Communication method based on national secret encryption network protocol, server and client

Abstract

The invention discloses a communication method based on a national secret encryption network protocol, a server and a client, and relates to the technical field of communication transmission. The method is applied to a server, and comprises the following steps: under the condition of receiving a first cryptographic security shell protocol connection request sent by a client, forming key agreement completion confirmation information matched with the first cryptographic security shell protocol connection request, and sending the key agreement completion confirmation information to the client; under the condition of receiving identity authentication challenge information sent by the client, generating identity confirmation information, and generating an authentication challenge data packet based on the identity confirmation information; verifying the result data packet and the intelligent key through a preset verification mode under the condition that the intelligent key is obtained and the result data packet is received; and sending a connection request to the client under the condition that the result data packet meets the preset threshold value and the intelligent key verification meets the preset password. And the security of the communication channel can be greatly improved.

Description

Technical Field

[0001] The present disclosure generally relates to the field of communication transmission technology, and in particular to a communication method, server and client based on a national secret encryption network protocol. Background Art

[0002] With the continuous development of network technology, network security issues have become increasingly prominent.

[0003] In the relevant technology, remote communication is a common communication method using computer networks. Specifically, a remote communication channel is established between two terminals through a server as a bridge for host communication. Among them, the remote communication channel is often a transmission channel encrypted by specific means. For example, the remote communication channel can be encrypted through the national secret algorithm encryption network protocol (Secure Shell, SSH) through user identity authentication, thereby improving the communication security of the remote communication channel.

[0004] During long-distance communications, the means of interfering with communication channels are constantly changing, posing challenges to communication security. Summary of the invention

[0005] In view of the above-mentioned defects or deficiencies in the relevant technology, it is expected to provide a communication method, server and client based on the national secret encryption network protocol, which can solve the problem that the interference means to the communication channel are constantly changing during remote communication, posing challenges to communication security, and greatly improving the security of the communication channel.

[0006] In a first aspect, a communication method based on a national secret encryption network protocol is provided, which is applied to a server, and the method includes: In the case where the server receives a first national secret secure shell protocol connection request sent by a client, the server generates confirmation key negotiation completion information matching the first national secret secure shell protocol connection request, and sends the confirmation key negotiation completion information to the client, the first national secret secure shell protocol connection request including: connection mode indication information, the connection mode including: software algorithm connection mode or hardware algorithm connection mode, the confirmation key negotiation completion information is used to indicate that the client and the server reach a handshake agreement; When the server receives the identity authentication challenge information sent by the client, it generates identity confirmation information corresponding to the identity authentication challenge information, and generates an authentication challenge data packet based on the identity confirmation information, wherein the authentication challenge data packet is used to instruct the client to send a smart key, and the identity authentication challenge information is used to instruct the server to generate identity confirmation information; When the server obtains the smart key corresponding to the client and receives the result data packet sent by the client corresponding to the authentication challenge data packet, verifying the result data packet and the smart key by a preset verification method; When the result data packet meets a preset threshold and the smart key verification meets a preset password, the server sends a connection request to the client, and the connection request is used to request the client to establish a communication connection with the server.

[0007] In the present application, when the server receives a first national secret secure shell protocol connection request sent by a client, the server generates confirmation key negotiation completion information that matches the first national secret secure shell protocol connection request, and sends the confirmation key negotiation completion information to the client (the first national secret secure shell protocol connection request includes: connection mode indication information, the connection mode includes: software algorithm connection mode or hardware algorithm connection mode, and the confirmation key negotiation completion information is used to indicate that the client and the server have reached a handshake agreement); thereafter, when the server receives an identity authentication challenge information sent by the client, it generates identity confirmation information corresponding to the identity authentication challenge information, and generates an authentication challenge data packet for instructing the client to send a result data packet based on the identity confirmation information, and the identity authentication challenge information is used to instruct the server to generate identity confirmation information; thereafter, when the server obtains the smart key corresponding to the client and receives the result data packet sent by the client corresponding to the authentication challenge data packet, the result data packet and the smart key are verified by a preset verification method; when the result data packet meets a preset threshold and the smart key verification meets a preset password, the server sends a connection request to the client to establish a connection. In this way, before the client and the server establish a communication connection, they need to go through two challenge processes, namely the identity authentication challenge corresponding to the identity authentication challenge information and the authentication challenge data packet. Combined with the three response processes of identity confirmation information, result data packet and connection request, the communication connection can be established, which greatly improves the security and reliability of the communication connection establishment process.

[0008] In a second aspect, a communication method based on a national secret encryption network protocol is provided, which is applied to a client, and the method includes: The client sends a first national secret secure shell protocol connection request to the server, wherein the first national secret secure shell protocol connection request includes: connection mode indication information, wherein the connection mode includes: software algorithm connection mode or hardware algorithm connection mode; The client receives key negotiation completion confirmation information sent by the server, where the key negotiation completion confirmation information is used to indicate that the client and the server have reached a handshake agreement; Sending identity authentication challenge information to the server, wherein the identity authentication challenge information is used to instruct the server to generate identity confirmation information; After receiving the authentication challenge data packet sent by the server, generating a result data packet corresponding to the authentication challenge data packet and sending it to the server; When a connection request from the server is received, a connection is established with the server.

[0009] In a third aspect, a server is provided, the server comprising: A first generating unit is configured to, when receiving a first national secret secure shell protocol connection request sent by a client, generate, by the server, confirmation key negotiation completion information that matches the first national secret secure shell protocol connection request, and send the confirmation key negotiation completion information to the server, wherein the first national secret secure shell protocol connection request includes: connection mode indication information, wherein the connection mode includes: a software algorithm connection mode or a hardware algorithm connection mode, and the confirmation key negotiation completion information is used to indicate that the client and the server have reached a handshake agreement; A confirmation unit, configured to generate identity confirmation information corresponding to the identity confirmation information upon receiving the identity authentication challenge information sent by the client, and generate an authentication challenge data packet based on the identity confirmation information, wherein the authentication challenge data packet is used to instruct the client to send a smart key, and the identity authentication challenge information is used to instruct the server to generate identity confirmation information; A first execution unit is used to verify the result data packet and the smart key by a preset verification method when the smart key corresponding to the client is obtained and the result data packet corresponding to the authentication challenge data packet sent by the client is received; The first sending unit is used for, when the result data packet meets a preset threshold and the smart key verification meets a preset password, the server sends a connection request to the client, and the connection request is used to request the client to establish a communication connection with the server.

