A secure communication method and apparatus for cryptographic algorithm detection

Abstract

The application discloses a secure communication method and device for password algorithm detection, and relates to the technical field of network communication, and the method comprises the steps of determining a target encryption technical scheme through an intelligent grading strategy comprising hardware password device technology and white-box password technology; receiving a negotiation request sent by a client; selecting a target algorithm based on a password algorithm list in the negotiation request, in combination with server support conditions and a preset strategy; performing SSH secure communication with the client based on the target encryption technical scheme, in combination with the target algorithm, and performing password algorithm detection in the SSH secure communication process, so that the security communication cost can be reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network communication, in particular to a secure communication method and device for password algorithm detection. BACKGROUND

[0002] As an important protocol for ensuring the security of remote login sessions and other network services, the SSH (Secure Shell) protocol is widely used in network communication. The SSH protocol can support international standard algorithms and national secret algorithms.

[0003] In an untrusted device environment, the key of a password algorithm is vulnerable to attacks. The existing technology often uses a solution based on a hardware password device (such as a UKey). The hardware password device realizes the isolated storage and operation of the key through a hardware security module, thereby improving the security of the SSH protocol to a certain extent.

[0004] However, such a hardware password device has significant limitations: the deployment of the hardware password device is costly, thereby increasing the cost of secure communication.

[0005] The above content is only used to assist in understanding the technical solutions of the present application and does not represent the acknowledgement of the above content as prior art. SUMMARY

[0006] The main purpose of the present application is to provide a secure communication method and device for password algorithm detection, aiming to solve the technical problem that the deployment of the current hardware password device is costly and increases the cost of secure communication.

[0007] To achieve the above purpose, the present application provides a secure communication method for password algorithm detection, applied to a server, comprising:

[0008] determining a target encryption technical solution through an intelligent hierarchical strategy containing hardware password device technology and white-box password technology;

[0009] receiving a negotiation request sent by a client;

[0010] selecting a target algorithm based on a password algorithm list in the negotiation request, in combination with the support condition of the server and a preset strategy;

[0011] conducting SSH secure communication with the client based on the target encryption technical solution, in combination with the target algorithm, and performing password algorithm detection in the SSH secure communication process.

[0012] In an embodiment, the step of determining the target encryption technical solution through the intelligent hierarchical strategy containing the hardware password device technology and the white-box password technology comprises:

[0013] detecting whether the hardware cryptographic device is missing;

[0014] If not, determining that the target encryption technology scheme is the hardware cryptographic device technology;

[0015] If yes, determining that the target encryption technology scheme is the white-box cryptographic technology.

[0016] In an embodiment, the step of performing SSH secure communication with the client based on the target encryption technology scheme and in combination with the target algorithm, and performing cryptographic algorithm detection in the process of the SSH secure communication comprises:

[0017] performing algorithm negotiation, key negotiation, identity authentication, and data transmission with the client based on the target encryption technology scheme and in combination with the target algorithm;

[0018] In response to a session key white-boxing instruction, decomposing and embedding session keys of at least one of the key negotiation and the data transmission into each operation node.

[0019] In an embodiment, the step of performing algorithm negotiation with the client based on the target encryption technology scheme and in combination with the target algorithm comprises:

[0020] selecting the target algorithm based on a list of cryptographic algorithms in the negotiation request, in combination with the service end support condition and a preset policy;

[0021] generating a service end key pair based on the target encryption technology scheme and in combination with the target algorithm;

[0022] deriving a service end public key in the service end key pair, and storing a service end private key in the service end key pair based on the target encryption technology scheme;

[0023] sending the target algorithm and the public key in the service end key pair to the client, so that the client generates a client key pair based on the target encryption technology scheme and in combination with the target algorithm, derives a client public key in the client key pair, and stores a client private key in the client key pair based on the target encryption technology scheme.

[0024] In an embodiment, the step of performing key negotiation with the client based on the target encryption technology scheme and in combination with the target algorithm comprises:

[0025] receiving a message sent by the client, the message containing a first random number;

[0026] generating a second random number;

[0027] sign the first random number and the second random number using the server private key based on the target encryption technology scheme;

[0028] return the server public key certificate, the second random number and the first signature data to the client, so that the client verifies the first signature data using the server public key certificate, and if the verification is passed, generates a third random number and encrypts the third random number using the server public key in the server public key certificate, and sends the encrypted third random number to the server;

[0029] receive the encrypted third random number sent by the client;

[0030] decrypt the encrypted third random number using the server private key based on the target encryption technology scheme to obtain the third random number;

[0031] calculate a hash value with the client, the hash value being composed of the first random number, the second random number, the server public key certificate and the third random number.

[0032] In an embodiment, based on the target encryption technology scheme, the step of performing identity authentication with the client in combination with the target algorithm comprises:

[0033] when the client selects a public key-based authentication mode, receive second signature data sent by the client, the second signature data being generated by the client using a preset hash algorithm to hash session data to generate a first digest, and signing the first digest using the client private key based on the target encryption technology scheme;

[0034] verify the second signature data using the client public key.

[0035] In an embodiment, based on the target encryption technology scheme, the step of performing identity authentication with the client in combination with the target algorithm comprises:

[0036] when the client selects a password-based authentication mode, receive third signature data sent by the client, the third signature data being encrypted by the client using a preset data encryption algorithm;

[0037] verify the third signature data using the preset data encryption algorithm and a pre-negotiated key.

[0038] In an embodiment, based on the target encryption technology scheme, the step of performing data transmission with the client in combination with the target algorithm comprises:

[0039] receive the encrypted data sent by the client, the encrypted data being obtained by encrypting the grouped data to be transmitted by the client using a preset data encryption algorithm and a session key;

[0040] decrypt the encrypted data using the preset data encryption algorithm and the session key to obtain the grouped data to be transmitted;

[0041] receive the second digest sent by the client, the second digest being generated by the client by performing a hash operation on the data to be transmitted using a preset hash algorithm;

[0042] perform a hash operation on the data to be transmitted using the preset hash algorithm to generate a third digest;

[0043] compare the second digest with the third digest;

[0044] if the second digest and the third digest are the same, the data to be transmitted is not tampered.

[0045] The application also provides a secure communication method for cryptographic algorithm detection, applied to a client, and the method comprises the following steps:

[0046] sending a negotiation request to a server, so that the server selects a target algorithm based on a list of cryptographic algorithms in the negotiation request, in combination with server support and a preset policy, and performs SSH secure communication with the client based on a target encryption technology scheme in combination with the target algorithm, and performs cryptographic algorithm detection in the SSH secure communication process, wherein the target encryption technology scheme is determined by an intelligent hierarchical strategy comprising hardware cryptographic device technology and white-box cryptographic technology.

