method provided in the embodiment of the present application, establishing network communication between the first application and the second application based on the first session key and the second session key includes: determining whether the first session key and the second session key are the same, and obtaining a first judgment result; if the first judgment result indicates that the first session key and the second session key are the same, obtaining target information of the second application, wherein the target information includes at least: the name of the second application, the IP address and the first communication time range; encrypting the target information based on the first session key or the second session key to obtain a target encryption result; and establishing network communication between the first application and the second application based on the target encryption result.

[0059] In an optional embodiment, it is determined whether the first session key and the second session key are the same: if the first session key and the second session key are the same, the external application will compose a session message (i.e., target information), which includes but is not limited to: the tunnel connection name, IP address, and first communication time range of the external application, etc. It is encrypted and signed by the first session key or the second session key to obtain a target encryption result, which is sent to the IPSec service to establish network communication between the external application and the IPSec service.

[0060] Through the above steps, not only can the IPSec tunnel be dynamically created and deleted, but also the security during the tunnel establishment and data transmission process can be ensured, while also taking into account network performance and resource management.

[0061] Optionally, in the network communication method provided in the embodiment of the present application, establishing network communication between the first application and the second application based on the target encryption result includes: after the first application receives the target encryption result, decrypting the target encryption result by using the first session key or the second session key to obtain the target decryption result; when the target decryption result meets a third preset condition, establishing network communication between the first application and the second application.

[0062] In an optional embodiment, when the IPSec service receives the target encryption result, it decrypts it using the first session key or the second session key to obtain the target information of the second application. Check whether the name and IP address in the target information are valid and whether it is a known and trusted application. And ensure that the communication is carried out within the expected time range to prevent replay attacks. If the target decryption result passes the verification of the third preset condition, the IPSec service generates a corresponding IPSec tunnel configuration based on the information in the target decryption result. And based on the generated tunnel configuration, initiate a tunnel negotiation process between the devices corresponding to the new IP address, including: using the IKE protocol to exchange security policies and key materials to ensure the secure establishment of the tunnel. Once the tunnel negotiation is successful, an encrypted network communication channel, namely the IPSec tunnel, will be established between the IPSec service and the external application, and all subsequent network communications will be carried out through this tunnel, ensuring the confidentiality and integrity of the data.

[0063] It should be noted that during network communication, before each new data transmission, the system will perform a new key generation and exchange process to generate a new temporary session key. This process usually involves two-way authentication and key negotiation between the first application and the second application to ensure that the latest and secure session key is used for each communication.

[0064] Through the above process, not only the automatic creation and management of IPSec tunnels based on dynamic public IP is realized, but also the key security of each communication and the health monitoring of the communication channel are ensured, thereby improving the security and reliability of network communications without increasing the operation and maintenance burden.

[0065] Optionally, in the network communication method provided in an embodiment of the present application, after establishing network communication between the first application and the second application, the method further includes: obtaining a second communication time range between the first application and the second application after establishing network communication; determining whether the second communication time range is greater than the first communication time range to obtain a second determination result; if the second determination result indicates that the second communication time range is greater than the first communication time range, disconnecting the network communication between the first application and the second application.

[0066] In an optional embodiment, in order to maintain the health of the tunnel and promptly discover failed tunnels, the IPSec service will continue to use the DPD (Dead Peer Detection) protocol to monitor the connection with the external application, including the communication time range (i.e., the second communication time range). This time range reflects the activity and duration of the communication. Usually, the second communication time range is dynamically updated according to the actual communication situation. For example, when a new data transmission starts between the IPSec service and the external application, the second communication time range is calculated from the current time. If the second communication time range is greater than the first communication time range, it means that the actual use time of the tunnel exceeds expectations, which may be due to new communication requirements, or it may mean potential security risks, such as: the tunnel is abused or there is unauthorized communication. At this time, the system will disconnect the network communication between the IPSec service and the external application. After disconnecting the network communication, the disconnection reason is recorded, the security incident investigation process is initiated, etc., to determine the reason for the communication time range being exceeded. If it is due to normal new communication requirements, the system can re-initiate tunnel negotiation and use the updated communication time range to establish a new tunnel. If it is due to a security incident (e.g. unauthorized access), further security measures need to be taken, such as disabling the tunnel, updating security policies, or issuing an alarm.