[0010] In a fourth aspect, a client is provided, the client comprising: A second sending unit is used to send a first national secret secure shell protocol connection request to the server, wherein the first national secret secure shell protocol connection request includes: connection mode indication information, and the connection mode includes: software algorithm connection mode or hardware algorithm connection mode; A receiving unit, configured to receive key negotiation completion confirmation information sent by the server, wherein the key negotiation completion confirmation information is used to indicate that the client and the server have reached a handshake agreement; The second sending unit is further used to send identity authentication challenge information to the server, wherein the identity authentication challenge information is used to instruct the server to generate identity confirmation information; A second generating unit is used to generate a result data packet corresponding to the authentication challenge data packet after receiving the authentication challenge data packet sent by the server, and send the result data packet to the server; The second execution unit is configured to establish a connection with the server upon receiving a connection request from the server.

[0011] In a fifth aspect, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method described in the first aspect or the second aspect is implemented.

[0012] In a sixth aspect, a computer-readable storage medium is provided, on which a computer program is stored, characterized in that when the program is executed by a processor, the method described in the first aspect or the second aspect is implemented.

[0013] In a seventh aspect, a computer program product is provided. The computer program product includes instructions, and the instructions are executed by a processor to implement the method described in the first aspect or the second aspect.

[0014] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings: Figure 1 One of the flow diagrams of the communication method based on the national secret encryption network protocol provided in the embodiment of the present application; Figure 2 The second flowchart of the communication method based on the national secret encryption network protocol provided in the embodiment of the present application; Figure 3 A schematic diagram of the structure of a server provided in an embodiment of the present application; Figure 4 Another schematic diagram of the structure of the client provided in the embodiment of the present application; Figure 5 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0016] The present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant invention, rather than to limit the invention. It is also necessary to explain that, for ease of description, only the parts related to the invention are shown in the accompanying drawings.

[0017] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The following is an explanation of the related technologies of the present application.

[0018] Remote communication channels are often transmission channels that have been encrypted by specific means. For example, remote communication channels can be encrypted through encrypted network protocols through user identity authentication, thereby improving the communication security of remote communication channels. In the specific use of this method of using encrypted network protocols, 1) a single confirmation method of user password and public key information will be used to authenticate the identities of both the server and the client. The so-called single confirmation method means that only one identity challenge is conducted between the server and the client, and the communication process can be started after the identity is confirmed; 2) In the process of encrypting communication data, the communication data is processed using a software encryption algorithm; 3) In the process of encrypting communication data, the encryption process is essentially a calculation process, and the calculation process is generally completed on the client; 4) The encrypted network protocol used often belongs to a standardized protocol process. The so-called labeled protocol process is the above-mentioned single identity authentication process. This standardized protocol process is the encryption method selected by most encrypted network protocols for remote communication.

[0019] However, the encryption network protocols in the above-mentioned related technologies have the following defects: 1) It is difficult to prevent user identity theft by only using a single identity challenge method. For example, if other users perform the process by disguising their identities, the encrypted communication data will be leaked; 2) The process of using only software encryption algorithms is actually inefficient in processing data and transmitting data; 3) All encryption operations are set to be executed locally, which actually takes up a lot of memory and CPU resources; 4) Since almost all encryption protocols are standardized and homogeneous encryption protocols (for example, the standard SSH protocol process), it is difficult to prevent communication data packets from being forged during remote communication.

[0020] Therefore, there are often some limitations for traditional remote communication channel protection mechanisms, especially for the protocol processing of user identity authentication, which uses a fixed protocol process and is difficult to cope with flexible and changeable attack methods. Traditional remote communication channel protection mechanisms use a fixed protocol process, which makes the data packets in the connection establishment process predictable and easy to be exploited by attackers.

[0021] Based on this, this application proposes a communication method, server and client based on the national secret encryption network protocol, which can solve the problem that the interference means of the communication channel are constantly changing during remote communication, posing challenges to communication security, and greatly improves the security of the communication channel.

[0022] Figure 1 The present application embodiment provides a flow chart of a communication method based on a national secret encryption network protocol, and the execution subject of the method may be the server described above. Figure 1 As shown, the method includes the following steps 301 to 304: Step 301: When the server receives the first national secret secure shell protocol connection request sent by the client, the server generates confirmation key negotiation completion information matching the first national secret secure shell protocol connection request, and sends the confirmation key negotiation completion information to the client.

[0023] In an embodiment of the present application, the above-mentioned first national secret secure shell protocol connection request includes: connection mode indication information, the above-mentioned connection mode includes: software algorithm connection mode or hardware algorithm connection mode, and the above-mentioned confirmation key negotiation completion information is used to indicate that the above-mentioned client and the above-mentioned server reach a handshake agreement.

[0024] In the embodiment of the present application, the first national secret secure shell protocol indicated by the above-mentioned first national secret secure shell protocol connection request is different from the standard national secret secure shell protocol. From the above content, it can be seen that the standard national secret secure shell protocol, that is, the standard encryption protocol, is an encryption protocol that is only verified once.

[0025] It can be understood that the first national secret security shell protocol in the embodiment of the present application is an exclusive national secret security shell protocol that requires two challenges or two verifications and three responses.

[0026] Furthermore, the above-mentioned selection of the encryption protocol in remote communication is indicated by a secure shell protocol connection request sent by the client. When the secure shell protocol connection request sent by the client is a first national secret secure shell protocol connection request, the server calls the communication connection algorithm of the challenge and response of the first national secret secure shell protocol, and completes the communication connection between the server and the client according to the communication connection algorithm.

[0027] Exemplarily, before executing the above challenge and response communication connection algorithm, the server needs to complete a handshake protocol with the client first, and then the challenge and response process can be performed to execute the communication connection.

[0028] Exemplarily, the above connection mode is used to indicate: after the handshake protocol between the client and the server is reached, the data transmission encryption method between the client and the server.

[0029] In one example, the software algorithm connection method means that after the handshake agreement between the client and the server is reached, the data transmission between the client and the server is encrypted using a software algorithm encryption method.

[0030] In one example, the hardware algorithm connection method means that after the handshake agreement between the client and the server is reached, the data transmission between the client and the server is encrypted by hardware encryption.

[0031] Furthermore, in the case where the connection mode is a hardware algorithm connection mode, there is a hardware encryption communication module on the server side, and the hardware encryption communication module is connected to the server to encrypt the communication data transmitted from the server to the client. In one example, the hardware encryption communication module can be a cryptographic machine, also known as a cryptographic card. It is understandable that after the hardware confidential communication module establishes a connection with the server, it can receive the data to be processed transmitted by the server, and output the encrypted data after the encryption is completed. In this way, the server can send the encrypted data directly to the client without the server calling its own software algorithm to perform encryption operations on the data.

