A message encryption authentication method based on a Wayland protocol

Abstract

The application provides a message encryption authentication method based on a Wayland protocol and belongs to the technical field of message encryption authentication. The method comprises the following steps: based on a Wayland library, extending a connection module, and according to an advanced encryption standard encryption and decryption process, overloading communication write data and read data function interfaces to obtain overloaded communication write and read data function interfaces; through adding judgment logic of a key and judgment logic of an encryption algorithm, obtaining an overloaded client connection request function interface and an overloaded server communication channel creation function interface; defining a working mode and judging, and communicating through a Unix Socket channel to complete message encryption authentication. The application solves the problem that in the case that an existing message transmission is destroyed in a permission system, an attacker can hijack and monitor transmission data, and simultaneously realizes a client whitelist function, so that an illegal application not in the whitelist cannot initiate a connection request.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of message encryption and authentication, and particularly relates to a message encryption and authentication method based on a Wayland protocol. BACKGROUND

[0002] The Wayland protocol is a new generation of display graphics protocol under a Unix-like operating system, uses a c / s architecture design, and replaces a traditional image data to display screen full-flow data transmission channel. By taking over the event messages of a mouse, a keyboard and a graphics card, a transmission framework is provided for message transmission between the above several hardware, so as to realize the function of human-computer interaction.

[0003] A classical work flow is as follows: when a keyboard inputs a password, the keyboard transmits an event to a user state through a Linux kernel driver, the user state has a Libinput library corresponding to the mouse and the keyboard, which is used to convert keyboard electrical signals into programmable codes, then the Libinput library notifies a Wayland compositor, the compositor identifies that the keyboard event belongs to which Wayland client application, then encapsulates the keyboard content into a message package and transmits the message package to the corresponding Wayland client, the Wayland client application decapsulates the message package and then transmits the message package to a background thread of the application for logical processing of data services, at this time, the graphical application can directly use the input string content, the background thread writes the data into a disk after data verification and corresponding business logic processing, and the graphical application renders new content to the screen after the image data of the graphical application is changed.

[0004] In a high security requirement scene, the message transmission process of the above process has the risk of being monitored, and if the message transmission process of the Wayland protocol is hijacked and monitored by a man-in-the-middle, the input content can be continuously captured before the keyboard data reaches the graphical application.

[0005] In the existing Wayland protocol transmission design, security protection mainly depends on permission management in the Linux system; after the Wayland server receives message data from the kernel, the path for transmitting keyboard data to the Wayland client application mainly communicates through the Unix Socket mode; when the synthesizer is started in the Linux system, a Socket file is created, and the permission is 0755, which means that the normal user who creates the file can read, write and execute, other users can read and execute but cannot write, so only the user who creates the file can initiate communication with the Wayland server for data transmission; but the current design only realizes the isolation of the use permission between multiple users under the normal operation of the permission system, and does not realize the message encryption isolation at the data level, and in the extreme case, if the permission system is damaged or the Socket file permission is set by human error, the Unix Socket file can be monitored through side channel attack, and the attacker can monitor the data communication between any client and the server.

[0006] After the existing technology receives the keyboard message content from the kernel in the Wayland protocol server, the window manager is used to find the application to which the message belongs to and then the message is distributed to ensure the data isolation between each client, but a malicious program can construct an existing client ID to cheat the synthesizer to illegally obtain data. SUMMARY

[0007] In view of the above problems in the prior art, the message encryption authentication method based on the Wayland protocol provided by the present application solves the problem that the attacker can hijack and monitor the transmission data when the permission system is damaged, and realizes the client whitelist function, so that the illegal application not in the whitelist cannot initiate a connection request.

