Method and system for implementing a national secret browser based on a running state function proxy technology

Abstract

The application relates to the technical field of information security, in particular to a method and system for implementing a national secret browser based on a running state function proxy technology, which comprises the following steps: constructing an SSL protocol Hook module, the SSL protocol Hook module containing functions supporting a national secret SSL protocol; inputting a URL address in the browser, accessing a national secret website, entering an SSL handshake stage, the browser calling an internal SSL protocol module, the SSL protocol module calling a message construction function or a message processing function; the SSL protocol Hook module adopting a running state function proxy technology to proxy the browser's calling of related functions in the SSL protocol module, replacing the currently called function of the SSL protocol module with a function supporting the national secret SSL protocol; and the browser realizing access to the national secret website after being proxied by the SSL protocol Hook module. The application can realize access to the national secret website on the basis of an existing browser kernel through the running state function proxy technology.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and more specifically to a method and system for implementing a national cryptographic browser based on runtime function proxy technology. Background Technology

[0002] With the rapid development and widespread application of internet technology, network security issues have become increasingly prominent. As the primary gateway for users to access the internet, the security of browsers is of paramount importance. Traditional browsers mainly employ internationally recognized cryptographic algorithms (such as RSA and AES) to ensure the security of network communication.

[0003] The Chinese National Cryptography Algorithm (CNCA) is a series of cryptographic algorithm standards formulated by the State Cryptography Administration, including SM2, SM3, and SM4. Compared to internationally used algorithms, CNCA algorithms are more in line with domestic needs in terms of security and independent controllability. Therefore, in certain industries and government agencies, it is necessary to use browsers that support CNCA algorithms to access and process sensitive information to meet compliance requirements and enhance security capabilities.

[0004] However, most browsers currently on the market, such as Chrome, Firefox, Safari, and Edge, are mainly developed based on international standards and have relatively insufficient support for Chinese cryptographic algorithms or require extensions through plugins, resulting in compatibility and usability issues.

[0005] Currently, when non-national cryptographic browsers access national cryptographic websites, they cannot directly access SSL-compliant websites. They often use a proxy module to achieve this. The browser first accesses the proxy module, and then the proxy module accesses the national cryptographic services. This method has low performance and a cumbersome process.

[0006] Therefore, how to improve information access performance by directly initiating requests through a browser is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0007] In view of this, the present invention provides a method and system for implementing Chinese cryptographic websites based on runtime function proxy technology, which can enable access to Chinese cryptographic websites on the basis of existing browser kernels through runtime function proxy technology.

[0008] To achieve the above objectives, the present invention adopts the following technical solution:

[0009] In a first aspect, the present invention provides a method for implementing a Chinese cryptographic browser based on runtime function proxy technology, comprising the following steps:

[0010] Construct an SSL protocol Hook module, which contains functions that support the Chinese national cryptographic SSL protocol;

[0011] When you enter a URL in your browser to access the national cryptographic website, you enter the SSL handshake phase. The browser calls the internal SSL protocol module, which in turn calls the message constructor or message processing function.

[0012] The SSL protocol Hook module uses runtime function proxy technology to proxy the browser's calls to relevant functions in the SSL protocol module, replacing the functions currently called by the SSL protocol module with functions that support the Chinese national cryptographic SSL protocol;

[0013] After the browser is proxied by the SSL protocol Hook module, it can access the national cryptographic website.

[0014] Furthermore, after the SSL handshake is completed, the SSL data communication phase begins, which includes:

[0015] The national cryptographic website returns encrypted communication packets to the browser;

[0016] The browser calls the SSL protocol module, and the SSL protocol module calls the encryption function.

[0017] The SSL protocol Hook module proxies the encryption function and calls the national cryptographic encryption function to decrypt the encrypted communication packet.

[0018] Furthermore, during the SSL data communication phase, the encryption functions called by the SSL protocol module include: encryption initialization function, encryption update function, and encryption termination function; the encryption functions called by the SSL protocol Hook module include the Chinese national cryptographic encryption initialization function, Chinese national cryptographic encryption update function, and Chinese national cryptographic encryption termination function.

[0019] Furthermore, the SSL data communication phase also includes:

[0020] The browser calls the SSL protocol module, and the SSL protocol module calls the encryption function.

[0021] The SSL protocol Hook module proxies the encryption function and calls the national cryptographic encryption function. It constructs national cryptographic ciphertext for user requests received by the browser and sends it to the national cryptographic website.