[0047] In addition, to achieve the above object, the application further provides a secure communication device for cryptographic algorithm detection, arranged on a server, and the secure communication device comprises:

[0048] a cryptographic determination module, configured to determine a target encryption technology scheme by an intelligent hierarchical strategy comprising hardware cryptographic device technology and white-box cryptographic technology;

[0049] a receiving module, configured to receive a negotiation request sent by a client;

[0050] an algorithm selection module, configured to select a target algorithm based on a list of cryptographic algorithms in the negotiation request, in combination with server support and a preset policy;

[0051] a communication module, configured to perform SSH secure communication with the client based on the target encryption technology scheme in combination with the target algorithm, and perform cryptographic algorithm detection in the SSH secure communication process.

[0052] Further, to achieve the above object, the present application also provides a secure communication device for cryptographic algorithm detection, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the secure communication method for cryptographic algorithm detection as described above.

[0053] Further, to achieve the above object, the present application also provides a storage medium, which is a computer-readable storage medium, and the storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the secure communication method for cryptographic algorithm detection as described above.

[0054] The one or more technical solutions provided by the present application have at least the following technical effects:

[0055] The present application determines a target encryption technology solution through an intelligent hierarchical strategy containing hardware cryptographic device technology and white-box cryptographic technology, wherein the white-box cryptographic technology provides a new idea for the security enhancement of the SSH protocol as a new cryptographic implementation method. The white-box cryptography embeds a key into the operation structure of a cryptographic algorithm, so that the cryptographic operation can still guarantee the security of the key in an untrusted environment, that is, even if an attacker can completely observe the execution process of the algorithm, it is also difficult to extract the key information. The present application can use the white-box cryptographic technology in the case where the hardware cryptographic device technology is not supported, thereby significantly reducing the deployment cost and the use threshold. The present application receives a negotiation request sent by a client, selects a target algorithm based on a cryptographic algorithm list in the negotiation request, in combination with the support condition of a server and a preset strategy, performs SSH secure communication with the client based on the target encryption technology solution and the target algorithm, and performs cryptographic algorithm detection in the SSH secure communication process. The present application can support the case where the hardware cryptographic device technology is used and the case where the hardware cryptographic device technology is not used, and the user can select according to the actual situation and the security requirement, thereby providing a low-cost, high-efficiency and secure communication solution for the user. BRIEF DESCRIPTION OF DRAWINGS

[0056] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments consistent with the present application and serve to explain the principles of the present application together with the specification.

[0057] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced as follows. Obviously, for those skilled in the art, other drawings can also be obtained based on these drawings without any creative effort.

[0058] Figure 1 A flowchart provided for the first embodiment of the secure communication method for password algorithm detection of the present application;

[0059] Figure 2 A flowchart provided for the second embodiment of the secure communication method for password algorithm detection of the present application;

[0060] Figure 3 A brief architecture diagram of the secure communication method for password algorithm detection of the present application;

[0061] Figure 4 A module structure diagram of the secure communication device of the present application;

[0062] Figure 5 A device structure diagram of the hardware running environment involved in the secure communication method for password algorithm detection of the present application.

[0063] The object implementation, functional features and advantages of the present application will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0064] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application, and are not used to limit the present application.

[0065] In order to better understand the technical solutions of the present application, the specific embodiments will be described in detail below with reference to the drawings and the specific embodiments.

[0066] The main solution of the present application is: determining a target encryption technical solution through an intelligent hierarchical strategy containing hardware password device technology and white-box password technology; receiving a negotiation request sent by a client; selecting a target algorithm based on a password algorithm list in the negotiation request, in combination with server support conditions and a preset strategy; performing SSH secure communication with the client based on the target encryption technical solution, in combination with the target algorithm, and performing password algorithm detection in the SSH secure communication process.

[0067] In an untrusted device environment, the key of the password algorithm is vulnerable to attacks, and the existing technology often adopts a solution based on a hardware password device (such as a UKey). The hardware password device technology realizes isolated storage and operation of the key through a hardware security module, which improves the security of the SSH protocol to a certain extent.

[0068] However, such hardware password device technology has significant limitations: the deployment cost of the hardware password device is high, which increases the cost of secure communication.

[0069] The hardware password device technology also has the following limitations: the use process of the hardware password device is cumbersome, the user needs to carry the device, and the device needs to be frequently plugged in and out when used in different terminals, and there are problems of device loss, damage or compatibility, which sacrifices the convenience of use.

[0070] In addition, the hardware password device has poor function expansion, and it is difficult to quickly adapt to new password algorithms or security requirements, which limits its application in complex and variable network environments.

[0071] The present application provides a solution. The present application determines a target encryption technology scheme through an intelligent grading strategy containing hardware password device technology and white box password technology. The white box password technology provides a new idea for the security enhancement of the SSH protocol as a new password implementation method. The white box password embeds the key into the operation structure of the password algorithm, so that the password operation can still guarantee the security of the key in an untrusted environment. Even if the attacker can completely observe the execution process of the algorithm, it is also difficult to extract the key information. The present application can use white box password technology in the case where hardware password device technology is not supported through an intelligent grading strategy containing hardware password device technology and white box password technology, thereby significantly reducing the deployment cost and use threshold. The present application receives a negotiation request sent by a client, selects a target algorithm based on a password algorithm list in the negotiation request, in combination with the support condition of the server and a preset strategy, performs SSH secure communication with the client based on the target encryption technology scheme in combination with the target algorithm, and performs password algorithm detection in the SSH secure communication process. The present application can support the case where hardware password device technology is supported and the case where hardware password device technology is not supported. The user can select according to the actual situation and security requirements, thereby providing a low-cost, high-efficiency and secure communication scheme for the user.

[0072] It should be noted that the execution subject of the present embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device, a secure communication device, etc. that can realize the above functions, or an electronic system, a secure communication system, etc. that can realize the above functions. The present embodiment and the following embodiments will be described below taking a secure communication system as an example.

[0073] Based on this, the present embodiment provides a secure communication method for password algorithm detection, applied to a server, referring to Figure 1 , Figure 1 The present embodiment provides a flowchart of the secure communication method for password algorithm detection.

[0074] In the present embodiment, the secure communication method for password algorithm detection includes steps S10-S40:

[0075] Step S10, determine the target encryption technology scheme through an intelligent grading strategy including hardware cryptographic device technology and white-box cryptographic technology;

[0076] Hardware cryptographic device technology is a technology that uses a hardware cryptographic device. The hardware cryptographic device (such as a UKey or a secure chip) realizes high-level key security storage and operation through physical isolation and hardware acceleration, but has the problems of high cost and limited use.

[0077] Among them, white-box cryptographic technology is a technology that tightly integrates the key and the algorithm code during the implementation of the cryptographic algorithm, so that even if the attacker can completely access the implementation code and the running environment of the algorithm, the key cannot be extracted from it.

[0078] Among them, the intelligent grading strategy comprehensively considers multiple factors such as security requirements, performance requirements, cost budgets, etc., evaluates and grades different cryptographic technologies, and selects one or more most suitable ones from multiple cryptographic technologies as the target encryption technology scheme according to specific application scenarios and requirements. For example, for high-security scenarios, hardware cryptographic device technology may be preferred; for resource-constrained client environments, white-box cryptographic technology may be considered; for environments with only hardware cryptographic devices, hardware cryptographic device technology is selected; for environments without hardware cryptographic devices, white-box cryptographic technology is selected.