[0008] In order to achieve the above purpose, the technical scheme adopted by the present application is as follows: a message encryption authentication method based on the Wayland protocol, comprising the following steps:

[0009] S1, based on the Wayland library, extending the connection module in the Wayland library, and according to the high-level encryption standard encryption and decryption process, the communication write data function interface and the communication read data function interface are overloaded to obtain the overloaded communication write data function interface and the overloaded communication read data function interface;

[0010] S2, the client connection request function interface is overloaded by adding the judgment logic of the key, the server communication channel creation function interface is overloaded by adding the judgment logic of enabling the encryption algorithm, the overloaded client connection request function interface and the overloaded server communication channel creation function interface are obtained, and the Unix Socket channel is established;

[0011] S3, the working mode is defined, the current communication conforming working mode is judged, the communication write data function interface, the communication read data function interface, the overloaded client connection request function interface and the overloaded server communication channel creation function interface are based on the overload, the communication is carried out through the Unix Socket channel, and the message encryption authentication is completed.

[0012] The application has the beneficial effects that: the application extends the connection module in the Wayland library, does not destroy the original Wayland protocol, non-invasively expands the security and flexibility of the wayland, makes the Wayland protocol communication framework have the ability of communication data encryption and decryption, realizes the white list function through the control of the key, makes the Wayland protocol only allow the request of the trusted program, realizes the problem that the attacker cannot decrypt the encrypted transmission data without obtaining the encryption key in the case that the permission system is destroyed, thereby providing safer protection for the input content of the mouse and the keyboard.

[0013] Further, the S1 includes the following steps:

[0014] S101, based on the Wayland library, the preset encryption data ring buffer field, the to-be-decrypted ciphertext field, the encrypted ciphertext field, the original data field and the key information field are added in the connection module resource structure body, the connection module in the Wayland library is extended, and an updated resource structure body is obtained;

[0015] S102, based on the updated resource structure body, the communication write data function interface is overloaded by adding the initialization and data encryption calculation logic of the advanced encryption standard encryption, and the overloaded communication write data function is obtained;

[0016] S103, the communication read data function interface is overloaded by adding the initialization and data encryption calculation logic of the advanced encryption standard decryption, and the overloaded communication read data function is obtained.

[0017] Further, the encryption data ring buffer field is used for storing all encrypted message frames in a ring buffer sequential storage mode, and transmitting the encrypted message frames on the Unix Socket inter-process communication channel;

[0018] The to-be-decrypted ciphertext field is used for storing a frame of to-be-decrypted ciphertext data.

[0019] The encrypted ciphertext field is used for storing a frame of encrypted ciphertext data.

[0020] The original data field is used for storing a frame of original data, wherein the original data field stores original input data to be encrypted in the encryption operation, and the original data field stores original data output after decryption in the decryption operation.

[0021] The key information field is used for storing key-related context information, and the key-related context information is continuously stored in the memory after being loaded once.

[0022] The above further scheme has the beneficial effects that the application sets the extension field, improves the security and flexibility of the Wayland protocol under the premise of non-invasion, and realizes the ability of communication data encryption and decryption.

[0023] Further, the judgment logic of the key is specifically that if the key is detected to be carried, the key is used to encrypt the to-be-transmitted data, otherwise, the to-be-transmitted data is in the Wayland original message frame data format, and the to-be-transmitted data is sent to the Wayland server through the Unix Socket channel.

[0024] Further, the judgment logic of the encryption algorithm is specifically that if the Wayland server is started, the first starting parameter and the second starting parameter are carried, according to the value of the first starting parameter, a corresponding working mode is enabled, according to the file carried in the second starting parameter, the content of the file is read, and the read content is stored as key information in the key information field, otherwise, the encryption algorithm is not enabled.

[0025] Further, the S3 includes the following steps:

[0026] S301, defining a first working mode allowing only encrypted data communication, a second working mode allowing only normal data communication, and a third working mode allowing encrypted data and normal data to establish communication at the same time;

[0027] S302, based on the working mode established in S301, obtaining a Wayland server working mode corresponding to current communication;

[0028] S303, according to the current communication Wayland server working mode, based on the overloaded communication write data function interface, the overloaded communication read data function interface, the overloaded client connection request function interface and the overloaded server communication channel creation function interface, communication is performed through the Unix Socket channel to complete message encryption authentication.