[0067] Through the above process, not only can the IPSec tunnel be dynamically established and managed, but the use of the tunnel can also be monitored and controlled according to the communication time range, ensuring the security and efficiency of network communications while preventing resource waste and potential security threats.

[0068] Optionally, in the network communication method provided in an embodiment of the present application, after determining whether the first session key and the second session key are the same and obtaining a first judgment result, the method further includes: if the first judgment result indicates that the first session key and the second session key are not the same, repeatedly executing the steps of generating the first session key according to the first decryption result through the first application and generating the second session key according to the second decryption result through the second application, until the first session key and the second session key are the same, or the number of executions exceeds a preset threshold.

[0069] In an optional embodiment, if the first session key and the second session key are not the same, the system will repeat the key generation and exchange steps between the IPSec service and the external application. Specifically, the IPSec service will generate a new RandomRight again, and the external application will generate a new RandomLeft. Both parties will use the preset key to encrypt and sign the new random number, and then exchange it with each other, decrypt and verify it to generate a new session key. This repeated execution step will continue until the first session key and the second session key are the same. However, in order to prevent infinite loops and waste of resources, the system sets a preset threshold, i.e., the maximum number of retries. If the number of times the key generation and check is performed exceeds the preset threshold, the system will consider that key consistency cannot be achieved, possibly due to ongoing security threats or system failures, and will no longer attempt to generate a new session key.

[0070] It should be noted that when the number of executions exceeds the preset threshold, the system will take further security measures, including but not limited to: Record security events: record events where the key consistency check fails in the log (for example, the number of executions, timestamps, and potential causes of errors, etc.). Start security protocols: A higher level of security protocols (for example, certificate verification or more complex key negotiation mechanisms) may be started to try to resolve the problem. Alarms and warnings: Send alarms to system administrators to indicate that there are security risks or system anomalies that require manual intervention. Suspend or disconnect communications: When a security incident occurs, suspend or disconnect network communications between the first application and the second application until the problem is resolved.

[0071] The above process ensures that when the session keys are inconsistent, the retry mechanism can be used to try to re-establish key consistency, and security measures can be taken when the preset threshold is exceeded to effectively respond to potential attacks and system failures and protect the security of network communications.

[0072] It should be noted that Figure 2 Schematic diagram of a network communication method provided according to an embodiment of the present application. Figure 2 As shown, first, a first random number is randomly generated and first signature information is obtained through a second application, and the first random number is encrypted according to a preset key to obtain a first encryption result; a communication request is obtained based on the first encryption result and the first signature information.

[0073] Then, after the first application receives the communication request generated by the second application, it decrypts the communication request according to the preset key to obtain a first decryption result. When the first decryption result meets the first preset condition, the first application randomly generates a second random number and obtains the second signature information; the first application encrypts the first random number and the second random number in the first decryption result according to the preset key to obtain a second encryption result; the first application obtains response information based on the second encryption result and the second signature information; the first application performs an XOR operation on the first random number and the second random number to obtain a first session key, and sends the response information to the second application. At the same time, the second application decrypts the response information according to the preset key to obtain a second decryption result, and when the second decryption result meets the second preset condition, the second application generates a second session key based on the second decryption result;

[0074] Finally, it is determined whether the first session key and the second session key are the same: if the first session key and the second session key are the same, the target information of the second application is obtained. After the first application receives the target encryption result, it is decrypted by the first session key or the second session key to obtain the target decryption result; if the target decryption result meets the third preset condition, the network communication between the first application and the second application is established.

[0075] The network communication method provided by the embodiment of the present application is that after the first application receives the communication request generated by the second application, the communication request is decrypted according to a preset key to obtain a first decryption result, wherein the communication request is obtained by encrypting a first random number and the first signature information of the second application; when the first decryption result meets the first preset condition, the first application generates a response message and a first session key according to the first decryption result, and sends the response message to the second application, wherein the response message is obtained by encrypting the first random number, the second random number and the second signature information of the first application; the response message is decrypted according to the preset key by the second application to obtain a second decryption result, and when the second decryption result meets the second preset condition, the second application generates a second session key according to the second decryption result; network communication between the first application and the second application is established according to the first session key and the second session key, which solves the problem in the related art that network communication between applications is realized according to a fixed IP address, and when the IP address changes, the application needs to be dynamically configured in plain text communication to re-establish the communication channel, thereby resulting in poor security of network communication.