[0022] Furthermore, the SSL handshake phase includes:

[0023] Initiate a request to access the national cryptographic website to the browser;

[0024] The browser calls the SSL protocol module, which in turn calls the clienthello constructor. The SSL protocol Hook module proxies the clienthello constructor, calls the Chinese cryptographic clienthello constructor, constructs the Chinese cryptographic clienthello message, and sends the message to the Chinese cryptographic website.

[0025] The Chinese cryptographic website processes the received Chinese cryptographic ClientHello messages, constructs a Chinese cryptographic SSL server handshake response, and sends it to the browser.

[0026] After the browser receives the handshake response from the Chinese cryptographic SSL server, it calls the message processing function in the SSL protocol module. The SSL protocol Hook module proxies the message processing function and calls the corresponding Chinese cryptographic message processing function, using the Chinese cryptographic algorithm to process the Chinese cryptographic SSL server handshake response.

[0027] After the Chinese cryptographic SSL server handshake response is processed, the browser calls the SSL protocol module, the SSL protocol module calls the message constructor, the SSL protocol Hook module proxies the message constructor and calls the corresponding Chinese cryptographic message constructor, and uses the Chinese cryptographic algorithm to construct the Chinese cryptographic SSL client handshake response.

[0028] After receiving the handshake response from the Chinese cryptographic SSL client, the Chinese cryptographic SSL website returns a Finished message, indicating that the Chinese cryptographic SSL protocol handshake is complete.

[0029] Furthermore, the national cryptographic SSL server handshake response constructed by the national cryptographic website includes: server Hello message, server digital certificate message, server key exchange message, server certificate request message, and server Hello completion message.

[0030] Furthermore, after the browser receives the handshake response from the Chinese national cryptographic SSL server, the message processing functions in the SSL protocol module that it calls include: server Hello message processing function, server digital certificate message processing function, server key exchange message processing function, server certificate request message processing function, and server Hello completion message processing function.

[0031] The Chinese cryptographic message processing functions called by the SSL protocol Hook module include: server-side Hello message Chinese cryptographic processing function, server-side digital certificate message Chinese cryptographic processing function, server-side key exchange message Chinese cryptographic processing function, server-side certificate request message Chinese cryptographic processing function, and server-side Hello completion message Chinese cryptographic processing function.

[0032] Furthermore, after the national cryptographic SSL server handshake response processing is completed, the message constructors called by the SSL protocol module include: client digital certificate message constructor, client key exchange message constructor, client certificate verification message constructor, and client handshake end message constructor;

[0033] The constructors for Chinese cryptographic messages called by the SSL protocol Hook module include: the constructor for client digital certificate messages, the constructor for client key exchange messages, the constructor for client certificate verification messages, and the constructor for client handshake end messages.

[0034] The final constructed Chinese cryptographic SSL client handshake response consists of a client digital certificate message encrypted using Chinese cryptographic algorithms, a client key exchange message, a client certificate verification message, and a client handshake end message.

[0035] Secondly, the present invention provides a national cryptographic browser implementation system based on runtime function proxy technology, comprising: an SSL protocol Hook module, an SSL protocol module, a browser, and a national cryptographic website. The SSL protocol Hook module, the SSL protocol module, the browser, and the national cryptographic website perform SSL handshake and SSL data communication in accordance with the method described above.

[0036] As can be seen from the above technical solution, compared with the prior art, the present invention has the following beneficial effects:

[0037] 1. Rapidly achieve support for Chinese cryptographic algorithms: This invention constructs an SSL protocol Hook module to proxy runtime functions. During browser runtime, it dynamically proxies key SSL protocol-related functions and replaces them with Chinese cryptographic algorithms. This allows for the rapid addition of Chinese cryptographic SSL protocol support to browsers without modifying the browser kernel source code, shortening the development cycle and reducing development costs.

[0038] 2. Non-intrusive modification with good compatibility: Runtime function proxy technology dynamically replaces functions at runtime, which has low intrusion into the browser kernel, reduces the risk of introducing compatibility issues, and ensures the stability and compatibility of the modified browser.

[0039] 3. Flexible and scalable: The SSL protocol Hook module and its internal national cryptographic algorithm module can be developed and maintained independently, which facilitates the subsequent upgrade and expansion of the national cryptographic algorithm, and also makes it easy to flexibly configure and adjust the application strategy of the national cryptographic algorithm according to different application scenarios.