[0029] Further, the Wayland server working mode specifically is:

[0030] The first working mode: based on the Wayland protocol, the message is decrypted using the key, and it is judged whether the key check is passed, if not, all subsequent requests of the client are rejected, if yes, the data in the subsequent session is encrypted using the key to obtain an encrypted message;

[0031] The second working mode: the Wayland protocol encryption algorithm is invalidated, the encrypted message initiated by the client is rejected, the Wayland protocol architecture is rolled back to the normal mode and communicated, and only the Wayland original message frame request is received to obtain a normal message;

[0032] The third working mode: the encrypted message and the non-encrypted message request are received simultaneously using the Wayland protocol framework, the key is used for decryption operation, it is judged whether the key check is passed, if yes, the data in the current session is encrypted using the key to obtain an encrypted message, if not, the Wayland protocol framework is rolled back, the non-encrypted message is transmitted according to the normal mode by analyzing the Wayland original message frame to obtain a normal message.

[0033] The beneficial effects of the above further scheme are: the present application defines the Wayland server working mode, judges the current Wayland server working mode, uses the overloaded function interface, implements the encryption algorithm communication, realizes the mutual independence of the channel logic, improves the high security of the encrypted message, and the non-encrypted message is transmitted in the normal mode, improves the applicability of the present application.

[0034] Further, the S303 includes the following steps:

[0035] S3031, the server key information is loaded by the Wayland server, the global key information field is initialized by the overloaded communication write data function interface using the advanced encryption standard encryption algorithm, the connection request of the Wayland client is received by the Unix Socket channel through the overloaded server communication channel creation function interface;

[0036] S3032, the key content is obtained by using a three-party trusted channel, the connection request using the key is sent in response to the client through the overloaded client connection request function interface, the content of the client key information field is calculated by using the advanced encryption standard encryption algorithm to obtain the key content, and the key content is stored in the connection resource instance;

[0037] S3033, encrypt the plaintext message by using the key content, store the encrypted plaintext message in the encrypted data ring buffer field, and send the encrypted plaintext message by using the Unix Socket channel;

[0038] S3034, in response to the Wayland server receiving the encrypted plaintext message, decrypt the encrypted plaintext message by using the initialized global key information field through the overloaded communication read data function interface according to the current communication Wayland server working mode;

[0039] S3035, judge whether the decryption is successful, if not, discard or rollback the Wayland protocol framework to the Wayland original frame analysis mode, perform ordinary communication on the Wayland client and the Wayland server to obtain ordinary information, if yes, create a private connection resource instance for the Wayland client by using the initialized global key information field;

[0040] S3036, transmit the subsequent Unix Socket channel communication request to the private connection resource instance, perform point-to-point encrypted communication on the Wayland client and the Wayland server by using the private connection resource instance to obtain encrypted information, and complete message encryption authentication.

[0041] The above-mentioned further scheme has the beneficial effects that: the message encryption authentication work is realized by combining the extension field and the overloaded function interface, the accuracy and efficiency of the message encryption are improved by judging the global key information field and the client key information field, and the Wayland protocol is allowed to be requested only by a trusted program. BRIEF DESCRIPTION OF DRAWINGS

[0042] Figure 1 The method flowchart of the present application.

[0043] Figure 2 The timing diagram of the message encryption authentication work in the present embodiment.

[0044] Figure 3 The communication process schematic diagram after applying the encryption algorithm in the present embodiment. DETAILED DESCRIPTION

[0045] The specific embodiments of the present application are described below to facilitate the understanding of the present application by those skilled in the art, but it should be clear that the present application is not limited to the scope of the specific embodiments, and for those skilled in the art, it is obvious that various changes are within the spirit and scope of the present application defined and determined by the appended claims, and all the application and creation utilizing the concept of the present application are within the scope of protection.