[0076] In summary, when the first application receives the communication request generated by the second application, it uses the preset key to decrypt the request to obtain the decrypted first random number and the first signature information. If the decrypted first random number and the first signature information meet the first preset condition, the first application will generate a response message and create a first session key at the same time. Then, after receiving the response message, the second application uses the preset key to decrypt it to obtain the first random number, the second random number and the second signature information, forming a second decryption result after decryption. If the second decryption result meets the second preset condition, the second application will generate a matching second session key based on the second decryption result. Finally, based on the first session key and the second session key, the network communication between the first application and the second application is established.

[0077] Through the first session key and the second session key, a dynamic and secure network communication channel is established without human intervention, which can adapt to the dynamic changes of the public IP address. At the same time, it also ensures the communication efficiency of data transmission and effectively solves the problems of poor communication security caused by plain text communication.

[0078] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0079] The embodiment of the present application also provides a network communication device. It should be noted that the network communication device of the embodiment of the present application can be used to execute the network communication method provided by the embodiment of the present application. The network communication device provided by the embodiment of the present application is introduced below.

[0080] Figure 3 Schematic diagram of a network communication device according to an embodiment of the present application. Figure 3 As shown, the device includes: a decryption unit 301, a first generation unit 302, a second generation unit 303, and an establishment unit 304.

[0081] The decryption unit 301 is used to decrypt the communication request generated by the second application according to a preset key after the first application receives the communication request, and obtain a first decryption result, wherein the communication request is obtained by encrypting the first random number and the first signature information of the second application;

[0082] The first generating unit 302 is used to generate response information and a first session key according to the first decryption result by the first application program when the first decryption result meets the first preset condition, and send the response information to the second application program, wherein the response information is obtained by encrypting the first random number, the second random number, and the second signature information of the first application program;

[0083] The second generating unit 303 is used to decrypt the response information according to the preset key through the second application to obtain a second decryption result, and generate a second session key according to the second decryption result through the second application when the second decryption result meets the second preset condition;

[0084] The establishing unit 304 is used to establish network communication between the first application and the second application based on the first session key and the second session key.

[0085] In the network communication device provided by the embodiment of the present application, after the first application receives the communication request generated by the second application, the decryption unit 301 decrypts the communication request according to the preset key to obtain a first decryption result, wherein the communication request is obtained by encrypting the first random number and the first signature information of the second application; the first generation unit 302 generates response information and a first session key through the first application according to the first decryption result when the first decryption result meets the first preset condition, and sends the response information to the second application, wherein the response information is obtained by encrypting the first random number, the second random number and the second signature information of the first application; the second generation unit 303 decrypts the response information through the second application according to the preset key to obtain a second decryption result, and generates a second session key through the second application according to the second decryption result when the second decryption result meets the second preset condition; the establishment unit 304 establishes network communication between the first application and the second application according to the first session key and the second session key, which solves the problem that the network communication between applications is realized according to a fixed IP address in the related art, and when the IP address changes, the application needs to be dynamically configured in a plain text communication mode to re-establish the communication channel, thereby resulting in poor security of the network communication.

[0086] In this solution, when the first application receives a communication request generated by the second application, it uses a preset key to decrypt the request to obtain the decrypted first random number and first signature information. If the decrypted first random number and first signature information meet the first preset condition, the first application will generate a response message and create a first session key. Then, after receiving the response message, the second application uses the preset key to decrypt it to obtain the first random number, the second random number and the second signature information to form a second decryption result. If the second decryption result meets the second preset condition, the second application will generate a matching second session key based on the second decryption result. Finally, based on the first session key and the second session key, network communication between the first application and the second application is established.

[0087] Through the first session key and the second session key, a dynamic and secure network communication channel is established without human intervention, which can adapt to the dynamic changes of the public IP address. At the same time, it also ensures the communication efficiency of data transmission and effectively solves the problems of poor communication security caused by plain text communication.

[0088] Optionally, in the network communication device provided in the embodiment of the present application, the device also includes: a first determination unit, used to randomly generate a first random number and obtain first signature information through a second application before decrypting the communication request according to a preset key to obtain a first decryption result; an encryption unit, used to encrypt the first random number according to the preset key through the second application to obtain a first encryption result; and a second determination unit, used to obtain the communication request through the second application based on the first encryption result and the first signature information.