[0032] In an embodiment of the present application, the above-mentioned server confirms the algorithm including the first national secret secure shell protocol. After it is possible to connect with the client through the first national secret secure shell protocol, it can send a confirmation key negotiation completion message to the client, thereby shaking hands with the client.

[0033] It is understandable that the reason why it is described here as "it is possible to connect with the client through the first national secret security shell protocol" is that the server only confirms that it has the algorithm of the first national secret security shell protocol and has the ability to use the algorithm of the first national secret security shell protocol to communicate with the client. However, it does not judge whether the client is a real client, and the judgment needs to be completed between the subsequent steps 302 to 304.

[0034] Step 302: When the server receives the identity authentication challenge information sent by the client, it generates identity confirmation information corresponding to the identity authentication challenge information, and generates an authentication challenge data packet based on the identity confirmation information.

[0035] In the embodiment of the present application, the above-mentioned authentication challenge data packet is used to instruct the above-mentioned client to send a result data packet corresponding to the above-mentioned authentication challenge data packet, and the above-mentioned identity authentication challenge information is used to instruct the above-mentioned server to generate identity confirmation information.

[0036] It is understandable that in the embodiment of the present application, the identity information of the above-mentioned client needs to be confirmed first. Therefore, when the server sends a key negotiation completion confirmation message to the client, and the client reaches a handshake agreement with the server through the key negotiation completion confirmation message, the client will send an identity authentication challenge message to the server, and the identity authentication challenge message is used to request the server to authenticate the identity of the client. The action of the client sending the identity authentication challenge message to the server is the first challenge before the server and the client formally use the first national secret secure shell protocol for communication connection; and the server generates the identity confirmation message as the first response.

[0037] Furthermore, the server authenticates the identity information of the client, and if it is confirmed to be a genuine client, it can generate identity confirmation information and authentication challenge data packets, which can trigger the client to send a result data packet to the server for authenticating its own authenticity. The action of the server sending the identity authentication challenge data packet to the client is the second challenge before the server and the client formally use the first national secret secure shell protocol to communicate and connect; and the client sending the result data packet based on the identity authentication challenge data packet is the second response.

[0038] Exemplarily, the above-mentioned identity authentication challenge data packet may be composed of a random challenge value. Specifically, the fixed structure data is signed by the server private key to generate an identity authentication challenge data packet, and the identity authentication challenge data packet is sent to the client.

[0039] It should be noted that since there is more than one way to authenticate identity information, for example, it can be user password verification or public key verification, the identity authentication challenge information sent by the client to the server may also include an indication of the authentication method. For example, if the identity authentication challenge information sent by the client is password-type information, then the authentication method is user password verification; if the identity authentication challenge information sent by the client is public key information, then the authentication method is public key verification. The embodiments of the present application do not limit this.

[0040] The following two identity authentication methods are verified: 1) User password verification, also known as user password authentication, identity authentication challenge information, that is, the challenge data is the hash operation result of (random challenge value generated by the server || user password after SM3 hash processing); when the server authenticates, it uses (random challenge value || user password received in the first challenge) for hashing to verify the identity authentication challenge information.

[0041] 2) Public key verification, that is, during public key authentication, the identity authentication challenge information, that is, the challenge data is the signature value signed using the client private key pair (session identifier (calculated by both parties during key negotiation) || authentication request protocol number || username to be logged in || service name || verification method name || random challenge value || verification algorithm name || client public key); during server verification, the client public key received in the first challenge is used to verify the signature of the same spliced ​​data.

[0042] Step 303: When the server obtains the smart key corresponding to the client and receives the result data packet sent by the client corresponding to the authentication challenge data packet, the server verifies the result data packet and the smart key by a preset verification method.

[0043] In an embodiment of the present application, the above-mentioned smart password key may be UKEY, in which a key pair of the user to be logged in is stored.

[0044] Furthermore, the smart password key may be directly connected to the server by hardware, or may be connected to the client by hardware.

[0045] Furthermore, after the server sends an identity authentication challenge data packet to the client, the server starts the step of obtaining the smart key.

[0046] In one example, when the smart password key directly forms a hardware connection with the server, the server directly obtains the smart key from the smart password key connected thereto.

[0047] In another example, when a hardware connection is formed between the smart password key and the client, the server obtains an authentication challenge data packet sent to the client that also includes a call instruction for calling the authentication random number of the smart key. Through the call instruction, the client can be triggered to generate an authentication random number for the smart key. When the server receives the authentication random number sent by the client and pairs it with the authentication random number of the smart key stored in its own storage, the server generates a smart key and sends the smart key together with the process of the client sending the result data packet to the server.

[0048] It should be noted that in the embodiment of the present application, the smart key may not be generated through a hardware cryptographic facility (ie, a smart cryptographic key).

[0049] Furthermore, the server generates a random number for identifying the smart key (the random number for identifying the smart key is different from the aforementioned random challenge value), and the challenge data packet sent to the client includes the random challenge value and the random number for identifying the smart key. After the client receives the random number for identifying the smart key, it uses the private key in the smart password key to sign the received random number for identifying the smart key, and then sends the random number for identifying the smart key and the signature value to the server. Before the server generates the smart key, it first compares the random number for identifying the smart key with the random number stored in itself. If they are the same, the user name to be logged in searches for the corresponding public key in the database for signature verification to generate the smart key.

[0050] Step 304: When the result data packet meets a preset threshold and the smart key verification meets a preset password, the server sends a connection request to the client.

[0051] In an embodiment of the present application, the connection request is used to request to establish a communication connection between the client and the server.

[0052] Exemplarily, the above-mentioned preset threshold value may be pre-set or user-defined, which is not limited in the embodiments of the present application.

[0053] Exemplarily, the preset password may be pre-set or user-defined, which is not limited in the embodiments of the present application.

[0054] If the verification is successful, the server sends a connection request to the client, indicating that a communication connection can be established with the client according to the first national secret secure shell protocol. The connection request is the third response.

[0055] In the method provided by the embodiment of the present application, when the server receives the first national secret secure shell protocol connection request sent by the client, the server generates confirmation key negotiation completion information matching the first national secret secure shell protocol connection request, and sends the confirmation key negotiation completion information to the client (the first national secret secure shell protocol connection request includes: connection mode indication information, the connection mode includes: software algorithm connection mode or hardware algorithm connection mode, and the confirmation key negotiation completion information is used to indicate that the client and the server have reached a handshake agreement); thereafter, when the server receives the identity authentication challenge information sent by the client, it generates identity confirmation information corresponding to the identity authentication challenge information, and generates an authentication challenge data packet for instructing the client to send a result data packet based on the identity confirmation information, and the identity authentication challenge information is used to instruct the server to generate identity confirmation information; thereafter, when the server obtains the smart key corresponding to the client and receives the result data packet sent by the client corresponding to the authentication challenge data packet, the result data packet and the smart key are verified by a preset verification method; when the result data packet meets the preset threshold and the smart key verification meets the preset password, the server sends a connection request to the client to establish a connection. In this way, before the client and the server establish a communication connection, they need to go through two challenge processes, namely the identity authentication challenge corresponding to the identity authentication challenge information and the authentication challenge data packet. Combined with the three response processes of identity confirmation information, result data packet and connection request, the communication connection can be established, which greatly improves the security and reliability of the communication connection establishment process.