[0079] Step S20, receive the negotiation request sent by the client;

[0080] Among them, the client will send a negotiation request to the server before initiating SSH secure communication with the server. This request usually contains some information supported by the client, such as a list of cryptographic algorithms, protocol versions, etc., which are used to negotiate the parameters and algorithms required for secure communication with the server.

[0081] Step S30, select the target algorithm based on the cryptographic algorithm list in the negotiation request, combined with the server support situation and the preset strategy;

[0082] Among them, the client lists various cryptographic algorithms it supports in the negotiation request, such as encryption algorithms (AES, DES, etc.), hash algorithms (SHA-1, SHA-256, etc.), signature algorithms (RSA, ECDSA, etc.), etc.

[0083] Among them, the server support situation indicates that the server also has its own set of supported cryptographic algorithms. When selecting the target algorithm, it is necessary to ensure that the selected algorithm is supported by both the server and the client to ensure normal communication between the two parties.

[0084] The server can select an algorithm according to some preset rules and strategies, for example, preferentially selecting an algorithm with higher security, considering the performance overhead of the algorithm, and the like.

[0085] By comprehensively considering the algorithms supported by the client, the support situation of the server side, and the preset strategy, a target algorithm for the SSH secure communication is finally determined.

[0086] In step S40, the target algorithm is used for SSH secure communication with the client based on the target encryption technology scheme, and password algorithm detection is performed in the SSH secure communication process.

[0087] The target encryption technology scheme determined by the intelligent hierarchical strategy is combined with the target algorithm obtained through negotiation between the server and the client, and the server and the client perform SSH secure communication.

[0088] The embodiment provides a secure communication method for password algorithm detection. The application determines a target encryption technology scheme through an intelligent hierarchical strategy containing hardware cryptographic device technology and white-box cryptographic technology. The white-box cryptographic technology, as a new cryptographic implementation method, provides a new idea for the security enhancement of the SSH protocol. The white-box cryptographic technology embeds a key into the operation structure of a cryptographic algorithm, so that the cryptographic operation can guarantee the security of the key in an untrusted environment. Even if an attacker can completely observe the execution process of the algorithm, it is difficult to extract the key information. The application can use the white-box cryptographic technology in the case where the hardware cryptographic device technology is not supported, thereby significantly reducing the deployment cost and the use threshold. The application receives a negotiation request sent by a client, selects a target algorithm based on a password algorithm list in the negotiation request, in combination with the support situation of the server and a preset strategy, performs SSH secure communication with the client based on the target encryption technology scheme in combination with the target algorithm, and performs password algorithm detection in the SSH secure communication process. The application can support the case where the hardware cryptographic device technology is supported and the case where the hardware cryptographic device technology is not supported. Users can select according to actual conditions and security requirements, thereby providing a low-cost, high-efficiency, and secure communication scheme for users.

[0089] In addition, the application can use the white-box cryptographic technology in the case where the hardware cryptographic device technology is not supported, thereby avoiding the inconvenience of using the hardware cryptographic device. Compared with the hardware UKey, the white-box cryptographic technology does not require additional special hardware devices and can be directly implemented at the software level, thereby significantly reducing the deployment cost and the use threshold. The white-box cryptographic technology has good flexibility and scalability and can quickly adapt to different cryptographic algorithms and application scenarios.

[0090] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as the above first embodiment can be referred to the above introduction, and the subsequent will not be described in detail. On this basis, please refer to Figure 2 , step S10, by means of intelligent hierarchical strategy including hardware cryptographic device technology and white-box cryptographic technology, the target encryption technology scheme is determined, including steps S11-S13:

[0091] Step S11, detecting whether the hardware cryptographic device is missing;

[0092] Step S12, if not, determining that the target encryption technology scheme is the hardware cryptographic device technology;

[0093] Step S13, if yes, determining that the target encryption technology scheme is the white-box cryptographic technology.

[0094] It should be noted that in the process of SSH protocol communication, the client and the server support flexible selection of key pair generation mode according to actual security requirements and resource conditions, that is, based on hardware cryptographic device or white-box cryptographic technology. Hardware cryptographic device (such as UKey, security chip) realizes high-level key security storage and operation through physical isolation and hardware acceleration, but has the problems of high cost and limited use; white-box cryptographic technology embeds the key into the algorithm structure through the software level, and realizes the key protection in untrusted environment without special hardware.

[0095] Refer to Figure 3 , for the brief architecture diagram of the security communication method for the cryptographic algorithm detection of the present application, in Figure 3 , the SSH client and the SSH server communicate, the SSH client corresponds to the hardware cryptographic component interface and the white-box cryptographic interface, the SSH server corresponds to the hardware cryptographic component interface and the white-box cryptographic interface, the hardware cryptographic component interface corresponds to the security key framework interface (SKF interface), and the white-box cryptographic interface corresponds to the SM2 white-box interface and the RSA white-box interface.

[0096] In order to balance between security and convenience, the present application adopts intelligent hierarchical strategy: the system defaults to preferentially attempt to call the hardware cryptographic device to generate the key pair, and ensures that the communication security level is maximized. If it is detected that the hardware device is missing (such as not inserting UKey, abnormal device driver), the white-box cryptographic technology is automatically switched to, to ensure the continuity and security of the key generation process.

[0097] After determining the target encryption technology scheme, the server and the client attempt to establish a connection: SSH relies on the port for communication. When the SSH connection is not established, the SSH server will listen to the connection request on the specified port, and after the SSH client initiates a connection request to the SSH server on the specified port, a TCP connection is established between the two parties, and subsequent communication will be carried out through the port.

[0098] After the service end and the client establish a connection, the service end and the client perform SSH version negotiation, and the process is shown in steps 1-3.

[0099] Step 1, the SSH service end sends the supported SSH version information to the SSH client through the established connection.

[0100] Step 2, after receiving the version information, the SSH client decides the version number to be used according to the supported SSH version of itself, and sends the decided version number to the SSH service end.

[0101] Step 3, the SSH service end judges whether it supports the version number decided by the client, so as to determine whether the version negotiation is successful.

[0102] As an implementation mode, the detection module is embedded and integrated in the embodiment of the application, wherein the detection configuration submodule receives a user configuration instruction, controls the start and stop of the detection process; the data acquisition submodule acquires protocol data in each stage in real time and compares with a standard parameter library; and the report generation submodule generates a detection report based on the acquired data and the comparison result, and obtains key parameters for key generation, signature / verification, encryption / decryption through data interaction, which are used for security and compliance detection.

[0103] The embodiment of the application balances between security and convenience by detecting whether the hardware cryptographic device is missing, and if not, determining that the target encryption technology scheme is the hardware cryptographic device technology, and if yes, determining that the target encryption technology scheme is the white-box cryptographic technology, thereby ensuring maximum communication security level.