[0089] Optionally, in the network communication device provided in the embodiment of the present application, the first generation unit includes: a first determination module, used to randomly generate a second random number and obtain second signature information through a first application; a first encryption module, used to encrypt the first random number and the second random number in the first decryption result according to a preset key through the first application to obtain a second encryption result; a second determination module, used to obtain response information based on the second encryption result and the second signature information through the first application; and an operation module, used to perform an XOR operation based on the first random number and the second random number through the first application to obtain a first session key.

[0090] Optionally, in the network communication device provided in the embodiment of the present application, the establishing unit includes: a judgment module, used to judge whether the first session key and the second session key are the same, and obtain a first judgment result; an acquisition module, used to obtain target information of the second application if the first judgment result indicates that the first session key and the second session key are the same, wherein the target information includes at least: the name of the second application, the IP address and the first communication time range; a second encryption module, used to encrypt the target information according to the first session key or the second session key to obtain a target encryption result; and an establishment module, used to establish network communication between the first application and the second application based on the target encryption result.

[0091] Optionally, in the network communication device provided in the embodiment of the present application, the establishment module includes: a decryption sub-module, used to decrypt the target encryption result by using the first session key or the second session key after the first application receives the target encryption result, so as to obtain the target decryption result; and an establishment sub-module, used to establish network communication between the first application and the second application when the target decryption result meets a third preset condition.

[0092] Optionally, in the network communication device provided in the embodiment of the present application, the device also includes: an acquisition unit, used to obtain a second communication time range of the first application and the second application after the network communication between the first application and the second application is established; a judgment unit, used to judge whether the second communication time range is greater than the first communication time range, and obtain a second judgment result; and a disconnection unit, used to disconnect the network communication between the first application and the second application if the second judgment result indicates that the second communication time range is greater than the first communication time range.

[0093] Optionally, in the network communication device provided in the embodiment of the present application, the device also includes: an execution unit, which is used to determine whether the first session key and the second session key are the same and obtain a first judgment result. If the first judgment result indicates that the first session key and the second session key are not the same, repeatedly execute the steps of generating the first session key according to the first decryption result through the first application and generating the second session key according to the second decryption result through the second application, until the first session key and the second session key are the same, or the number of executions exceeds a preset threshold.

[0094] The network communication device includes a processor and a memory. The above-mentioned first determination unit 301, second determination unit 302, third determination unit 303, first change unit 304, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to achieve efficient communication with the network.

[0095] The processor includes a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set, and efficient communication with the network can be achieved by adjusting kernel parameters.

[0096] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0097] An embodiment of the present invention provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, a network communication method is implemented.

[0098] An embodiment of the present invention provides a processor, which is used to run a program, wherein the program executes a network communication method when it is run.

[0099] like Figure 4 As shown, an embodiment of the present invention provides an electronic device, the device includes a processor, a memory and a program stored in the memory and executable on the processor, and the processor implements the following steps when executing the program: after a first application receives a communication request generated by a second application, the communication request is decrypted according to a preset key to obtain a first decryption result, wherein the communication request is obtained by encrypting a first random number and a first signature information of the second application; when the first decryption result meets a first preset condition, the first application generates a response message and a first session key according to the first decryption result, and sends the response message to the second application, wherein the response message is obtained by encrypting the first random number, the second random number and the second signature information of the first application; the response message is decrypted according to the preset key by the second application to obtain a second decryption result, and when the second decryption result meets a second preset condition, the second application generates a second session key according to the second decryption result; and network communication between the first application and the second application is established according to the first session key and the second session key.

[0100] Optionally, before decrypting the communication request according to a preset key to obtain a first decryption result, the method also includes: randomly generating a first random number and obtaining first signature information through a second application; encrypting the first random number according to the preset key through the second application to obtain a first encryption result; and obtaining a communication request through the second application based on the first encryption result and the first signature information.

[0101] Optionally, generating a response message and a first session key by the first application based on the first decryption result includes: randomly generating a second random number and obtaining second signature information by the first application; encrypting the first random number and the second random number in the first decryption result by the first application based on a preset key to obtain a second encryption result; obtaining a response message by the first application based on the second encryption result and the second signature information; and obtaining the first session key by the first application by performing an XOR operation on the first random number and the second random number.