[0056] In another embodiment of the present application, a specific implementation method for generating and sending confirmation key negotiation completion information is also provided. Exemplarily, the specific implementation of the above-mentioned "when the server receives the first national secret secure shell protocol connection request sent by the client, the server generates confirmation key negotiation completion information that matches the first national secret secure shell protocol connection request, and sends the confirmation key negotiation completion information to the server" includes: when the server receives the first national secret secure shell protocol connection request sent by the client, the server sends the first verification information to the client; after receiving the encrypted unique value sent by the client, the encrypted unique value is decrypted by the server's decryption private key corresponding to the encryption public key of the server, a server unique value is generated, key negotiation is performed by the server unique value, a confirmation key negotiation completion information is generated between the server and the client, and the confirmation key negotiation completion information is sent to the client.

[0057] Exemplarily, the first verification information is used to request the client to send verification information for verifying the identity of the client, and the first verification information includes a second random number matching the first random number, the signature public key information of the server, the encryption public key information of the server and the signature information of the server.

[0058] It is understandable that in the embodiment of the present application, the request for negotiation between the client and the server, or the request to reach a handshake agreement, or the request for the server to send a confirmation key negotiation completion message is different from the previous related technologies. In the embodiment of the present application, the client generates a first random number, and wraps the first random number in a first national secret secure shell protocol connection request and sends it to the server.

[0059] Then, after receiving the first national secret secure shell protocol connection request, the server generates a second random number corresponding to the first random number, wherein the weight ratio between the first random number and the second random number is equal.

[0060] Furthermore, when the server receives a first national secret secure shell protocol connection request containing a first random number and generates a second random number, the server signs the first random number and the second random number using the server private key, and sends the signed second random number, the server signature public key, the server encryption public key, and the signature value of the first random number and the second random number signed by the server private key to the client, that is, sending the first verification information to the client.

[0061] The above “the weight ratio between the first random number and the second random number is equivalent” is explained as follows: When performing key negotiation between the server and the client, both parties need to provide a piece of data for calculating the session key. Originally, the two parties provided a randomly generated key pair, which is modified here to a random number. While simplifying the amount of calculation, it ensures that the data provided by both parties are of the same length and random, that is, the weight ratio is equivalent, which can also be understood as the same weight.

[0062] In an embodiment of the present application, after the client receives the above-mentioned first verification information, the client can use the server signature public key sent by the server to the client to verify the signature value of the first random number and the second random number signed by the above-mentioned server private key, generate a random unique value, and use the server encryption public key sent by the server to the client in the first verification information to encrypt the random unique value to generate an encrypted unique value, and the client sends the encrypted unique value to the server, that is, the server in the aforementioned content "receives the encrypted unique value sent by the client".

[0063] Exemplarily, the above-mentioned key negotiation is performed through the encrypted unique value, and the process includes: the client and the server respectively calculate the session identifier, IV vector, symmetric key and integrity key between the client and the server according to the server-specific value corresponding to the encrypted unique value, and when the calculation is completed and the result meets the preset calculation result, generate confirmation key negotiation completion information between the client and the client, and send the confirmation key negotiation completion information to the client.

[0064] In another embodiment of the present application, a specific implementation method for confirming the specific type of the national secret secure shell protocol between the server and the client is also provided. Exemplarily, before the aforementioned "when the server receives the first national secret secure shell protocol connection request sent by the client, the server generates a confirmation key negotiation completion message that matches the first national secret secure shell protocol connection request", the communication method based on the national secret encryption network protocol provided in the embodiment of the present application includes: receiving the first information sent by the above-mentioned client, and opening a selection interface for the communication connection matching method between the above-mentioned client and the above-mentioned server according to the above-mentioned first information.

[0065] Exemplarily, after receiving the first information, the server knows that the client wants to establish an encrypted communication connection with the server, and on the other hand, needs to open a public entrance for selecting the encrypted communication protocol so that it can subsequently connect according to the first national secret secure shell protocol sent by the client and confirm that the communication connection protocol between the client and the server is the first national secret secure shell protocol.

[0066] It can be understood that the first national secret secure shell protocol and the standard secure shell protocol are different communication connection protocols. Therefore, the public entrance for selecting the encrypted communication protocol includes multiple communication protocol branches with different branches. When the server subsequently receives the first national secret secure shell protocol connection request sent by the client, it can be confirmed that the communication connection protocol between the client and the server is the first national secret secure shell protocol.

[0067] In another embodiment of the present application, a specific implementation method is provided in which the communication between the server and the client is encrypted by a hardware encryption module, and then the communication data is transmitted. Exemplarily, the above-mentioned server is connected to the hardware encryption communication module, and the above-mentioned hardware encryption communication module is used to generate a hardware communication verification password. In the case where the above-mentioned first national secret secure shell protocol connection request includes a hardware algorithm connection method, the above-mentioned "generating identity confirmation information corresponding to the above-mentioned identity authentication challenge information, and generating an authentication challenge data packet based on the above-mentioned identity confirmation information" specific implementation method includes: triggering the above-mentioned hardware encryption module to start encrypting the communication connection between the above-mentioned client and the above-mentioned server, and generating identity confirmation information corresponding to the above-mentioned identity authentication challenge information, and generating an authentication challenge data packet based on the above-mentioned identity confirmation information.

[0068] Exemplarily, it can be known from the foregoing content that the above-mentioned hardware encryption module can be a cryptographic machine, a cryptographic card, etc. connected to a server.

[0069] It can be understood that the interface libraries of the cryptographic machine and the cryptographic card are unified by the 0018 interface standard, so the same logic calls can be used.

[0070] Furthermore, when the server confirms that it is connected to the hardware encryption module, it can start encrypting the communication connection between the above-mentioned client and the above-mentioned server by triggering the hardware encryption module, and encrypt the communication process between the server and the client after reaching a handshake agreement through the hardware communication verification password.