[0040] 4. Enhanced security of browsers using Chinese cryptographic algorithms: By replacing internationally used algorithms with Chinese cryptographic algorithms, the security of browsers when processing sensitive information is improved, meeting the security needs of specific industries and application scenarios. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0042] Figure 1 An architecture diagram of the national cryptographic browser implementation method based on runtime function proxy technology provided by this invention;

[0043] Figure 2 The flowchart shows the implementation method of the national cryptographic browser based on runtime function proxy technology provided by the present invention. Detailed Implementation

[0044] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0045] like Figure 1 As shown, this embodiment of the invention discloses a method for implementing a national cryptographic browser based on runtime function proxy technology, including the following steps:

[0046] Construct an SSL protocol Hook module, which contains functions that support the Chinese national cryptographic SSL protocol;

[0047] When you enter a URL in your browser to access the national cryptographic website, you enter the SSL handshake phase. The browser calls the internal SSL protocol module, which in turn calls the message constructor or message processing function. Among them, the SSL client message constructor (construct_client_functions) contains function calls for constructing messages for the client in multiple phases of the SSL handshake: construct_client_hello (client hello message constructor), construct_client_certificate (client digital certificate message constructor), construct_client_key_exchange (client key exchange message constructor), construct_cert_verify (client certificate verification message constructor), and construct_finished (client handshake end message constructor).

[0048] The SSL server message handling functions (process_server_functions) contain function calls for the client to process messages sent by the server during various stages of the SSL handshake: process_server_hello (server Hello message handling function), process_server_certificate (server digital certificate message handling function), process_cert_verify (server certificate verification message handling function), process_key_exchange (server key exchange message handling function), process_certificate_request (server certificate request message handling function), and process_server_done (server Hello completion message handling function).

[0049] The SSL protocol Hook module uses runtime function proxy technology to proxy the browser's calls to relevant functions in the SSL protocol module, replacing the functions currently called by the SSL protocol module with functions that support the Chinese national cryptographic SSL protocol;

[0050] After the browser is proxied by the SSL protocol Hook module, it can access the national cryptographic website.

[0051] This invention proxies runtime function calls in application code through an SSL protocol Hook module. It only requires placing a single file in the original browser and does not require the installation of an additional proxy forwarding service.

[0052] Runtime function proxy technology, also known as function hooking or API hooking, is a computer programming technique used to intercept and modify the execution flow of function calls in an operating system or application. By setting a "hook" at the entry point of function execution, when the program calls the function, the pre-defined code in the "hook" will be executed first, thereby enabling the monitoring, modification, or extension of function behavior.

[0053] Next, the above process will be explained in further detail, such as... Figure 2 As shown, it specifically includes:

[0054] S1. The user initiates a request to access the Chinese cryptographic website to the browser. The browser calls the SSL protocol module, which implements the functions for SSL handshake and communication.

[0055] S2. The SSL protocol module calls the clienthello constructor to construct the client Hello message. The SSL protocol Hook module proxies the clienthello constructor (construct_client_hello), calls the corresponding Chinese cryptographic clienthello constructor (gm_construct_client_hello), constructs the Chinese cryptographic clienthello message, and sends the message to the Chinese cryptographic website.

[0056] S3. The Chinese cryptographic website will continue the SSL handshake process, process the received Chinese cryptographic ClientHello message, construct a Chinese cryptographic SSL server handshake response accordingly, and send it to the browser. The Chinese cryptographic SSL server handshake response constructed by the Chinese cryptographic website includes:

[0057] Server-side Hello message (ServerHello);

[0058] Server-side digital certificate message (Certificate);

[0059] Server-side key exchange message (ServerKeyExchange);

[0060] Server-side certificate request message (CertificateRequest);

[0061] The server-side Hello completion message (ServerHelloDone) is displayed.

[0062] S4. After receiving the handshake response from the Chinese national cryptographic SSL server, the browser calls the message processing functions in the SSL protocol module. These functions include:

[0063] The server-side Hello message handling function (process_server_hello);

[0064] Server-side digital certificate message processing (process_server_certificate) function

[0065] The server-side key exchange message processing function (process_key_exchange);

[0066] The server-side certificate request message handling function (process_certificate_request);

[0067] The server-side Hello function completes message processing (process_server_done).

[0068] The SSL protocol Hook module proxies the aforementioned message processing functions, thereby calling the corresponding national cryptographic message processing functions to handle the national cryptographic SSL server handshake response. These national cryptographic message processing functions include:

[0069] The `gm_process_server_hello` function handles the Hello message using Chinese cryptographic methods on the server side.