[0046] Before the embodiment is described, the following terms are explained:

[0047] Wayland protocol: a modern display server protocol;

[0048] Libinput library: a library for handling common input device events;

[0049] Socket file: a special file type representing inter-process network communication;

[0050] Connection module: connection module;

[0051] AES algorithm: Advanced Encryption Standard encryption algorithm;

[0052] IPC: inter-process communication.

[0053] Embodiment

[0054] In the embodiment, to propose a data transmission encryption implementation outside the scope of the prior art security framework, through the AES symmetric encryption algorithm, the Wayland server and the Wayland client are encrypted and packaged before actual communication; even if the permission system is destroyed, the attacker still cannot decrypt the encrypted transmission data without obtaining the encryption key, thereby providing more secure protection for input content such as mouse and keyboard;

[0055] The encryption key can be generated and distributed through a three-party trusted channel, and the Wayland server can be authenticated through the key. Only client application programs carrying a legal key can initiate a communication request. The design here can completely block all requests of maliciously constructed illegal applications, and can achieve the effect of a whitelist.

[0056] As shown in Figure 1 The application provides a message encryption authentication method based on a Wayland protocol, and the implementation method is as follows:

[0057] S1, based on the Wayland library, the connection module in the Wayland library is extended, and the communication write data function interface and the communication read data function interface are overloaded according to the advanced encryption standard encryption and decryption process, to obtain the overloaded communication write data function interface and the overloaded communication read data function interface, the specific steps are as follows:

[0058] S101, based on the Wayland library, by adding a preset encrypted data ring buffer field, a to-be-decrypted ciphertext field, an encrypted ciphertext field, an original data field and a key information field in the connection module resource structure body, the connection module in the Wayland library is extended to obtain an updated resource structure body.

[0059] In this embodiment, the connection module in the existing Wayland library is expanded, and a preset struct wl_ring_buffer incrypt encryption data ring buffer field, an unsigned char indecrypt

[4096] to-be-decrypted ciphertext field, an unsigned char outencrypt

[4096] encrypted ciphertext field, an unsigned char plaintext

[4096] original data field and a key information field are added in the wl_connection resource structure body, so as to obtain an updated resource structure body;

[0060] The struct wl_ring_buffer incrypt field is mainly used for storing a frame of to-be-decrypted ciphertext data.

[0061] The unsigned char indecrypt

[4096] field is mainly used for storing a frame of encrypted ciphertext data.

[0062] The unsigned char outencrypt

[4096] field is mainly used for storing a frame of original data. In the encryption operation, the original input data to be encrypted is stored here, and in the decryption operation, the original data output after decryption is stored in the field.

[0063] The field is mainly used for storing key-related context information, which is continuously stored in the memory after being loaded once, and is used for subsequent encryption and decryption operations.

[0064] S102, based on the updated resource structure body, the initialization and data encryption calculation logic of the advanced encryption standard are added, the communication write data function interface is overloaded, and an overloaded communication write data function is obtained.

[0065] S103, the initialization and data encryption calculation logic of the advanced encryption standard decryption are added, the communication read data function interface is overloaded, and an overloaded communication read data function is obtained.

[0066] In this embodiment, the wl_connection_write communication write data function interface is overloaded, the initialization and data encryption calculation logic of AES encryption are added, and an overloaded communication write data function is obtained.

[0067] The wl_connection_read communication read data function interface is overloaded, the initialization and data decryption calculation logic of AES decryption are added, and an overloaded communication read data function is obtained.

[0068] S2, the client connection request function interface is overloaded by adding the judgment logic of the key, the server communication channel creation function interface is overloaded by adding the judgment logic of enabling the encryption algorithm, the overloaded client connection request function interface and the overloaded server communication channel creation function interface are obtained, and the Unix Socket channel is established.

[0069] In the embodiment, the wl_display_connect_to_fd client connection request function interface is overloaded, which is a Wayland client dedicated interface. In the interface, the judgment logic of the key is added. If the key is detected, the key is used to encrypt the to-be-transmitted data. If the key is not detected, the to-be-transmitted data in the Wayland original message frame data format is used. Then, the to-be-transmitted data is sent to the client through the Unix Socket channel.

