End-to-end communication method based on ECDHE

Abstract

The invention discloses an ECDHE-based end-to-end communication method, belongs to an end-to-end communication method in the technical field of communication, and aims to solve the technical problems of many handshake times and low data transmission efficiency when a TLS handshake is adopted to establish a connection between a client and a server in the prior art. The method comprises a handshake stage, a communication stage and a termination stage. During handshake, the client sends a request to the server, and transmits an ECDHE key pair public key instantly generated by the client; after the server side receives the request, if the request is refused, connection establishment between the client side and the server side is refused; if the client agrees with the request, establishing connection between the client and the server, and configuring TCP connection as a nodealy mode; the server side performs handshake with a back hand, takes out a pair of ECDHE secret keys from the secret key pool and returns a public key; and according to the returned public key and the randomly generated salt value, the two parties derive a shared key based on an HDKF algorithm, handshake and identity authentication are completed, and a full-duplex communication channel is established and marked as a session window.

Description

Technical Field

[0001] The present invention belongs to the field of communication technology and relates to an end-to-end communication method, and in particular to an end-to-end communication method based on ECDHE. Background Art

[0002] The development and application of Internet communication technology has made information omnipresent and connections possible at any time, but at the same time, Internet communication has also exposed a series of security issues. It is necessary to apply relevant security technologies in a targeted manner to enhance the security and reliability of communication systems and build a protective wall for information security.

[0003] The invention patent application with application number 202311677386.5 also discloses a data encryption transmission method based on the transport layer security protocol, which includes the following key steps: First, a secure connection between the client and the server is established through the TLS handshake protocol. During the handshake process, the communicating parties exchange digital certificates and perform digital verification through PKI to ensure the legitimacy of the identities of the communicating parties. Subsequently, two-factor authentication is introduced. After the identity authentication of both communicating parties is passed, a unique symmetric key is independently generated through the Diffie-Hellman key exchange protocol to achieve secure key negotiation. The data to be transmitted is obtained and segmented, and each data segment is nested and encrypted using the master key to form an encrypted data packet containing nested encrypted data segments and necessary metadata. After the transmission is completed, the identities of both communicating parties are authenticated through a password and a dynamic token, and decrypted through the negotiated key.

[0004] As mentioned in the invention patent application, most of the existing technologies need to establish a secure connection between the client and the server through a handshake protocol (such as TLS handshake) when performing data communication and transmission. TLS (Transport Layer Security Protocol) is used to ensure the security of network communications, and HTTPS is its typical application. The TLS handshake is the key process for the client and the server to establish a secure connection. The handshake process is as follows: 1. Client Hello: The client initiates a request, sending the supported TLS version, encryption algorithm list, random number, etc. 2. Server Hello: The server selects an encryption algorithm, returns its own random number, and attaches a digital certificate (including a public key); 3. Key negotiation: The client generates a pre-master key, encrypts it with the server's public key, and sends it to the server; The server decrypts with the private key, and both parties calculate the session key based on the pre-master key; 4. Session encryption starts: Both parties switch to symmetric encryption mode and use the session key to encrypt subsequent communications.

[0005] Although a secure connection can be established between the client and the server through the above TLS handshake, its TLS handshake also has some problems: 1. Performance overhead, TLS handshake involves multiple information exchanges and encryption calculations, especially for high-concurrency scenarios; 2. Certificate management issues, certificates may be expired, misconfigured or forged; 3. Downgrade attacks, attackers may induce clients and servers to use weaker encryption algorithms; 4. Reliance on the CA trust system, if the CA (certificate authority) is compromised, TLS security will be compromised. Summary of the invention

[0006] The purpose of the present invention is to provide an end-to-end communication method based on ECDHE in order to solve the technical problems of many handshake times and low data transmission efficiency existing in the prior art when using TLS handshake to establish a connection between a client and a server.