[0102] Optionally, establishing network communication between the first application and the second application based on the first session key and the second session key includes: determining whether the first session key and the second session key are the same to obtain a first determination result; if the first determination result indicates that the first session key and the second session key are the same, obtaining target information of the second application, wherein the target information includes at least: the name of the second application, the IP address and the first communication time range; encrypting the target information based on the first session key or the second session key to obtain a target encryption result; and establishing network communication between the first application and the second application based on the target encryption result.

[0103] Optionally, establishing network communication between the first application and the second application based on the target encryption result includes: after the first application receives the target encryption result, decrypting the target encryption result using the first session key or the second session key to obtain a target decryption result; and establishing network communication between the first application and the second application when the target decryption result meets a third preset condition.

[0104] Optionally, after establishing network communication between the first application and the second application, the method also includes: obtaining a second communication time range between the first application and the second application after establishing network communication; determining whether the second communication time range is greater than the first communication time range to obtain a second determination result; if the second determination result indicates that the second communication time range is greater than the first communication time range, disconnecting the network communication between the first application and the second application.

[0105] Optionally, after determining whether the first session key and the second session key are the same and obtaining a first determination result, the method further includes: if the first determination result indicates that the first session key and the second session key are not the same, repeatedly executing the steps of generating the first session key according to the first decryption result through the first application, and generating the second session key according to the second decryption result through the second application, until the first session key and the second session key are the same, or the number of executions exceeds a preset threshold.

[0106] The devices in this article can be servers, PCs, PADs, mobile phones, etc.

[0107] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program that is initialized with the following method steps: after a first application receives a communication request generated by a second application, the communication request is decrypted according to a preset key to obtain a first decryption result, wherein the communication request is obtained by encrypting a first random number and a first signature information of the second application; when the first decryption result meets a first preset condition, the first application generates a response message and a first session key according to the first decryption result, and sends the response message to the second application, wherein the response message is obtained by encrypting the first random number, the second random number and the second signature information of the first application; the response message is decrypted according to the preset key by the second application to obtain a second decryption result, and when the second decryption result meets a second preset condition, the second application generates a second session key according to the second decryption result; and network communication between the first application and the second application is established based on the first session key and the second session key.

[0108] Optionally, before decrypting the communication request according to a preset key to obtain a first decryption result, the method also includes: randomly generating a first random number and obtaining first signature information through a second application; encrypting the first random number according to the preset key through the second application to obtain a first encryption result; and obtaining a communication request through the second application based on the first encryption result and the first signature information.

[0109] Optionally, generating a response message and a first session key by the first application based on the first decryption result includes: randomly generating a second random number and obtaining second signature information by the first application; encrypting the first random number and the second random number in the first decryption result by the first application based on a preset key to obtain a second encryption result; obtaining a response message by the first application based on the second encryption result and the second signature information; and obtaining the first session key by the first application by performing an XOR operation on the first random number and the second random number.

[0110] Optionally, establishing network communication between the first application and the second application based on the first session key and the second session key includes: determining whether the first session key and the second session key are the same to obtain a first determination result; if the first determination result indicates that the first session key and the second session key are the same, obtaining target information of the second application, wherein the target information includes at least: the name of the second application, the IP address and the first communication time range; encrypting the target information based on the first session key or the second session key to obtain a target encryption result; and establishing network communication between the first application and the second application based on the target encryption result.

[0111] Optionally, establishing network communication between the first application and the second application based on the target encryption result includes: after the first application receives the target encryption result, decrypting the target encryption result using the first session key or the second session key to obtain a target decryption result; and establishing network communication between the first application and the second application when the target decryption result meets a third preset condition.

[0112] Optionally, after establishing network communication between the first application and the second application, the method also includes: obtaining a second communication time range between the first application and the second application after establishing network communication; determining whether the second communication time range is greater than the first communication time range to obtain a second determination result; if the second determination result indicates that the second communication time range is greater than the first communication time range, disconnecting the network communication between the first application and the second application.