[0070] The wl_display_create server communication channel creation function interface is overloaded, which is a Wayland server dedicated interface and can establish a Unix Socket IPC channel. In the interface, the judgment logic of whether to enable the encryption algorithm is added. When the Wayland server is started, the first enable parameter enable-encrypt [1 / 2 / 3] and the second enable parameter aes-key [filename.txt] are carried. The server enables the corresponding first, second, and third working modes according to the value of the first enable parameter. The content of the file carried by the second enable parameter is read as key information and stored in the global digest field. At the same time, the Unix Socket channel is used to listen to the connection request initiated by the client.

[0071] S3, define the working mode, judge the working mode that the current communication conforms to, based on the overloaded communication write data function interface, the overloaded communication read data function interface, the overloaded client connection request function interface, and the overloaded server communication channel creation function interface, communicate through the Unix Socket channel, complete message encryption authentication, and the specific steps are as follows:

[0072] S301, define the first working mode that only allows encrypted data communication, the second working mode that only allows ordinary data communication, and the third working mode that allows encrypted data and ordinary data to establish communication at the same time.

[0073] S302, based on the working mode established in S301, obtain the Wayland server working mode that the current communication conforms to.

[0074] In this embodiment, the working mode of the Wayland server is defined, the first working mode is to allow only encrypted data communication, the second working mode is to allow only normal data communication, and the third working mode is to allow both encrypted data and normal data to establish communication;

[0075] Based on the defined working mode of the Wayland server, the current communication conforming to the Wayland server working mode is obtained, when conforming to the first working mode, the Wayland protocol tries to use its own key to decrypt the message, if the key verification is passed, the key is used to continue to encrypt the data in the subsequent session. If the key verification fails, all subsequent requests of the client are rejected;

[0076] When conforming to the second working mode, the Wayland protocol encryption algorithm is invalid, the encrypted message initiated by the client is rejected, the Wayland protocol architecture falls back to the normal mode for communication, and only the wayland original message frame request is allowed in the subsequent;

[0077] When conforming to the third working mode, the Wayland protocol framework allows both encrypted message and non-encrypted message request, and preferentially tries to use the key to decrypt the operation, and if the decryption operation fails, the wayland original message frame is parsed. The respective channel logic is independent and does not interfere with each other, at this time, the message with encryption effect has high security, and the message without encryption is transmitted in the normal mode, and the security is low.

[0078] S303、According to the current communication Wayland server working mode, based on the overloaded communication write data function interface, the overloaded communication read data function interface, the overloaded client connection request function interface and the overloaded server communication channel creation function interface, the communication is carried out through the Unix Socket channel, the message encryption authentication is completed, and the specific steps are as follows:

[0079] S3031, the Wayland server loads the server key information, initializes the global key information field by using the advanced encryption standard encryption algorithm through the overloaded communication write data function interface, and receives the connection request of the Wayland client by using the Unix Socket channel through the overloaded server communication channel creation function interface;

[0080] S3032, the key content is obtained by using a trusted channel, in response to the connection request of the client by using the overloaded client connection request function interface, the content of the client key information field is calculated by using the advanced encryption standard encryption algorithm, the key content is obtained, and the key content is stored in the connection resource instance;

[0081] S3033. Use the key content to perform encryption calculation on the plaintext message, store the encrypted plaintext message in the encrypted data ring buffer field, and send the encrypted plaintext message using the Unix Socket channel.

[0082] In this embodiment, as Figure 2 As shown, the overall working sequence in message encryption authentication mode is as follows: communication mainly involves information exchange between the client and the server. First, the Wayland server loads its own key information and initializes the global key according to the AES algorithm through the wl_connection_write function interface. Fields, storing key context, will be based on global settings in the future. The information stored in the field is encrypted and decrypted, and then an actual Unix Socket public communication channel is established to wait for connection requests from Wayland clients;

[0083] When a client needs to use a key to make a connection request, the key content must first be obtained from a trusted third-party source, and the client's key must be calculated using the AES algorithm. The content is stored in its own wl_connection resource instance and used by the client when initiating communication. The field performs encrypted calculations on plaintext messages and stores the encrypted data in the struct wl_ring_buffer incrypt field, which is then sent via a Unix Socket channel.