[0007] In order to achieve the above-mentioned purpose, the present invention specifically adopts the following technical solutions: An end-to-end communication method based on ECDHE comprises the following steps: Step 1, handshake phase; The client sends a request to the server and transmits the public key of the ECDHE key pair generated by the client in real time; After receiving the request, if the server rejects the request, it will refuse to establish a connection between the client and the server; if it agrees to the request, it will establish a connection between the client and the server and configure the TCP connection to nodealy mode; The server performs a handshake, takes out an ECDHE key pair from the key pool and returns the public key. Based on the returned public key and the randomly generated salt value, the two parties derive a shared key based on the HDKF algorithm, complete the handshake and identity authentication, and establish a full-duplex communication channel and mark it as a session window. Step 2, communication phase; The client and server jointly maintain the communication session window, and all streaming information is encrypted using a shared key as an AES key; Step 3, termination phase; When communication needs to be terminated, one end sends a FIN packet to the other end and the connection is terminated.

[0008] Furthermore, in step 1, when the public key is returned, an integer representing eight bits is also returned along with the public key; if ordinary information is transmitted, the integer returned when the public key is returned is a null value; if important information is transmitted, the integer returned when the public key is returned is a non-null value.

[0009] Furthermore, when performing identity authentication between both parties, the public key AAD information is used as the authentication password.

[0010] Furthermore, in step 2, each data packet in the data packet is dynamically unpacked by a machine learning algorithm based on uncoupled linear ordinary differential equations.

[0011] Furthermore, each data packet includes a data packet size in a header, and each data packet allows a receiving end to receive data in an exact manner.

[0012] Furthermore, in step 2, after an unexpected communication disconnection occurs, the client sends a request to restore the connection to the server within the time range allowed by the server. If the server agrees to restore the connection, it starts to verify the client's request header for restoring the connection based on the cached session. After successful verification, the TCP connection is reused and restored to the state before the disconnection. The data that failed to be sent is resent from the buffer.

[0013] The beneficial effects of the present invention are as follows: 1. In the present invention, the ECDHE encryption algorithm is used for key exchange during handshake, and the HKDF is used to derive the key. Both identity authentication and data encryption can be implemented at the protocol layer, so that the number of handshakes is reduced and the data transmission efficiency is higher.

[0014] 2. In the present invention, data packets are transmitted in fragments, and the transmission size is marked in the header of each data packet. This allows the protocol layer to dynamically allocate data packet sizes based on MTU to cope with complex network environments, improve transmission efficiency, and reduce the possibility of data loss. In addition, streaming serialization and deserialization are used to replace JSON for data structures, avoiding the overhead of data conversion. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 It is a schematic diagram of the process of the present invention. DETAILED DESCRIPTION

[0016] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments.

[0017] Therefore, based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative work shall fall within the scope of protection of the present invention.

[0018] This embodiment provides an end-to-end communication method based on ECDHE, including the following steps: Step 1, handshake phase; First, the client sends a request to the server and transmits the public key of the ECDHE key pair generated by the client.

[0019] Then, after the server receives the request, if the request is rejected, the connection between the client and the server will be refused; if the request is approved, a connection between the client and the server will be established, and the TCP connection will be configured as nodealy mode, and the linger time will be set to 0 to avoid invalid waiting.

[0020] Finally, the server performs a back-hand handshake, takes out a pair of ECDHE key pairs from the key pool and returns the public key; based on the returned public key and the randomly generated salt value, the two parties derive a shared key based on the HDKF algorithm, complete the handshake and identity authentication, and the two parties establish a full-duplex communication channel and mark it as a session window.

[0021] When the public key is returned, an integer representing eight bits is also returned along with the public key; if ordinary information is transmitted, the integer returned when the public key is returned is a null value; if important information is transmitted, the integer returned when the public key is returned is a non-null value, and the non-null integer can be generated by an existing algorithm.

[0022] When authenticating the identities of both parties (i.e., the client and the server), the public key AAD information is used as the authentication password, that is, the identity authentication is completed during the handshake.

[0023] Step 2, communication phase; After the handshake is complete, both parties have derived and stored a shared key, and all streaming information is encrypted using the shared key as an AES key.

[0024] The client and the server jointly maintain the communication session window. Based on the MTU (maximum transmittable unit) and the current network environment, each segment of the data packet is dynamically unpacked through a machine learning algorithm based on uncoupled linear ordinary differential equations to avoid the performance overhead caused by the gateway splitting the data frame.