[0070] The `gm_process_server_certificate` function is used for processing server-side digital certificate messages using Chinese cryptographic methods.

[0071] The `gm_process_key_exchange` function handles the Chinese cryptographic rules for key exchange messages on the server side.

[0072] The `gm_process_certificate_request` function handles the server-side certificate request message using Chinese cryptographic methods.

[0073] The server-side Hello function completes the national cryptographic processing of the message (gm_process_server_done).

[0074] The functions mentioned above employ Chinese cryptographic algorithms and can process Chinese cryptographic handshake messages.

[0075] After the S5 and Chinese national cryptographic SSL server handshake response processing is completed, the browser calls the SSL protocol module, which in turn calls the message constructor, including:

[0076] The `construct_client_certificate` function constructs the client digital certificate message.

[0077] The `construct_client_key_exchange` function constructs the client key exchange message.

[0078] The `construct_cert_verify` function constructs the client certificate verification message.

[0079] The `construct_finished` function constructs the client handshake end message.

[0080] The SSL protocol Hook module proxies the aforementioned message constructor, calls the corresponding national cryptographic message constructor, and constructs the national cryptographic SSL client handshake response using the national cryptographic algorithm. The national cryptographic message constructor includes:

[0081] The function `gm_construct_client_certificate` constructs the client's digital certificate message using Chinese cryptographic methods.

[0082] The function `gm_construct_client_key_exchange` constructs the client key exchange message using Chinese cryptographic standards.

[0083] The client certificate verification message is constructed using the Chinese cryptographic method (gm_construct_cert_verify) function;

[0084] The client handshake end message is constructed using the Chinese cryptographic construct function (gm_construct_finished).

[0085] These Chinese cryptographic message constructors implement the Chinese cryptographic algorithm, enabling the construction of Chinese cryptographic handshake messages.

[0086] S6. After receiving the handshake response from the national cryptographic SSL client, the national cryptographic website returns a Finished message. The SSL protocol module calls the Finished message constructor (process_finished), and the SSL protocol Hook module replaces the Finished message constructor with the national cryptographic Finished message constructor (gm_process_finished). The national cryptographic SSL protocol handshake is completed, and the SSL data communication phase begins. Subsequent communication uses the negotiated session key for encrypted communication.

[0087] During S7 and SSL data communication, the browser calls the SSL protocol module, which in turn calls the encryption function. The SSL protocol Hook module proxies the encryption function and calls the national cryptographic encryption function to construct national cryptographic ciphertext for the user request received by the browser and send it to the national cryptographic website.

[0088] The national cryptographic website returns encrypted communication packets to the browser; the browser calls the SSL protocol module, which in turn calls encryption functions, including: encryption initialization function (Cipher_Init), encryption update function (Cipher_Update), and encryption termination function (Cipher_Finish).

[0089] The SSL protocol Hook module proxies the encryption functions and calls the Chinese national cryptographic encryption functions, including the Chinese national cryptographic encryption initialization function (gm_Cipher_Init), the Chinese national cryptographic encryption update function (gm_Cipher_Update), and the Chinese national cryptographic encryption termination function (gm_Cipher_Finish), to decrypt the encrypted communication packets.

[0090] These national cryptographic encryption functions implement the national cryptographic algorithm, enabling the construction and decryption of national cryptographic encrypted communication packets.

[0091] At this point, the SSL protocol Hook module has completed the Chinese national cryptographic SSL protocol by proxying the browser's runtime functions, and successfully completed access to the Chinese national cryptographic website.

[0092] In another embodiment, the present invention also provides a national cryptographic browser implementation system based on runtime function proxy technology, including: an SSL protocol Hook module, an SSL protocol module, a browser, and a national cryptographic website. The SSL protocol Hook module, the SSL protocol module, the browser, and the national cryptographic website perform SSL handshake and SSL data communication in accordance with the method described above.