[0071] In another embodiment of the present application, a specific implementation method is provided in which the server confirms the software algorithm and the hardware algorithm before the server and the client establish a connection. Exemplarily, before "when the server receives the first national secret secure shell protocol connection request sent by the client, the server generates a confirmation key negotiation completion message that matches the first national secret secure shell protocol connection request", the communication method based on the national secret encryption network protocol provided in the embodiment of the present application also includes: determining the interface file path in the server that matches the hardware encryption module; the server obtains the configuration parameters of the hardware encryption module through the interface file path, and configures the interface corresponding to the interface file path in the server through the configuration parameters, and the server is connected to the hardware encryption module.

[0072] Exemplarily, the interface library file path of the hardware encryption communication module can be specified in the configuration file responsible for connecting the client and the server, and whether data can be transmitted smoothly through the interface library file path determines whether the hardware algorithm connection mode can be enabled.

[0073] Generally, when the interface library file path can smoothly transmit data, it is determined that the hardware algorithm connection mode can be enabled; when the interface library file path cannot smoothly transmit data, it is determined that the hardware algorithm connection mode cannot be enabled.

[0074] Exemplarily, in the process of obtaining configuration parameters, the interface call initialization of the hardware encryption module can be completed by reading the relevant configuration of the hardware algorithm connection method in the configuration file between the server and the client, and after the initialization is completed and the hardware encryption module interface is turned on, the hardware algorithm connection method is selected to perform subsequent communication data encryption.

[0075] It is understandable that after the initialization is completed, assuming that the hardware encryption module interface fails to be opened, it is also possible to switch to the software algorithm connection mode, thereby avoiding errors in the hardware encryption module that lead to subsequent inability to communicate between the server and the client.

[0076] In another embodiment of the present application, a specific implementation method of the hardware algorithm connection method between the server and the hardware encryption module is also provided after the hardware algorithm connection method is selected between the server and the client. Exemplarily, the above-mentioned first national secret secure shell protocol connection request also includes: hardware encryption module activation indication information, before "triggering the above-mentioned hardware encryption module to start encrypting the communication connection between the above-mentioned client and the above-mentioned server", the communication method based on the national secret encryption network protocol provided in the embodiment of the present application also includes: the above-mentioned server obtains the interface status between the above-mentioned server and the above-mentioned hardware encryption module; when the above-mentioned server obtains that the interface status between the above-mentioned server and the above-mentioned hardware encryption module is in an open state, triggering the above-mentioned hardware encryption module to start encrypting the communication connection between the above-mentioned client and the above-mentioned server.

[0077] The following describes the process of triggering the hardware encryption module to establish a communication connection between the server and the client through a hardware algorithm connection.

[0078] It can be understood that when the server obtains that the interface status between the above-mentioned server and the above-mentioned hardware encryption module is in an open state, the server opens the interface library of the hardware encryption module, starts the hardware encryption module, and obtains the session between the server and the client; thereafter, the server calls the hardware encryption module interface, and the operation parameters between the server and the client can be input into the hardware encryption module interface.

[0079] Furthermore, when the hardware encryption module is turned on to perform communication connection encryption for the data to be transmitted in the server, the remote communication process of the server is as follows: the server first calls the interface between the hardware encryption module and the server as the caller, and then, as the operation requester, encapsulates and packages the communication parameters of the interface passed into the hardware encryption module, and transmits them to the hardware encryption module as the recipient through the remote communication channel; the hardware encryption module encapsulates and packages the communication data through the remote communication channel, and performs encryption operation on the communication data as the operation processor; after the hardware encryption module completes the encryption operation, it returns the operation result to the server as the operation requester, and the server can obtain the encrypted data corresponding to the data to be transmitted through the interface between the hardware encryption module and the server in the interface library.

[0080] In another embodiment of the present application, a multi-factor encryption mode between the server and the client is also provided, that is, multiple challenges and multiple responses, and a specific implementation method that can be combined with other hardware, such as a smart password key to complete the communication connection. Exemplarily, when the smart password key is connected to the server, the specific implementation method of "when the above-mentioned server obtains the smart password key corresponding to the above-mentioned client, and receives the result data packet sent by the above-mentioned client corresponding to the above-mentioned identification challenge data packet, the above-mentioned result data packet and the above-mentioned smart key are verified by a preset verification method" mentioned in the above text includes: when the above-mentioned smart password key is triggered to generate a smart key, and when the result data packet sent by the above-mentioned client corresponding to the above-mentioned identification challenge data packet is received, the above-mentioned result data packet and the above-mentioned smart key are verified by a preset verification method.

[0081] Exemplarily, it can be known from the above content that when the smart password key is directly connected to the server, it can directly trigger the above-mentioned smart password key to generate a smart key.

[0082] Specifically, the smart password key has a corresponding database, and the smart key can be obtained by querying the database through the smart password key.

[0083] Exemplarily, the above-mentioned preset verification method may be: the server retrieves a smart key verification library (a database) for verification.

[0084] Exemplarily, when both the smart key and the result data packet are successfully verified, the server sends a connection request to the client.

[0085] Figure 2 This is a flow chart of a communication method based on a national secret encryption network protocol provided by an embodiment of the present application. The execution subject of the method can be the client mentioned above. Figure 2 As shown, the method includes the following steps 401 to 405: Step 401: The client sends a first national security shell protocol connection request to the server.

[0086] In the embodiment of the present application, the above-mentioned first national secret secure shell protocol connection request includes: connection mode indication information.

[0087] In the embodiment of the present application, the above-mentioned connection method includes: a software algorithm connection method or a hardware algorithm connection method.

[0088] Step 402: The client receives the key negotiation completion confirmation message sent by the server.

[0089] In an embodiment of the present application, the key negotiation completion confirmation information is used to indicate that the client and the server have reached a handshake agreement.

[0090] Step 403: Send identity authentication challenge information to the above server.

[0091] In an embodiment of the present application, the above-mentioned identity authentication challenge information is used to instruct the above-mentioned server to generate identity confirmation information.

[0092] Step 404: after receiving the authentication challenge data packet sent by the server, generate a result data packet corresponding to the authentication challenge data packet and send it to the server.

[0093] Step 405: upon receiving a connection request from the server, establishing a connection with the server.

[0094] In another embodiment of the present application, a specific implementation method for the client and the server to complete the handshake by confirming the key negotiation completion information is also provided. Exemplarily, the specific implementation of "the client sends a first national secret secure shell protocol connection request to the above-mentioned server" mentioned in the above text includes: the above-mentioned client sends a first national secret secure shell protocol connection request to the above-mentioned server, and the above-mentioned first national secret secure shell protocol connection request includes a first random number; the above-mentioned "the client sends a first national secret secure shell protocol connection request to the server", the method also includes: after receiving the first verification information sent by the above-mentioned server, generating a unique value according to the above-mentioned first verification information, and sending the above-mentioned unique value to the above-mentioned server.