[0025] Each data packet should contain the packet size in the header to allow the receiving end to receive the data in an exact manner to ensure data integrity and prevent data loss.

[0026] During data transmission, JSON (such as HTTP POST and WebSocket data transmission) is used for data serialization and transmission; since the protocol library is implemented in Rust, an efficient serialization method using Google Protobuf and Apache Fury as an alternative is built in to accelerate the process of serializing explicit data into binary data that can be efficiently transmitted over the network.

[0027] If the network environment is unstable, the connection may be accidentally disconnected. The server and client should maintain session status information for a period of time. After an unexpected disconnection, within the time allowed by the server, once the client restores the network connection, the client sends a request to restore the connection to the server. If the server agrees to restore the connection, it will verify the client's request header for restoring the connection based on the cached session. After successful verification, the TCP connection will be reused to restore to the state before the disconnection, and the failed data will be resent from the buffer.

[0028] Step 3, termination phase; When communication needs to be terminated, one end sends a FIN packet to the other end and the connection is terminated.

[0029] This embodiment is implemented based on TCP / QUIC and uses the ECDHE encryption algorithm for key exchange. Since the HKDF derived key is used, both identity authentication and data encryption can be implemented at the protocol layer. Compared with the two existing protocols (WebSockets communication protocol, Matrix communication protocol), the handshake number in this embodiment is less and the transmission efficiency is higher. At the same time, in this embodiment, the data packet is transmitted in fragments, and the transmission size is marked in the header of each data packet. This allows the protocol layer in this embodiment to dynamically allocate the data packet size based on MTU to cope with complex network environments, improve transmission efficiency, and reduce the possibility of data loss. For data structures, streaming serialization and deserialization are used instead of JSON to avoid the overhead of data conversion. At the same time, this embodiment also uses a high-concurrency asynchronous runtime based on Rust, which can ensure stable high-concurrency response on low-performance servers.

Claims

1. An end-to-end communication method based on ECDHE, characterized in that: The following steps are involved: Step 1, handshake phase; The client sends a request to the server and transmits the public key of the ECDHE key pair generated by the client in real time; After receiving the request, if the server rejects the request, it will refuse to establish a connection between the client and the server; if it agrees to the request, it will establish a connection between the client and the server and configure the TCP connection to nodealy mode; The server performs a handshake, takes out an ECDHE key pair from the key pool and returns the public key. Based on the returned public key and the randomly generated salt value, the two parties derive a shared key based on the HDKF algorithm, complete the handshake and identity authentication, and establish a full-duplex communication channel and mark it as a session window. Step 2, communication phase; The client and server jointly maintain the communication session window, and all streaming information is encrypted using a shared key as an AES key; Step 3, termination phase; When communication needs to be terminated, one end sends a FIN packet to the other end and the connection is terminated.

2. The end-to-end communication method based on ECDHE as claimed in claim 1, characterized in that: In step 1, when the public key is returned, an integer representing eight bits is also returned along with the public key; if ordinary information is transmitted, the integer returned when the public key is returned is a null value; if important information is transmitted, the integer returned when the public key is returned is a non-null value.

3. The end-to-end communication method based on ECDHE as claimed in claim 1 or 2, characterized in that: When performing identity authentication between two parties, the public key AAD information is used as the authentication password.

4. The end-to-end communication method based on ECDHE as claimed in claim 1, characterized in that: In step 2, each data packet in the data packet is dynamically unpacked by a machine learning algorithm based on uncoupled linear ordinary differential equations.

5. The end-to-end communication method based on ECDHE as claimed in claim 4, characterized in that: Each packet contains the packet size in the header, and each packet allows the receiver to receive data in an exact manner.

6. The end-to-end communication method based on ECDHE as claimed in claim 1, characterized in that: In step 2, after an unexpected communication disconnection occurs, the client sends a request to restore the connection to the server within the time allowed by the server. If the server agrees to restore the connection, it starts to verify the client's request header for restoring the connection based on the cached session. After successful verification, the TCP connection is reused and restored to the state before the disconnection. The data that failed to be sent is resent from the buffer.

Images