[0084] S3034. In response to the Wayland server receiving an encrypted plaintext message, based on the current Wayland server working mode, the encrypted plaintext message is decrypted using the initialized global key information field through the overloaded communication read data function interface.

[0085] S3035. Determine whether decryption was successful. If not, discard or revert the Wayland protocol framework to the Wayland raw frame parsing mode, and perform normal communication between the Wayland client and the Wayland server to obtain normal information. If yes, use the initialized global key information field to create a private connection resource instance for the Wayland client.

[0086] In this embodiment, the Wayland server receives messages from the Wayland client by monitoring the read / write status of the Unix socket file. Based on the current Wayland server's operating mode, it adjusts the subsequent communication encryption process, using the wl_connection_read function interface and the initialized global... The field content attempts to decrypt the message, and if the decryption is successful, a private wl_connection resource instance is created for the current Wayland client, and the initialized global The field content is copied to the private wl_connection resource instance, and subsequent Unix Socket communication requests are transmitted through the private wl_connection resource instance; if the decryption fails, the message is discarded or the original wayland frame parsing mode is returned.

[0087] S3036, the subsequent Unix Socket channel communication request is transmitted to the private connection resource instance, and the Wayland client and the Wayland server are used for point-to-point encryption communication by using the private connection resource instance, to obtain encrypted information and complete message encryption authentication.

[0088] If the encryption and decryption check is successful, the client and the server will use their own private wl_connection instance for point-to-point encryption communication to complete message encryption authentication.

[0089] Among them, the three fields unsigned char indecrypt

[4096] , unsigned char outencrypt

[4096] , and unsigned char plaintext

[4096] are only used for temporary conversion between plaintext data and encrypted data in the communication encryption and decryption process.

[0090] In this embodiment, the communication process as shown in Figure 3 is implemented, and the security of the communication is improved.

Claims

1. A message encryption and authentication method for the Wayland protocol, characterized in that, Includes the following steps: S1. Based on the Wayland library, the connection module in the Wayland library is extended, and the communication write data function interface and communication read data function interface are overloaded according to the encryption and decryption process of Advanced Encryption Standard, resulting in overloaded communication write data function interface and overloaded communication read data function interface, specifically: S101. Based on the Wayland library, the connection module in the Wayland library is extended by adding a preset encrypted data ring buffer field, a ciphertext field to be decrypted, an encrypted ciphertext field, a raw data field, and a key information field to the connection module resource structure, resulting in an updated resource structure. S102. Based on the updated resource structure, the communication write data function interface is overloaded by adding initialization and data encryption calculation logic of advanced encryption standard encryption to obtain the overloaded communication write data function. S103. By adding initialization and data encryption calculation logic for advanced encryption standard decryption, the communication read data function interface is overloaded to obtain the overloaded communication read data function. S2. By adding key judgment logic, the client connection request function interface is reloaded. By adding encryption algorithm enable judgment logic, the server communication channel creation function interface is reloaded. The reloaded client connection request function interface and the reloaded server communication channel creation function interface are obtained, and a Unix Socket channel is established. S3. Define the working mode, determine the current communication mode, and based on the overloaded communication write data function interface, overloaded communication read data function interface, overloaded client connection request function interface, and overloaded server communication channel creation function interface, communicate through the Unix Socket channel and complete message encryption authentication, specifically: S301, Define a first working mode that only allows encrypted data communication, a second working mode that only allows ordinary data communication, and a third working mode that simultaneously allows encrypted data and ordinary data to establish communication. S302. Based on the working mode established by S301, obtain the Wayland server working mode that the current communication conforms to. S303. Based on the current Wayland server's working mode, and using the overloaded communication write data function interface, the overloaded communication read data function interface, the overloaded client connection request function interface, and the overloaded server communication channel creation function interface, communication is conducted through the Unix Socket channel to complete message encryption and authentication.