[0095] Exemplarily, the above-mentioned unique value is a value encrypted by the above-mentioned server public key.

[0096] It can be understood that, as described above, the unique value can be decrypted by using the server's decryption private key corresponding to the server's encryption public key to generate the server-specific value.

[0097] Exemplarily, the first verification information is used to request the client to send verification information for verifying the identity of the client, and the first verification information includes a second random number matching the first random number, the signature public key information of the server, the encryption public key information of the server and the signature information of the server.

[0098] In another embodiment of the present application, a specific implementation method for confirming the specific type of the national secret secure shell protocol between the server and the client is also provided. Exemplarily, before the "client sends a first national secret secure shell protocol connection request to the above-mentioned server" mentioned above, the communication method based on the national secret encryption network protocol provided in the embodiment of the present application includes: the above-mentioned client sends a first message to the above-mentioned server.

[0099] Exemplarily, the first information is used to indicate that the communication connection matching mode is a first national secret secure shell protocol connection.

[0100] In another embodiment of the present application, a specific implementation method of the multi-factor encryption mode between the client and the server is also provided. Exemplarily, when the smart password key is connected to the client, the specific implementation method of "after receiving the authentication challenge data packet sent by the server, generating a result data packet corresponding to the above authentication challenge data packet, and sending it to the above server" mentioned in the above text includes: upon receiving the authentication challenge data packet sent by the server, triggering the above smart password key to generate a smart password key, and generating a result data packet corresponding to the above authentication challenge data packet; sending the above smart key and the above result data packet to the above server.

[0101] Exemplarily, it can be seen from the above content that when the smart password key is directly connected to the client, after the client receives the authentication random number corresponding to the smart password key sent by the server, it calls the interface of the smart password key to check the smart key (such as whether there is a smart password key and the smart key pair in the local area), and then the client uses the private key in the smart key pair to sign the random number and sends the random number and signature value to the server; the server confirms the binding status of the user to be logged in and the smart password key. If the user to be logged in is not bound to the smart password key, the smart password key verification is not performed; if the user to be logged in is bound to the smart password key, check whether the signature value is empty and compare whether the random number is consistent.

[0102] During the comparison process, if the random number is empty, it will not pass the verification. Therefore, it is necessary to first compare whether the random number is empty. If it is not empty, then find the corresponding public key and verify the signature value. If the verification passes, the verification of the smart password key is passed.

[0103] It should be noted that, in the above process, assuming that the client is not connected to the smart password key, the sent data is all 0.

[0104] The present application also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the training rule determination method described in the present application is implemented. For example, the following can be executed: Figure 1 or Figure 2 The individual steps of the method are shown.

[0105] The present invention provides a computer program product, which includes instructions that are executed by a processor when the processor executes the instructions. Figure 1 or Figure 2 The individual steps of the method are shown.

[0106] It should be noted that although the operations of the method of the present invention are described in a particular order in the drawings, this does not require or imply that the operations must be performed in this particular order or that all illustrated operations must be performed to achieve desired results.

[0107] Figure 3 This is a block diagram of a server according to an embodiment of the present application. Figure 3 The device includes a first generating unit 601, a confirming unit 602, a first executing unit 603 and a first sending unit 604.

[0108] The first generating unit 601 is configured to, when receiving a first national secret secure shell protocol connection request sent by a client, generate, by the server, confirmation key negotiation completion information that matches the first national secret secure shell protocol connection request, and send the confirmation key negotiation completion information to the server, wherein the first national secret secure shell protocol connection request includes: connection mode indication information, wherein the connection mode includes: software algorithm connection mode or hardware algorithm connection mode, and the confirmation key negotiation completion information is used to indicate that the client and the server have reached a handshake agreement; A confirmation unit 602 is used to generate identity confirmation information corresponding to the identity authentication challenge information when receiving the identity authentication challenge information sent by the client, and generate an authentication challenge data packet based on the identity authentication information, wherein the authentication challenge data packet is used to instruct the client to send a result data packet corresponding to the authentication challenge data packet, and the identity authentication challenge information is used to instruct the server to generate identity confirmation information; The first execution unit 603 is used to verify the result data packet and the smart key by a preset verification method when the smart key corresponding to the client is obtained and the result data packet corresponding to the authentication challenge data packet sent by the client is received; The first sending unit 604 is used for, when the result data packet meets a preset threshold and the smart key verification meets a preset password, the server sends a connection request to the client, and the connection request is used to request the client to establish a communication connection with the server.

[0109] In one embodiment, the first generating unit 601 is specifically used for: The server, upon receiving the first national secret secure shell protocol connection request sent by the client, sends first verification information to the client, the first verification information being used to request the client to send verification information for verifying the identity of the client, the first verification information including a second random number matching the first random number, signature public key information of the server, encryption public key information of the server and signature information of the server; After receiving the encrypted unique value sent by the client, the encrypted unique value is decrypted by the decryption private key of the server corresponding to the encryption public key of the server to generate the server-specific value, key negotiation is performed through the server-specific value, confirmation key negotiation completion information is generated between the client and the client, and the confirmation key negotiation completion information is sent to the client.

[0110] In one embodiment, the first execution unit 603 is further configured to: The first information sent by the client is received, and a selection interface for a communication connection matching mode between the client and the server is opened according to the first information.

[0111] In one embodiment, the server is connected to a hardware encryption communication module, and the hardware encryption communication module is used to generate a hardware communication verification password. When the first national secret secure shell protocol connection request includes a hardware algorithm connection mode, the first generation unit 601 is further used to: The hardware encryption module is triggered to start encrypting the communication connection between the client and the server, and identity confirmation information corresponding to the identity authentication challenge information is generated, and an authentication challenge data packet is generated based on the identity confirmation information.

[0112] In one embodiment, the first execution unit 603 is further configured to: Determine an interface file path in the server that matches the hardware encryption module; The server obtains the configuration parameters of the hardware encryption module through the interface file path, and configures the interface corresponding to the interface file path in the server through the configuration parameters. The server is connected to the hardware encryption module.

[0113] In one embodiment, the first national encryption secure shell protocol connection request further includes: hardware encryption module activation indication information, and the first execution unit 603 is further used to: The server obtains the interface status between the server and the hardware encryption module; When the server obtains that the interface status between the server and the hardware encryption module is in an open state, the hardware encryption module is triggered to start encrypting the communication connection between the client and the server.

[0114] In one embodiment, when the smart password key is connected to the server, the first execution unit 603 is specifically used to: When the smart password key is triggered to generate a smart key and a result data packet corresponding to the authentication challenge data packet sent by the client is received, the result data packet and the smart key are verified by a preset verification method.