[0104] In the current SSH protocol related technology, there is an obvious lack of special detection capability for national cryptographic algorithms. The existing technology only focuses on the communication security of the SSH protocol and does not consider the compliance, compatibility and security detection requirements of the national cryptographic algorithm in the application of the SSH protocol. With the mandatory promotion of national cryptographic algorithms in various industries, enterprises and institutions need to verify whether the deployment of national cryptographic algorithms in the SSH protocol meets national standards, but the existing technology cannot provide standardized detection mechanisms and data support, resulting in compliance risks and security risks in the application of national cryptographic algorithms in the SSH protocol, and cannot meet the technical needs of the main cryptographic detection business for SSH protocol national cryptographic algorithm detection.

[0105] Based on this, the third embodiment of the application is proposed. In the third embodiment of the application, the same or similar contents as the above embodiments can be referred to the above introduction, and will not be described hereinafter. On this basis, step S40, based on the target encryption technology scheme, combining the target algorithm and the client to perform SSH secure communication, and performing cryptographic algorithm detection in the SSH secure communication process includes steps S41-S43:

[0106] Step S41, based on the target encryption technology scheme, combining the target algorithm and the client for algorithm negotiation, key negotiation, identity authentication, data transmission;

[0107] Among them, the algorithm negotiation is that the server and the client agree on the cryptographic algorithm used. The client provides a list of algorithms it supports in the negotiation request, and the server selects appropriate algorithms from the list based on its own support and preset policies. Both parties determine a set of algorithms that they agree on, which is used in subsequent communication processes to ensure that both parties can correctly understand and process the data sent by each other.

[0108] Among them, the key negotiation is that the server and the client negotiate to generate a session key for encrypting and decrypting data. The session key is a temporary key used during the current communication session, ensuring that even if the communication channel is insecure, attackers cannot obtain the generated session key, thereby ensuring the confidentiality of subsequent data transmission.

[0109] Among them, identity authentication verifies the authenticity of the identities of both parties. The server needs to confirm that the client is a legitimate user or device, and the client also needs to verify that the server is a trusted service provider.

[0110] Among them, after completing algorithm negotiation, key negotiation and identity authentication, the server and the client use the algorithms and session keys negotiated to encrypt the actual data to be transmitted, and then transmit it through an insecure network. The receiving party uses the corresponding decryption algorithm and session key to decrypt the received encrypted data to recover the original data, ensuring the confidentiality and integrity of the data during transmission.

[0111] Step S42, in response to the session key white-box instruction, decomposing and embedding the session key of at least one of the key negotiation and the data transmission into each operation node.

[0112] Among them, according to the special properties of the session key, the system provides configurable white-box options (including the server and the client).

[0113] Since the session key is generated temporarily and has a short life cycle, its white-box process requires additional computing resources and time. As an implementation, in a regular scenario, the system adopts a lightweight key management strategy and does not white-box the session key; in a high-security scenario, users can manually enable the session key white-box function (for example, issue a session key white-box instruction), and the secure communication system further enhances the anti-attack ability of the session key during transmission and use through complex key confusion and algorithm reconstruction, meeting the differentiated security needs in different scenarios.

[0114] Step S43, in response to the national secret algorithm detection instruction, the detection dimension is acquired, and the detection data acquisition module and the standard parameter library are initialized to detect the service end and the client by the national secret algorithm.

[0115] It should be noted that in the pre-preparation stage, the "detection mode" is pre-configured: the user can select whether to enable the "national secret algorithm detection mode" through the configuration interface of the client / server, and specify the detection dimension (compliance detection, compatibility detection). After the detection mode is enabled, the system automatically initializes the detection data acquisition module and the standard parameter library (built-in national secret standard parameters such as SM2 key length, SM3 hash digest length, SM4 encryption mode, etc.), laying a foundation for the subsequent detection process.

[0116] In the SSH connection establishment stage, if the national secret algorithm detection mode is enabled, the system will record the TCP connection establishment time, port communication stability and other basic data as auxiliary indicators for compatibility detection.

[0117] In the version negotiation stage between the SSH server and the SSH client, if the national secret algorithm detection mode is enabled, the system will automatically record the version list supported by both parties, the final negotiation version number and the negotiation time consumption, and compare them with the SSH version range adapted to the national secret algorithm, generate version compatibility detection results, and if the negotiation version does not meet the adaptation requirements of the national secret algorithm, mark a warning in the detection log.

[0118] When the national secret algorithm detection mode is started, at least one of the following (1) ~ (5) can be implemented based on the pre-specified detection dimension:

[0119] (1) Compatibility detection: the system collects the national secret algorithm list supported by the client and the server, the finally selected national secret algorithm suite, and the key pair generation success rate (statistically in hardware / white box mode), verifies whether both parties support the complete national secret algorithm suite (SM2-SM3-SM4), and if there is a missing algorithm, mark it as "compatibility exception"; in addition, the adaptation stability of the national secret algorithm under different authentication methods (public key / password) can also be verified, and the authentication success rate (statistically in hardware / white box mode) is recorded, and if the national secret algorithm authentication fails under a certain authentication method, it is marked as "compatibility exception".

[0120] (2) Compliance detection: Call the standard parameter library to check the generated SM key parameters (such as whether the SM2 private key length is 256 bits, and whether the SM4 initial vector is 128 bits). If the parameters do not comply with the GM / T standard, record the violation items and specific deviation values; and / or, check the SM4 encryption mode (such as whether it is a CBC mode), the padding method (such as whether it complies with PKCS#7), and if it does not comply with the SM standard, mark the violation item; and / or, check the SM2 signature format, SM3 hash value calculation result (compared with the standard algorithm library calculation result), if the signature format is incorrect or the hash value does not match, mark it as "compliance exception";

[0121] (3) Performance detection: Record the total time of key negotiation, signature / verification time (hardware / white box mode is counted separately), generate SM algorithm key negotiation performance report, and provide data support for subsequent optimization.

[0122] (4) Integrity detection: Randomly tamper with part of the transmission data (such as modifying 1-2 bytes), verify whether the SM3 hash digest can accurately identify the tampering behavior, and record the success rate of tampering detection;

[0123] (5) Stability detection: Continuously transmit 1000 different size test data (1KB-10MB), record the data loss rate and decryption failure rate, and generate a SM algorithm data transmission stability report.

[0124] In addition, the system records detection logs, that is, the above collected data and verification results are stored in the detection log module in real time. The log format includes "detection dimension-detection item-collection value-standard value-determination result-timestamp", ensuring that the data is traceable.

[0125] As an implementation, the system automatically generates a complete SM algorithm detection report, which includes the following (a)~(d) contents:

[0126] (a) Detection basic information: detection time, client / server device information, detection mode (compliance / compatibility / security);

[0127] (b) Detection results of each stage: version negotiation, algorithm negotiation, key negotiation, identity authentication, detection items, determination results, and abnormal item explanations in the data transmission stage;

[0128] (c) Comprehensive evaluation: SM algorithm application compliance level in SSH protocol (such as "excellent / qualified / unqualified"), security score (full score 100), and optimization suggestions;

[0129] (d) Data attachments: complete detection log, and key operation data (such as SM2 signature result, SM3 hash value).