[0113] Optionally, after determining whether the first session key and the second session key are the same and obtaining a first determination result, the method further includes: if the first determination result indicates that the first session key and the second session key are not the same, repeatedly executing the steps of generating the first session key according to the first decryption result through the first application, and generating the second session key according to the second decryption result through the second application, until the first session key and the second session key are the same, or the number of executions exceeds a preset threshold.

[0114] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0115] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0116] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0117] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0118] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0119] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0120] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0121] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0122] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0123] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A network communication method, characterized in that: include: After the first application receives the communication request generated by the second application, the first application decrypts the communication request according to the preset key to obtain a first decryption result, wherein the communication request is obtained by encrypting the first random number and the first signature information of the second application; If the first decryption result meets the first preset condition, generate response information and a first session key according to the first decryption result by the first application, and send the response information to the second application, wherein the response information is obtained by encrypting the first random number, the second random number and the second signature information of the first application; decrypting the response information according to the preset key by the second application to obtain a second decryption result, and generating a second session key according to the second decryption result by the second application if the second decryption result meets a second preset condition; Network communication between the first application and the second application is established based on the first session key and the second session key.

2. The method according to claim 1, characterized in that Before decrypting the communication request according to the preset key to obtain the first decryption result, the method further includes: Randomly generate the first random number and obtain the first signature information through the second application; Encrypting the first random number by the second application according to the preset key to obtain a first encryption result; The communication request is obtained through the second application according to the first encryption result and the first signature information.

3. The method according to claim 1, characterized in that Generating, by the first application according to the first decryption result, response information and a first session key includes: Randomly generate the second random number and obtain the second signature information through the first application; Encrypting the first random number and the second random number in the first decryption result according to the preset key by the first application to obtain a second encryption result; Obtaining the response information through the first application according to the second encryption result and the second signature information; The first session key is obtained by performing an XOR operation on the first random number and the second random number through the first application.

4. The method according to claim 1, characterized in that: Establishing network communication between the first application and the second application based on the first session key and the second session key includes: Determine whether the first session key and the second session key are the same, and obtain a first determination result; If the first judgment result indicates that the first session key and the second session key are the same, obtaining target information of the second application, wherein the target information at least includes: the name, IP address and first communication time range of the second application; encrypting the target information according to the first session key or the second session key to obtain a target encryption result; Based on the target encryption result, network communication between the first application and the second application is established.

5. The method according to claim 4, characterized in that Establishing network communication between the first application and the second application according to the target encryption result includes: After the first application receives the target encryption result, decrypting the target encryption result by using the first session key or the second session key to obtain a target decryption result; When the target decryption result meets a third preset condition, network communication between the first application and the second application is established.

6. The method according to claim 5, characterized in that After establishing network communication between the first application and the second application, the method further includes: Obtaining a second communication time range between the first application and the second application after network communication is established; Determine whether the second communication time range is greater than the first communication time range, and obtain a second determination result; If the second judgment result indicates that the second communication time range is greater than the first communication time range, the network communication between the first application and the second application is disconnected.

7. The method according to claim 4, characterized in that After determining whether the first session key and the second session key are the same and obtaining a first determination result, the method further includes: If the first judgment result indicates that the first session key and the second session key are not the same, repeatedly performing the steps of generating the first session key according to the first decryption result by the first application and generating the second session key according to the second decryption result by the second application until the first session key and the second session key are the same, or the number of executions exceeds a preset threshold.

8. A network communication device, characterized in that: include: a decryption unit, configured to decrypt the communication request generated by the second application according to a preset key to obtain a first decryption result after the first application receives the communication request generated by the second application, wherein the communication request is obtained by encrypting a first random number and first signature information of the second application; a first generating unit, configured to generate response information and a first session key by the first application according to the first decryption result if the first decryption result meets a first preset condition, and send the response information to the second application, wherein the response information is obtained by encrypting the first random number, the second random number, and the second signature information of the first application; A second generating unit, configured to decrypt the response information according to the preset key through the second application to obtain a second decryption result, and generate a second session key according to the second decryption result through the second application if the second decryption result meets a second preset condition; An establishing unit is used to establish network communication between the first application and the second application based on the first session key and the second session key.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein when the program is executed, the storage medium is controlled to execute the network communication method according to any one of claims 1 to 7 on a device.

10. An electronic device, characterized in that: It comprises one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the network communication method described in any one of claims 1 to 7.

Images