[0115] Figure 4 This is a block diagram of a client according to an embodiment of the present application. Figure 4 The client includes a second sending unit 701, a receiving unit 702, a second generating unit 703 and a second executing unit 704.

[0116] The second sending unit 701 is used to send a first national secret secure shell protocol connection request to the server, wherein the first national secret secure shell protocol connection request includes: connection mode indication information, and the connection mode includes: software algorithm connection mode or hardware algorithm connection mode; The receiving unit 702 is configured to receive key negotiation completion confirmation information sent by the server, where the key negotiation completion confirmation information is used to indicate that the client and the server have reached a handshake agreement; The second sending unit 701 is further used to send identity authentication challenge information to the server, where the identity authentication challenge information is used to instruct the server to generate identity confirmation information; The second generating unit 703 is used to generate a result data packet corresponding to the authentication challenge data packet after receiving the authentication challenge data packet sent by the server, and send it to the server; The second execution unit 704 is configured to establish a connection with the server upon receiving a connection request from the server.

[0117] In one embodiment, the second sending unit 701 is used to send a first national secret secure shell protocol connection request to the server, wherein the first national secret secure shell protocol connection request includes a first random number; The second sending unit 701 is further used to generate a unique value according to the first verification information sent by the server after receiving the first verification information sent by the server, and send the unique value to the server, wherein the unique value is a numerical value encrypted by the public key of the server, and the first verification information is used to request the client to send verification information for verifying the identity of the client, and the first verification information includes a second random number matching the first random number, the signature public key information of the server, the encrypted public key information of the server and the signature information of the server.

[0118] In one embodiment, the second sending unit 701 is further used to send first information to the server, where the first information is used to indicate that the communication connection matching mode is a first national security shell protocol connection.

[0119] In one embodiment, when the smart password key is connected to the client, the second execution unit 704 is used to: After receiving the authentication challenge data packet sent by the server, triggering the smart password key to generate a smart key, and generating a result data packet corresponding to the authentication challenge data packet; The smart key and the result data packet are sent to the server.

[0120] It should be understood that the units recorded in the server and the client correspond to the steps in the method described in the accompanying drawings. Therefore, the operations and features described above for the method are also applicable to the server and the client and the units contained therein, and will not be repeated here. The server and the client can be pre-implemented in the browser or other security application of the computer device, or can be loaded into the browser or its security application of the computer device by downloading or the like. The corresponding units in the server and the client can cooperate with the units in the computer device to implement the solution of the embodiment of the present application.

[0121] For the several modules or units mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0122] It should be noted that for details not disclosed in the server and client of the embodiments of the present application, please refer to the details disclosed in the above embodiments of the present application, which will not be repeated here.

[0123] Reference below Figure 5 , Figure 5 FIG. 1 is a schematic diagram showing a structure of a computer device suitable for implementing an embodiment of the present application. Figure 5 As shown, the computer system 1700 includes a central processing unit (CPU) 1701, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 1702 or the program loaded from the storage part 1708 to the random access memory (RAM) 1703. In the RAM 1703, various programs and data required for the operation instructions of the system are also stored. The CPU 1701, the ROM 1702, and the RAM 1703 are connected to each other through a bus 1704. An input / output (I / O) interface 1705 is also connected to the bus 1704.

[0124] The following components are connected to the I / O interface 1705: an input section 1706 including a keyboard, a mouse, etc.; an output section 1707 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1708 including a hard disk, etc.; and a communication section 1709 including a network interface card such as a LAN card, a modem, etc. The communication section 1709 performs communication processing via a network such as the Internet. A drive 1710 is also connected to the I / O interface 1705 as needed. A removable medium 1711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1710 as needed, so that a computer program read therefrom is installed into the storage section 1708 as needed.

[0125] In particular, according to an embodiment of the present application, the above reference flow chart Figure 1 or Figure 2 The described process can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through the communication part 1709, and / or installed from a removable medium 1711. When the computer program is executed by the central processing unit (CPU) 1701, the above-mentioned functions defined in the system of the present application are executed.

[0126] It should be noted that the computer-readable medium shown in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium such as a computer-readable storage medium that can send, propagate or transmit a program for use by or in conjunction with an instruction execution system, device or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0127] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operating instructions of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the aforementioned module, program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, the boxes represented by two connections can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operating instruction, or can be implemented with a combination of dedicated hardware and computer instructions.

[0128] The units or modules involved in the embodiments described in the present application may be implemented by software or hardware. The units or modules described may also be set in a processor. For example, it may be described as: a processor includes a first receiving module, a second receiving module, and a sending module. The names of these units or modules do not, in some cases, constitute limitations on the units or modules themselves.

[0129] As another aspect, the present application further provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiment, or may exist independently without being assembled into the electronic device. The above computer-readable storage medium stores one or more programs, and when the above programs are used by one or more processors to execute the communication method based on the national encryption network protocol described in the present application.

[0130] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the aforementioned disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present application (but not limited to) by each other to form a technical solution.

Claims

1. A communication method based on a national secret encryption network protocol, characterized in that: Applicable to servers, including: In the case where the server receives a first national secret secure shell protocol connection request sent by a client, the server generates confirmation key negotiation completion information matching the first national secret secure shell protocol connection request, and sends the confirmation key negotiation completion information to the client, the first national secret secure shell protocol connection request including: connection mode indication information, the connection mode including: software algorithm connection mode or hardware algorithm connection mode, the confirmation key negotiation completion information is used to indicate that the client and the server reach a handshake agreement; When the server receives the identity authentication challenge information sent by the client, it generates identity confirmation information corresponding to the identity authentication challenge information, and generates an authentication challenge data packet based on the identity confirmation information, wherein the authentication challenge data packet is used to instruct the client to send a result data packet corresponding to the authentication challenge data packet, and the identity authentication challenge information is used to instruct the server to generate identity confirmation information; When the server obtains the smart key corresponding to the client and receives the result data packet sent by the client corresponding to the authentication challenge data packet, verifying the result data packet and the smart key by a preset verification method; When the result data packet meets a preset threshold and the smart key verification meets a preset password, the server sends a connection request to the client, and the connection request is used to request the client to establish a communication connection with the server.

2. The method according to claim 1, characterized in that When the server receives the first national secret secure shell protocol connection request sent by the client, the server generates confirmation key negotiation completion information matching the first national secret secure shell protocol connection request, and sends the confirmation key negotiation completion information to the server, including: The server, upon receiving the first national secret secure shell protocol connection request sent by the client, sends first verification information to the client, the first verification information being used to request the client to send verification information for verifying the identity of the client, the first verification information including a second random number matching the first random number, signature public key information of the server, encryption public key information of the server and signature information of the server; After receiving the encrypted unique value sent by the client, the encrypted unique value is decrypted by the decryption private key of the server corresponding to the encryption public key of the server to generate the server-specific value, key negotiation is performed through the server-specific value, confirmation key negotiation completion information is generated between the client and the client, and the confirmation key negotiation completion information is sent to the client.