[0130] The application can ensure the confidentiality and integrity of data in the transmission process by algorithm negotiation, key negotiation, identity authentication, and data transmission between the target algorithm and the client based on the target encryption technology scheme. The application decomposes and embeds the session key of at least one of the key negotiation and the data transmission into each operation node in response to the session key white-box instruction, effectively resisting the extraction attack on the key and improving the resistance of the system to the key attack.

[0131] In addition, the embodiments of the application realize the compliance of the SSH protocol China secret algorithm (SM2 / SM3 / SM4) by adding a China secret algorithm detection module and a standardized detection mechanism, and provide detection technical support for the deployment of the SSH protocol China secret algorithm.

[0132] The traditional SSH protocol mainly uses international general-purpose cryptographic algorithms such as RSA, AES, SHA, etc. With the increasing demand for information security independence and compliance in various countries, China has introduced SM2, SM3, SM4, and other independent China secret algorithms. These algorithms are more suitable for Chinese needs in terms of security and compliance.

[0133] However, the existing SSH protocol has deficiencies in algorithm compatibility, either supporting only international general-purpose algorithms or only adapting to China secret algorithms, making it difficult to meet the flexible selection needs of various cryptographic algorithms in different users and different scenarios.

[0134] Therefore, the fourth embodiment of the application is proposed. In the fourth embodiment of the application, the same or similar contents as the above embodiments can be referred to the above introduction, and will not be described hereinafter. On this basis, based on the target encryption technology scheme, algorithm negotiation is carried out between the target algorithm and the client, including steps S411-S414:

[0135] Step S411, based on the cryptographic algorithm list in the negotiation request, combining the service support condition and the preset strategy, selecting the target algorithm;

[0136] Among them, the client sends a negotiation request to the server, which contains the cryptographic algorithm list supported by the client, covering international general-purpose algorithms (such as RSA for key exchange, AES for data encryption, and SHA-256 for hash operation) and China secret algorithms (such as SM2 for key exchange, SM4 for data encryption, and SM3 for hash operation). If both international algorithms and China secret algorithms are supported, the China secret algorithm is preferred.

[0137] Wherein, the server receives the request, from the algorithm list provided by the client, combines the self-supporting situation and the preset strategy, selects the appropriate key exchange algorithm, data encryption algorithm and hash algorithm, the algorithm is SM2-SM3-SM4 or RSA-SHA256-AES, if both algorithms are supported, the national secret algorithm suite is preferred.

[0138] Step S412, based on the target encryption technology scheme, the server key pair is generated in combination with the target algorithm;

[0139] Step S413, the server public key in the server key pair is derived, and the server private key in the server key pair is stored based on the target encryption technology scheme;

[0140] Wherein, if the target encryption technology scheme is hardware password device technology (hardware device supports SM2 or RSA, according to the client algorithm, if the client supports both algorithms, the national secret SM2 is preferred), the key pair for SSH authentication is generated in the password device, and the public key is derived, and the private key is stored in the hardware password device;

[0141] If the target encryption technology scheme is white box password technology, the key pair is generated using white box password technology (including SM2 white box and RSA white box, according to the algorithm type of the client), and the public key is derived, and the private key is stored using white box method.

[0142] Step S414, the target algorithm and the public key in the server key pair are sent to the client, so that the client generates a client key pair based on the target encryption technology scheme in combination with the target algorithm, the client public key in the client key pair is derived, and the client private key in the client key pair is stored based on the target encryption technology scheme.

[0143] The server sends the selected algorithm information (including algorithm name, version, etc.), the public key of the server to the client.

[0144] After receiving the feedback from the server, the client confirms the target algorithm selected by both parties, and generates a key pair of the corresponding algorithm,

[0145] Similarly, according to the selection prepared in the first step, if the target encryption technology scheme is hardware password device technology (hardware device supports SM2 or RSA, according to the algorithm and the algorithm ability of the server transmitted and the self algorithm ability), the key pair for SSH authentication is generated in the password device, and the public key is derived, and the private key is stored in the hardware password device,

[0146] If the target encryption technology scheme is white-box cryptography, the white-box technology is used to generate a key pair (including SM2 white-box and RSA white-box, selected according to the algorithm type of the client), and the public key is exported, and the private key is stored in a white-box manner.

[0147] If all the algorithms of a certain type fail to match, the algorithm negotiation of this type fails, and the algorithm negotiation between the SSH server and the client fails and the connection is disconnected.

[0148] The embodiment of the application provides an SSH protocol supporting multiple types of cryptographic algorithms based on white-box cryptographic algorithms, solves the problem of low key security in an untrusted environment, enables the protocol to flexibly adapt to international general algorithms and national cryptographic algorithms, and enhances the security and applicability of the protocol in different application scenarios.

[0149] Based on the above embodiment, in the fifth embodiment of the application, the same or similar contents as the above embodiment can be referred to the above introduction, and will not be described in detail. On this basis, based on the target encryption technology scheme, the key negotiation between the target algorithm and the client includes steps S415-S4111:

[0150] Step S415, receiving the message sent by the client, the message containing a first random number;

[0151] Based on the selected key exchange algorithm, the key negotiation is performed. If the SM2 algorithm is selected, the client and the server calculate the shared key based on the public keys of both parties using the SM2 algorithm; if the RSA algorithm is selected, the operation is performed according to the key exchange process of the RSA algorithm.

[0152] Among them, the client sends a message to the server, containing a first random number C.

[0153] Step S416, generating a second random number;

[0154] The server generates a random number S and signs C||S using the server private key.

[0155] Among them, in cryptography and security protocols, C||S means concatenating two data (C and S) to form a continuous bit string or byte sequence.

[0156] Step S417, based on the target encryption technology scheme, signing the first random number and the second random number using the server private key;

[0157] If the target encryption technology scheme is hardware cryptographic device technology, the server private key in the hardware cryptographic module is called to sign C||S;

[0158] If the target encryption technology scheme is white-box cryptography, the private key in white-box form is used to sign C||S.

[0159] In step S418, the server public key certificate, the second random number and the first signature data are returned to the client, so that the client verifies the first signature data using the server public key certificate, and if the verification is passed, a third random number is generated and encrypted using the server public key in the server public key certificate, and the encrypted third random number is sent to the server.

[0160] After signing, the server assembles and returns data, including the server public key certificate, the server random number S and the signature data.

[0161] After receiving the data, the client verifies the signature data using the server certificate public key, generates a random number as a key K, and then encrypts K using the server public key in the server certificate, and then sends it to the server.

[0162] In step S419, the encrypted third random number sent by the client is received.

[0163] In step S4110, based on the target encryption technology scheme, the server private key is used to decrypt the encrypted third random number to obtain the third random number.

[0164] After receiving the encrypted third random number, the server decrypts it using the server private key, and also selects hardware cryptographic device technology decryption or white-box cryptographic technology decryption.

[0165] In step S4111, the hash value is calculated with the client, and the hash value is composed of the first random number, the second random number, the server public key certificate and the third random number.