2. The Wayland protocol message encryption and authentication method according to claim 1, characterized in that, The encrypted data ring buffer field is used to store all encrypted message frames in a sequential manner using a ring buffer, and to transmit the encrypted message frames on the Unix Socket inter-process communication channel. The ciphertext field to be decrypted is used to store a frame of ciphertext data to be decrypted; The encrypted ciphertext field is used to store a frame of encrypted ciphertext data; The original data field is used to store a frame of original data. In the encryption operation, the original data field stores the original input data to be encrypted, and in the decryption operation, the original data field stores the original data output after decryption. The key information field is used to store key-related context information. In response to a single load, the key-related context information is continuously stored in memory.

3. The Wayland protocol message encryption and authentication method according to claim 1, characterized in that, The key determination logic is as follows: if a key is detected, the key is used to encrypt the data to be transmitted; otherwise, the data to be transmitted is sent to the Wayland server using the Wayland raw message frame data format and through the Unix Socket channel.

4. The Wayland protocol message encryption and authentication method according to claim 1, characterized in that, The specific logic for determining whether to enable the encryption algorithm is as follows: if the Wayland server starts with a first startup parameter and a second startup parameter, the corresponding working mode is enabled according to the value of the first startup parameter, and the contents of the file carried in the second startup parameter are read and stored as key information in the key information field; otherwise, the encryption algorithm is not enabled.

5. The Wayland protocol message encryption and authentication method according to claim 2, characterized in that, The Wayland server's working mode is specifically as follows: First working mode: Based on the Wayland protocol, the message is decrypted using a key. The key verification is checked. If not, all subsequent requests from the client are rejected. If yes, the data in the subsequent session is encrypted using the key to obtain encrypted messages. Second working mode: disable the Wayland protocol encryption algorithm, reject encrypted messages initiated by the client, revert the Wayland protocol architecture to normal mode and communicate, and only receive Wayland raw message frame requests to obtain normal messages; The third working mode: Utilizes the Wayland protocol framework to simultaneously receive encrypted and unencrypted message requests, performs decryption operations using the key, and determines whether the key verification passes. If yes, the key is used to encrypt the data in the current session to obtain an encrypted message. If no, it reverts to the Wayland protocol framework, parses the Wayland raw message frame, and transmits the unencrypted message in normal mode to obtain a normal message.

6. The Wayland protocol message encryption and authentication method according to claim 2, characterized in that, S303 includes the following steps: S3031. Load the server key information using the Wayland server, initialize the global key information field using the Advanced Encryption Standard (AES) encryption algorithm through the overloaded communication write data function interface, create a function interface through the overloaded server communication channel, and receive connection requests from Wayland clients using the Unix Socket channel. S3032. Obtain the key content through a trusted third-party channel. In response to the client sending a connection request using the key through the overloaded client connection request function interface, calculate the content of the client key information field using the Advanced Encryption Standard (AES) encryption algorithm, obtain the key content, and store the key content in the connection resource instance. S3033. Use the key content to perform encryption calculation on the plaintext message, store the encrypted plaintext message in the encrypted data ring buffer field, and send the encrypted plaintext message using the Unix Socket channel; S3034. In response to the Wayland server receiving an encrypted plaintext message, based on the current Wayland server working mode, the encrypted plaintext message is decrypted using the initialized global key information field through the overloaded communication read data function interface. S3035. Determine whether decryption was successful. If not, discard or revert the Wayland protocol framework to the Wayland original frame parsing mode, perform normal communication between the Wayland client and the Wayland server, and obtain normal information. If yes, use the initialized global key information field to create a private connection resource instance for the Wayland client. S3036. Transmit subsequent Unix Socket channel communication requests to the private connection resource instance. Use the private connection resource instance to perform point-to-point encrypted communication between the Wayland client and the Wayland server, obtain encrypted information, and complete message encryption authentication.

Images