3. The method according to claim 1, characterized in that In the case where the server receives a first national secret secure shell protocol connection request sent by the client, before the server generates confirmation key negotiation completion information matching the first national secret secure shell protocol connection request, the method further includes: The first information sent by the client is received, and a selection interface for a communication connection matching mode between the client and the server is opened according to the first information.

4. The method according to claim 1, characterized in that: The server is connected to a hardware encryption communication module, and the hardware encryption communication module is used to generate a hardware communication verification password. When the first national secret secure shell protocol connection request includes a hardware algorithm connection mode, the identity confirmation information corresponding to the identity authentication challenge information is generated, and the authentication challenge data packet is generated based on the identity confirmation information, including: The hardware encryption module is triggered to start encrypting the communication connection between the client and the server, and identity confirmation information corresponding to the identity authentication challenge information is generated, and an authentication challenge data packet is generated based on the identity confirmation information.

5. The method according to claim 1, characterized in that: In the case where the server receives a first national secret secure shell protocol connection request sent by the client, before the server generates confirmation key negotiation completion information matching the first national secret secure shell protocol connection request, the method further includes: Determine an interface file path in the server that matches the hardware encryption module; The server obtains the configuration parameters of the hardware encryption module through the interface file path, and configures the interface corresponding to the interface file path in the server through the configuration parameters. The server is connected to the hardware encryption module.

6. The method according to claim 4, characterized in that The first national secret secure shell protocol connection request also includes: hardware encryption module activation indication information, and before triggering the hardware encryption module to start encrypting the communication connection between the client and the server, the method also includes: The server obtains the interface status between the server and the hardware encryption module; When the server obtains that the interface status between the server and the hardware encryption module is in an open state, the hardware encryption module is triggered to start encrypting the communication connection between the client and the server.

7. The method according to claim 1, characterized in that In the case where the smart password key corresponding to the smart key is connected to the server, the server obtains the smart key corresponding to the client and receives a result data packet sent by the client corresponding to the authentication challenge data packet, verifying the result data packet and the smart key by a preset verification method, including: When the smart password key is triggered to generate a smart key and a result data packet corresponding to the authentication challenge data packet sent by the client is received, the result data packet and the smart key are verified by a preset verification method.

8. A communication method based on a national secret encryption network protocol, applied to a client, characterized in that: The method comprises: The client sends a first national secret secure shell protocol connection request to the server, wherein the first national secret secure shell protocol connection request includes: connection mode indication information, wherein the connection mode includes: software algorithm connection mode or hardware algorithm connection mode; The client receives key negotiation completion confirmation information sent by the server, where the key negotiation completion confirmation information is used to indicate that the client and the server have reached a handshake agreement; Sending identity authentication challenge information to the server, wherein the identity authentication challenge information is used to instruct the server to generate identity confirmation information; After receiving the authentication challenge data packet sent by the server, generating a result data packet corresponding to the authentication challenge data packet and sending it to the server; When a connection request from the server is received, a connection is established with the server.

9. The method according to claim 8, characterized in that The client sends a first national secret secure shell protocol connection request to the server, including: The client sends a first national secret secure shell protocol connection request to the server, wherein the first national secret secure shell protocol connection request includes a first random number; The client sends a first national secret secure shell protocol connection request to the server, and then the method further includes: After receiving the first verification information sent by the server, a unique value is generated according to the first verification information, and the unique value is sent to the server. The unique value is a value encrypted by the public key of the server. The first verification information is used to request the client to send verification information for verifying the identity of the client. The first verification information includes a second random number matching the first random number, the signature public key information of the server, the encrypted public key information of the server and the signature information of the server.

10. The method according to claim 8, characterized in that Before the client sends a first national secret secure shell protocol connection request to the server, the method further includes: The client sends first information to the server, where the first information is used to indicate that the communication connection matching mode is a first national secret secure shell protocol connection.

11. The method according to claim 8, characterized in that In the case where the smart password key is connected to the client, after receiving the authentication challenge data packet sent by the server, generating a result data packet corresponding to the authentication challenge data packet and sending it to the server, including: Upon receiving the authentication challenge data packet sent by the server, triggering the smart password key to generate a smart key, and generating a result data packet corresponding to the authentication challenge data packet; The smart key and the result data packet are sent to the server.

12. A server, characterized in that: The server comprises: A first generating unit is configured to, when receiving a first national secret secure shell protocol connection request sent by a client, generate, by the server, confirmation key negotiation completion information that matches the first national secret secure shell protocol connection request, and send the confirmation key negotiation completion information to the server, wherein the first national secret secure shell protocol connection request includes: connection mode indication information, wherein the connection mode includes: a software algorithm connection mode or a hardware algorithm connection mode, and the confirmation key negotiation completion information is used to indicate that the client and the server have reached a handshake agreement; A confirmation unit, configured to generate identity confirmation information corresponding to the identity confirmation information upon receiving the identity authentication challenge information sent by the client, and generate an authentication challenge data packet based on the identity confirmation information, wherein the authentication challenge data packet is used to instruct the client to send a smart key, and the identity authentication challenge information is used to instruct the server to generate identity confirmation information; A first execution unit is used to verify the result data packet and the smart key by a preset verification method when the smart key corresponding to the client is obtained and the result data packet corresponding to the authentication challenge data packet sent by the client is received; The first sending unit is used for, when the result data packet meets a preset threshold and the smart key verification meets a preset password, the server sends a connection request to the client, and the connection request is used to request the client to establish a communication connection with the server.

13. A client, characterized in that: The client comprises: A second sending unit is used to send a first national secret secure shell protocol connection request to the server, wherein the first national secret secure shell protocol connection request includes: connection mode indication information, and the connection mode includes: software algorithm connection mode or hardware algorithm connection mode; A receiving unit, configured to receive key negotiation completion confirmation information sent by the server, wherein the key negotiation completion confirmation information is used to indicate that the client and the server have reached a handshake agreement; The second sending unit is further used to send identity authentication challenge information to the server, wherein the identity authentication challenge information is used to instruct the server to generate identity confirmation information; A second generating unit is used to generate a result data packet corresponding to the authentication challenge data packet after receiving the authentication challenge data packet sent by the server, and send the result data packet to the server; The second execution unit is configured to establish a connection with the server upon receiving a connection request from the server.

Images