[0166] Both parties calculate the hash value H, which is composed of the first random number, the second random number, the server public key certificate and the third random number.

[0167] In the key agreement phase, if the session key white-box is enabled, the calculated session key is white-boxed to further improve the anti-attack performance of the session key in the transmission and use process.

[0168] The embodiment of the application can ensure the confidentiality and integrity of data in the transmission process by performing key negotiation with the client based on the target encryption technology scheme in combination with the target algorithm.

[0169] Based on the above embodiment, in the sixth embodiment of the application, the same or similar contents as the above embodiments can be referred to the above introduction, and will not be described in detail. On this basis, based on the target encryption technology scheme, identity authentication is performed with the client in combination with the target algorithm, including steps S4112-S4113:

[0170] In step S4112, when the client selects a public key-based authentication mode, the second signature data sent by the client is received, the second signature data is generated by performing a hash operation on the session data using a preset hash algorithm to generate a first digest, and the first digest is signed using the client private key based on the target encryption technology scheme;

[0171] In step S4113, the second signature data is verified using the client public key.

[0172] It should be noted that the client can select a password-based authentication mode or a public key-based authentication mode.

[0173] If the public key-based authentication mode is selected, the client generates a digest by performing a hash operation on the session data using a selected hash algorithm (such as SM3 or SHA-256), and then signs the digest using the private key (such as SM2 private key or RSA private key) corresponding to the algorithm of the client. During this period, a hardware-based password module or white-box password technology is also selected to sign the corresponding private key.

[0174] The client sends the signed data to the server, and the server verifies the signature using the public key of the client.

[0175] The embodiment of the application can ensure the confidentiality and integrity of data in the transmission process by performing identity authentication with the client based on the target encryption technology scheme in combination with the target algorithm.

[0176] Based on the above embodiment, in the seventh embodiment of the application, the same or similar contents as the above embodiments can be referred to the above introduction, and will not be described in detail. On this basis, based on the target encryption technology scheme, identity authentication is performed with the client in combination with the target algorithm, including steps S4114-S4115:

[0177] Step S4114, when the client selects the password-based authentication mode, receiving the third signature data sent by the client, the third signature data being obtained by encrypting the client using a preset data encryption algorithm;

[0178] Step S4115, verifying the third signature data using the preset data encryption algorithm and a pre-negotiated key.

[0179] If the client selects the password-based authentication mode, the client encrypts the password using a selected data encryption algorithm (such as SM4 or AES) to obtain third signature data, and transmits the third signature data to the server. The server decrypts and verifies using the same encryption algorithm and a negotiated key.

[0180] Based on the target encryption technical solution, the identity authentication of the client in combination with the target algorithm can ensure the confidentiality and integrity of data in the transmission process.

[0181] Based on the above embodiments, in the eighth embodiment of the present application, the same or similar contents as the above embodiments can be referred to the above introduction, and will not be described in detail. On this basis, based on the target encryption technical solution, the data transmission of the client in combination with the target algorithm includes steps S4116-S4121:

[0182] Step S4116, receiving the encrypted data sent by the client, the encrypted data being obtained by encrypting the grouped data to be transmitted using a preset data encryption algorithm and a session key by the client;

[0183] It should be noted that in the data transmission process, the selected data encryption algorithm (such as SM4 or AES) is used to encrypt and decrypt the transmitted data, which can ensure the confidentiality of the data.

[0184] The client groups the data to be transmitted, encrypts using the selected encryption algorithm and the session key, and then sends. The server receives and decrypts using the same session key.

[0185] Step S4117, decrypting the encrypted data using the preset data encryption algorithm and the session key to obtain the grouped data to be transmitted;

[0186] After receiving the encrypted data, the server decrypts the encrypted data using the preset data encryption algorithm and the session key to obtain the grouped data to be transmitted.

[0187] Step S4118, receiving the second digest sent by the client, the second digest being generated by the client using a preset hash algorithm to hash the data to be transmitted;

[0188] Step S4119, using the preset hash algorithm to hash the data to be transmitted to generate a third digest;

[0189] Step S4120, comparing the second digest with the third digest;

[0190] Step S4121, if the second digest and the third digest are the same, the data to be transmitted is not tampered.

[0191] For data integrity verification, a selected hash algorithm (such as SM3 or SHA-256) is used to hash the data to generate a digest, which is transmitted with the data. After receiving the data, the receiver reuses the same hash algorithm to calculate the hash digest and compares it with the received digest to ensure that the data has not been tampered with.

[0192] In addition, if the session key is white-boxed, the session key used in the entire data transmission process is protected by a white-box cryptographic algorithm. The session key is decomposed and embedded in each operation node of the white-box cryptographic algorithm, making it difficult for attackers to recover the complete session key even if they obtain the operation process.

[0193] When the client or the server decides to end the session, the client or the server sends a session end request to the other party, which contains the session end identifier and related information. After receiving the request, both parties release the keys used in this session (such as shared keys, session keys, etc.) and related resources (such as network connections, memory space, etc.), and the session ends.

[0194] Based on the target encryption technology scheme, the data transmission between the target algorithm and the client can ensure the confidentiality and integrity of the data during transmission. In response to the white-box session key instruction, the key negotiation session key is decomposed and embedded in each operation node. This processing method effectively resists key extraction attacks and improves the resistance of the system to key attacks.

[0195] Based on the above embodiments, in Embodiment Nine of the present application, the same or similar contents as the above embodiments can be referred to the above introduction, and will not be repeated hereinafter. On this basis, applied to the client, the method comprises the following steps:

[0196] Step S1, sending a negotiation request to the server to make the server select a target algorithm based on the list of cryptographic algorithms in the negotiation request, combined with the server support and preset policy, and based on the target encryption technology scheme, combined with the target algorithm and the client to perform SSH secure communication, and perform cryptographic algorithm detection in the SSH secure communication process. The target encryption technology scheme is determined by an intelligent hierarchical strategy including hardware cryptographic device technology and white box cryptographic technology.

[0197] Wherein, the client sends a negotiation request to the server. This request usually contains some information supported by the client, such as the list of cryptographic algorithms, protocol version, etc., which is used to negotiate the parameters and algorithms required for secure communication with the server.

[0198] Wherein, the intelligent hierarchical strategy comprehensively considers various factors such as security requirements, performance requirements, cost budget, etc., evaluates and classifies different cryptographic technologies, and selects the most suitable one or more as the target encryption technology scheme according to the specific application scenario and requirements. For example, for high security requirements, hardware cryptographic device technology may be preferred; for resource-constrained client environments, white box cryptographic technology may be considered; for environments with only hardware cryptographic devices, hardware cryptographic device technology is selected; for environments without hardware cryptographic devices, white box cryptographic technology is selected.

[0199] Wherein, the client lists various cryptographic algorithms it supports in the negotiation request, such as encryption algorithms (AES, DES, etc.), hash algorithms (SHA-1, SHA-256, etc.), signature algorithms (RSA, ECDSA, etc.), etc.