[0093] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0094] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for implementing a national cryptographic browser based on runtime function proxy technology, characterized in that, Includes the following steps: Construct an SSL protocol Hook module, which contains functions that support the Chinese national cryptographic SSL protocol; When you enter a URL in your browser to access the national cryptographic website, you enter the SSL handshake phase. The browser calls the internal SSL protocol module, which in turn calls the message constructor or message processing function. The SSL protocol Hook module uses runtime function proxy technology to proxy the browser's calls to relevant functions in the SSL protocol module, replacing the functions currently called by the SSL protocol module with functions that support the Chinese national cryptographic SSL protocol; After the browser is proxied through the SSL protocol Hook module, it can access the national cryptographic website; The SSL handshake phase includes: Initiate a request to access the national cryptographic website to the browser; The browser calls the SSL protocol module, which in turn calls the clienthello constructor. The SSL protocol Hook module proxies the clienthello constructor, calls the Chinese cryptographic clienthello constructor, constructs the Chinese cryptographic clienthello message, and sends the message to the Chinese cryptographic website. The Chinese cryptographic website processes the received Chinese cryptographic ClientHello messages, constructs a Chinese cryptographic SSL server handshake response, and sends it to the browser. After the browser receives the handshake response from the Chinese cryptographic SSL server, it calls the message processing function in the SSL protocol module. The SSL protocol Hook module proxies the message processing function and calls the corresponding Chinese cryptographic message processing function, using the Chinese cryptographic algorithm to process the Chinese cryptographic SSL server handshake response. After the Chinese cryptographic SSL server handshake response is processed, the browser calls the SSL protocol module, the SSL protocol module calls the message constructor, the SSL protocol Hook module proxies the message constructor and calls the corresponding Chinese cryptographic message constructor, and uses the Chinese cryptographic algorithm to construct the Chinese cryptographic SSL client handshake response. After receiving the handshake response from the Chinese cryptographic SSL client, the Chinese cryptographic SSL website returns a Finished message, indicating that the Chinese cryptographic SSL protocol handshake is complete. After the SSL handshake is completed, the SSL data communication phase begins, which includes: The national cryptographic website returns encrypted communication packets to the browser; The browser calls the SSL protocol module, and the SSL protocol module calls the encryption function. The SSL protocol Hook module proxies the encryption function and calls the national cryptographic encryption function to decrypt the encrypted communication packet; The SSL data communication phase also includes: The browser calls the SSL protocol module, and the SSL protocol module calls the encryption function. The SSL protocol Hook module proxies the encryption function and calls the national cryptographic encryption function. It constructs national cryptographic ciphertext for user requests received by the browser and sends it to the national cryptographic website.

2. The method for implementing a national cryptographic browser based on runtime function proxy technology according to claim 1, characterized in that, During the SSL data communication phase, the encryption functions called by the SSL protocol module include: encryption initialization function, encryption update function, and encryption termination function; the encryption functions called by the SSL protocol Hook module include the Chinese national cryptographic encryption initialization function, Chinese national cryptographic encryption update function, and Chinese national cryptographic encryption termination function.

3. The method for implementing a national cryptographic browser based on runtime function proxy technology according to claim 1, characterized in that, The handshake response of the Chinese cryptographic SSL server constructed by the Chinese cryptographic website includes: server Hello message, server digital certificate message, server key exchange message, server certificate request message, and server Hello completion message.

4. The method for implementing a national cryptographic browser based on runtime function proxy technology according to claim 3, characterized in that, After the browser receives the handshake response from the Chinese national cryptographic SSL server, the message processing functions in the SSL protocol module it calls include: server Hello message processing function, server digital certificate message processing function, server key exchange message processing function, server certificate request message processing function, and server Hello completion message processing function. The Chinese cryptographic message processing functions called by the SSL protocol Hook module include: server-side Hello message Chinese cryptographic processing function, server-side digital certificate message Chinese cryptographic processing function, server-side key exchange message Chinese cryptographic processing function, server-side certificate request message Chinese cryptographic processing function, and server-side Hello completion message Chinese cryptographic processing function.

5. The method for implementing a national cryptographic browser based on runtime function proxy technology according to claim 3, characterized in that, After the Chinese national cryptographic SSL server handshake response processing is completed, the message constructors called by the SSL protocol module include: client digital certificate message constructor, client key exchange message constructor, client certificate verification message constructor, and client handshake end message constructor; The constructors for Chinese cryptographic messages called by the SSL protocol Hook module include: the constructor for client digital certificate messages, the constructor for client key exchange messages, the constructor for client certificate verification messages, and the constructor for client handshake end messages. The final constructed Chinese cryptographic SSL client handshake response consists of a client digital certificate message encrypted using Chinese cryptographic algorithms, a client key exchange message, a client certificate verification message, and a client handshake end message.

6. A national cryptographic browser implementation system based on runtime function proxy technology, characterized in that, include: An SSL protocol hook module, an SSL protocol module, a browser, and a Chinese cryptographic website are used to perform SSL handshake and SSL data communication in accordance with the method described in any one of claims 1-5.

Images