[0200] Wherein, the server support indicates that the server also has its own set of supported cryptographic algorithms. When selecting the target algorithm, it needs to ensure that the selected algorithm is supported by both the server and the client to ensure normal communication between the two parties.

[0201] Wherein, the server can select algorithms according to some preset rules and strategies, such as preferentially selecting algorithms with higher security, considering the performance overhead of algorithms, etc.

[0202] By considering the algorithms supported by the client, the server support and the preset policy, the target algorithm for this SSH secure communication is finally determined.

[0203] Wherein, the target encryption technology scheme determined by the intelligent hierarchical strategy, combined with the target algorithm obtained by the server and the client negotiating, the server and the client perform SSH secure communication.

[0204] The embodiment provides a secure communication method for password algorithm detection, and the application determines a target encryption technology scheme through an intelligent hierarchical strategy containing hardware password device technology and white-box password technology, wherein the white-box password technology provides a new train of thought for security enhancement of the SSH protocol as a new password implementation mode; the white-box password embeds a key into an operation structure of a password algorithm, so that the password operation can guarantee the security of the key in an untrusted environment, and even if an attacker can completely observe the execution process of the algorithm, it is difficult to extract the key information; the application can use the white-box password technology in the case where the hardware password device technology is not supported, so that the deployment cost and the use threshold are significantly reduced. The application receives a negotiation request sent by a client, selects a target algorithm based on a password algorithm list in the negotiation request, in combination with server support conditions and a preset strategy, performs SSH secure communication with the client based on the target encryption technology scheme and the target algorithm, and performs password algorithm detection in the SSH secure communication process; the application can support the case where the hardware password device technology is used and the case where the hardware password device technology is not used, users can select according to actual conditions and security requirements, so that a low-cost, high-efficiency and certain security communication scheme is provided for users.

[0205] The application also provides a secure communication device arranged on a server, please refer to Figure 4 , the secure communication device comprises:

[0206] The password determination module 10 is configured to determine a target encryption technology scheme through an intelligent hierarchical strategy containing hardware password device technology and white-box password technology.

[0207] The receiving module 20 is configured to receive a negotiation request sent by a client.

[0208] The algorithm selection module 30 is configured to select a target algorithm based on a password algorithm list in the negotiation request, in combination with server support conditions and a preset strategy.

[0209] The communication module 40 is configured to perform SSH secure communication with the client based on the target encryption technology scheme and the target algorithm, and perform password algorithm detection in the SSH secure communication process.

[0210] The secure communication device provided in the present application adopts the secure communication method for password algorithm detection in the above embodiments, and can solve the technical problem of high deployment cost of hardware password devices and improve the cost of secure communication. Compared with the prior art, the secure communication device provided in the present application has the same beneficial effects as the secure communication method for password algorithm detection provided in the above embodiments, and other technical features in the secure communication device are the same as the features disclosed in the above embodiments, which will not be repeated here.

[0211] The present application provides a secure communication device, which comprises at least one processor and a memory connected with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the secure communication method for password algorithm detection in the above embodiment one.

[0212] Reference will be made to the following description of the drawings Figure 5 which shows a structural schematic diagram of a secure communication device suitable for implementing the embodiments of the present application. The secure communication device in the embodiments of the present application can include but is not limited to mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (Personal Digital Assistant), PADs (Portable Application Description), PMPs (Portable Media Player), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), and the like, and fixed terminals such as digital TVs, desktop computers, and the like. Figure 5 The secure communication device shown is only an example and should not impose any limitation on the functions and use range of the embodiments of the present application.

[0213] As Figure 5As shown, the secure communication device can include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.) that can perform various appropriate actions and processes according to programs stored in a read-only memory 1002 or loaded from a storage device 1003 into a random access memory 1004. Various programs and data required for the operation of the secure communication device are also stored in the random access memory 1004. The processing device 1001, the read-only memory 1002, and the random access memory 1004 are connected to each other by a bus 1005. An input / output interface 1006 is also connected to the bus. Generally, the following systems can be connected to the input / output interface 1006: input devices 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; the storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the secure communication device to communicate with other devices wirelessly or by wire to exchange data. Although the secure communication device with various systems is shown in the figure, it should be understood that all the shown systems are not required to be implemented or possessed. More or less systems can be alternatively implemented or possessed.

[0214] In particular, according to the embodiments disclosed in the present application, the processes described above with reference to the flowcharts can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product comprising a computer program carried on a computer readable medium, the computer program containing program codes for executing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network by the communication device, or installed from the storage device 1003, or installed from the read-only memory 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the methods of the embodiments disclosed in the present application are performed.

[0215] The secure communication device provided by the present application adopts the secure communication method for password algorithm detection in the above-mentioned embodiments, which can solve the technical problem of high deployment cost of hardware password devices and improve the cost of secure communication. Compared with the prior art, the secure communication device provided by the present application has the same beneficial effects as the secure communication method for password algorithm detection provided by the above-mentioned embodiments, and the other technical features in the secure communication device are the same as the features disclosed in the previous embodiment method, which will not be repeated here.

[0216] It should be understood that various aspects of the disclosure can be implemented in hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any appropriate manner in any one or more embodiments or examples.

[0217] The above description is merely illustrative of the application and is not intended to limit the scope of the application. Any modifications or equivalents of the application should be construed as falling within the scope of the application. The scope of the application should be determined by the appended claims.

[0218] The application provides a computer readable storage medium having stored thereon computer readable program instructions (i.e., a computer program) for performing the secure communication method for cryptographic algorithm detection in the above embodiments.

[0219] The computer readable storage medium provided by the application may, for example, be a U disk, but is not limited to an electric, magnetic, optical, electromagnetic, infrared, or semiconductor system or device, or any combination thereof. More specific examples of the computer readable storage medium can include, but are not limited to, an electric connection having one or more conductive wires, a portable computer disk, a hard disk, a random access memory (RAM), a read only memory (ROM), an erasable programmable read only memory (EPROM or flash memory), an optical fiber, a portable compact disk read only memory (CD-ROM), an optical storage device, a magnetic storage device, or any appropriate combination thereof. In the present embodiment, the computer readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system or device. The program code contained on the computer readable storage medium can be transmitted by any appropriate medium, including but not limited to an electric wire, an optical cable, an RF (Radio Frequency), etc., or any appropriate combination thereof.

[0220] The above computer readable storage medium can be contained in a secure communication device or can exist separately without being assembled into a secure communication device.

[0221] The computer readable storage medium described above carries one or more programs, when the one or more programs are executed by the secure communication device, cause the secure communication device to: determine a target encryption technology scheme through an intelligent hierarchical strategy containing hardware cryptographic device technology and white-box cryptographic technology; receive a negotiation request sent by a client; select a target algorithm based on a cryptographic algorithm list in the negotiation request, in combination with server support and a preset strategy; and based on the target encryption technology scheme, in combination with the target algorithm, perform SSH secure communication with the client and perform cryptographic algorithm detection in the SSH secure communication process.

[0222] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0223] The flow diagrams and the block diagrams in the drawings are illustrations of architectures, functionalities, and operations of possible implementations of systems, methods, and computer program products according to various embodiments of present application. In this regard, each block in the flow diagrams or block diagrams can represent a module, a segment, or a portion of code, which comprises one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and / or flow diagrams, and combinations thereof, can be implemented by special purpose hardware-based systems that perform the specified functions or operations, or combinations of special purpose hardware and computer instructions.

[0224] The modules described in the embodiments of the present application can be implemented in the form of software or in the form of hardware. In some cases, the name of the module does not constitute a limitation on the module itself.

[0225] The readable storage medium provided by the present application is a computer readable storage medium, which stores computer readable program instructions (i.e. computer programs) for executing the above-mentioned security communication method for cipher algorithm detection, and can solve the technical problem of high deployment cost of hardware cipher device and improve the cost of security communication. Compared with the prior art, the beneficial effects of the computer readable storage medium provided by the present application are the same as those of the security communication method for cipher algorithm detection provided by the above-mentioned embodiments, and will not be repeated here.

[0226] The above only describes some embodiments of the present application, and does not limit the patent scope of the present application. Any equivalent structural transformation made by using the content of the present application specification and drawings, or direct / indirect application in other related technical fields is included in the patent protection scope of the present application.

Claims

1. A secure communication method for cryptographic algorithm detection, characterized in that, Applied to a server, the method comprises: Determine a target encryption technology scheme through an intelligent hierarchical strategy comprising hardware cryptographic device technology and white-box cryptographic technology; Receive a negotiation request sent by a client; Select a target algorithm based on a cryptographic algorithm list in the negotiation request, in combination with server support conditions and preset strategies, including: Carry out algorithm negotiation, key negotiation, identity authentication, and data transmission with the client based on the target encryption technology scheme and the target algorithm; In response to a session key white-boxing instruction, decompose a session key of at least one of the key negotiation and the data transmission and embed it in each operation node; In response to a national cryptographic algorithm detection instruction, obtain a detection dimension, and initialize a detection data collection module and a standard parameter library to detect the server and the client for national cryptographic algorithms; The step of carrying out algorithm negotiation with the client based on the target encryption technology scheme and the target algorithm comprises: Select the target algorithm based on the cryptographic algorithm list in the negotiation request, in combination with the server support conditions and the preset strategies; Generate a server key pair based on the target encryption technology scheme and the target algorithm; Export a server public key in the server key pair, and store a server private key in the server key pair based on the target encryption technology scheme; Send the target algorithm and the public key in the server key pair to the client, so that the client generates a client key pair based on the target encryption technology scheme and the target algorithm, exports a client public key in the client key pair, and stores a client private key in the client key pair based on the target encryption technology scheme; The step of carrying out key negotiation with the client based on the target encryption technology scheme and the target algorithm comprises: Receive a message sent by the client, the message comprising a first random number; Generate a second random number; Sign the first random number and the second random number using the server private key based on the target encryption technology scheme; Return a server public key certificate, the second random number, and first signature data to the client, so that the client verifies the first signature data using the server public key certificate, generates a third random number if the verification is passed, and encrypts the third random number using a server public key in the server public key certificate, and sends the encrypted third random number to the server; Receive the encrypted third random number sent by the client; Decrypt the encrypted third random number using the server private key based on the target encryption technology scheme to obtain the third random number; Calculate a hash value with the client, the hash value being composed of the first random number, the second random number, the server public key certificate, and the third random number; Carry out SSH secure communication with the client based on the target encryption technology scheme and the target algorithm, and carry out cryptographic algorithm detection in the SSH secure communication process.

2. The method of claim 1, wherein, The step of determining the target encryption technology scheme through the intelligent hierarchical strategy including the hardware cryptographic device technology and the white-box cryptographic technology comprises: detecting whether the hardware cryptographic device is missing; if not, determining that the target encryption technology scheme is the hardware cryptographic device technology; if yes, determining that the target encryption technology scheme is the white-box cryptographic technology.

3. The method of claim 1, wherein, The step of performing identity authentication with the client based on the target encryption technology scheme and the target algorithm comprises: when the client selects a public key-based authentication mode, receiving second signature data sent by the client, the second signature data being first digest generated by the client through hashing operation on session data using a preset hash algorithm, and being obtained by the client through signing the first digest using a client private key based on the target encryption technology scheme; verifying the second signature data using a client public key.

4. The method of claim 1, wherein, The step of performing identity authentication with the client based on the target encryption technology scheme and the target algorithm comprises: when the client selects a password-based authentication mode, receiving third signature data sent by the client, the third signature data being obtained by the client through encryption using a preset data encryption algorithm; verifying the third signature data using the preset data encryption algorithm and a pre-negotiated key.

5. The method of claim 1, wherein, The step of performing data transmission with the client based on the target encryption technology scheme and the target algorithm comprises: receiving encrypted data sent by the client, the encrypted data being obtained by the client through encryption on grouped to-be-transmitted data using a preset data encryption algorithm and a session key; decrypting the encrypted data using the preset data encryption algorithm and the session key to obtain the grouped to-be-transmitted data; receiving second digest sent by the client, the second digest being generated by the client through hashing operation on the to-be-transmitted data using a preset hash algorithm; performing hashing operation on the to-be-transmitted data using the preset hash algorithm to generate third digest; comparing the second digest with the third digest; if the second digest is the same as the third digest, the to-be-transmitted data is not tampered.

6. A secure communication method for cryptographic algorithm detection, characterized by, Applied to a client, the method comprises: sending a negotiation request to a server, so that the server selects a target algorithm based on a password algorithm list in the negotiation request, in combination with server support conditions and a preset strategy, and performs SSH secure communication with the client based on a target encryption technology scheme and the target algorithm, and performs password algorithm detection in the SSH secure communication process, the target encryption technology scheme being determined through an intelligent hierarchical strategy including a hardware cryptographic device technology and a white-box cryptographic technology; generating a client key pair based on the target encryption technology scheme and the target algorithm, deriving a client public key in the client key pair, and storing a client private key in the client key pair based on the target encryption technology scheme; sending a first random number to the server; receive a server public key certificate, a second random number and a first signature data returned by the server; verify the first signature data using the server public key certificate; if the verification is passed, generate a third random number, encrypt the third random number using a server public key in the server public key certificate, and send the encrypted third random number to the server; calculate a hash value with the server, the hash value being composed of the first random number, the second random number, the server public key certificate and the third random number; based on the target encryption technology scheme, perform SSH secure communication with the server in combination with the target algorithm, and cooperate with the password algorithm detection in the SSH secure communication process; in response to a session key white-boxing instruction, decompose and embed a session key of at least one of key negotiation or data transmission into each operation node; in response to a national secret algorithm detection instruction, complete national secret algorithm detection in combination with the server, including providing detection required data or executing a specified detection operation.

7. A secure communication device for cryptographic algorithm detection, characterized in that The device comprises a memory, a processor and a computer program stored on the memory and executable on the processor, and the computer program is configured to implement the steps of the secure communication method for password algorithm detection according to any one of claims 1 to 6.

Images