Request processing method and device, computer equipment and storage medium

Abstract

The invention relates to a request processing method, which comprises the following steps: evaluating a first mixed key combination in a received first message, and sending a second message to a client after the evaluation is passed; if the second mixed key combination in the second message passes the evaluation of the client, generating a session key based on the first mixed key combination and the second mixed key combination; performing double-signature verification on the mixed certificate in the received service processing request based on the gateway server; if the verification is passed, receiving target request data which is sent by the client and is obtained by encrypting the service request data by using the session key; decrypting the target request data to obtain corresponding service request content, and processing the service request content to obtain corresponding service response data; and encrypting the service response data by using the session key through the gateway server to obtain target response data, and sending the target response data to the client. According to the invention, the security and normalization of request processing are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, and in particular to a request processing method and device, a computer device and a storage medium. BACKGROUND

[0002] In the transmission encryption mode of a traditional communication system, data security is mainly guaranteed by the TLS / SSL protocol, and the core encryption mechanism thereof is based on classic public key algorithms such as RSA / ECC. However, with the rapid development of quantum computing technology, the Shor algorithm has shown the ability to break RSA and ECC algorithms in polynomial time, which makes the existing communication system face serious security threats in the process of business request processing. Due to the vulnerability of classic public key algorithms, an attacker may intercept and crack encrypted communication content through a quantum computing device, resulting in risks such as sensitive data leakage and business logic tampering, which seriously threatens the security and reliability of the communication system. For example, in the online transaction scenario in the financial insurance field, when a user submits an insurance application through a mobile terminal, the communication link encrypted by the traditional TLS / SSL protocol may be cracked due to quantum computing attacks, resulting in leakage of sensitive content such as user identity information and policy data. If the attacker tampers with the insurance amount or beneficiary information, it may cause insurance fraud or financial loss, harming the interests of users and insurance institutions.

[0003] Therefore, it is urgent to construct a new type of communication encryption method to improve transmission security and guarantee the safe operation of businesses in key fields such as finance and insurance. SUMMARY

[0004] The purpose of the embodiments of the present application is to provide a request processing method and device, a computer device and a storage medium to solve the technical problem of low security in the process of business request processing in the existing communication system.

[0005] In a first aspect, a request processing method is provided, comprising: receiving a first message sent by a client; wherein the first message carries a first hybrid key combination; extracting the first hybrid key combination from the first message based on a preset gateway server and performing evaluation, and sending a second message to the client after the first hybrid key combination passes the evaluation; wherein the gateway server is deployed with a preset dynamic plug-in; the second message carries a second hybrid key combination; if the second hybrid key combination passes the evaluation of the client, generating a corresponding session key based on the first hybrid key combination and the second hybrid key combination; receiving a business processing request issued by the client; wherein the business processing request carries a hybrid certificate of the client, and the hybrid certificate includes a national secret signature and a post-quantum signature; The gateway server performs dual-signature verification on the hybrid certificate; If the hybrid certificate is verified, the client sends target request data obtained by encrypting the business request data using the session key. The gateway server decrypts the target request data to obtain the corresponding business request content, and processes the business request content to obtain the corresponding business response data. The gateway server uses the session key to encrypt the service response data to obtain the corresponding target response data, and then sends the target response data to the client.

[0006] Secondly, a request processing apparatus is provided, comprising: The first receiving module is configured to receive a first message sent by the client; wherein the first message carries a first hybrid key combination; A first processing module is configured to extract the first hybrid key combination from the first message based on a preset gateway server and evaluate it, and send a second message to the client after the first hybrid key combination passes the evaluation; wherein, the gateway server is deployed with a preset dynamic plugin; the second message carries a second hybrid key combination; A generation module is configured to generate a corresponding session key based on the first hybrid key combination and the second hybrid key combination if the second hybrid key combination passes the evaluation of the client. The second receiving module is used to receive a service processing request sent by the client; wherein the service processing request carries the client's hybrid certificate, and the hybrid certificate includes a national cryptographic signature and a post-quantum signature; The verification module is used to perform dual-signature verification on the hybrid certificate based on the gateway server; The third receiving module is used to receive target request data sent by the client after encrypting the business request data using the session key, if the hybrid certificate passes verification. The second processing module is used to decrypt the target request data based on the gateway server to obtain the corresponding business request content, and to process the business request content to obtain the corresponding business response data. The third processing module is used to encrypt the business response data using the session key through the gateway server to obtain the corresponding target response data, and then send the target response data to the client.

[0007] Thirdly, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described request processing method.

[0008] Fourthly, a computer-readable storage medium is provided, which stores a computer program that, when executed by a processor, implements the steps of the above-described request processing method.

[0009] In the above-described request processing method, apparatus, computer equipment, and storage medium, a first message sent by a client is first received; wherein the first message carries a first hybrid key combination; then, based on a preset gateway server, the first hybrid key combination is extracted from the first message and evaluated, and a second message is sent to the client after the first hybrid key combination passes the evaluation; wherein the gateway server is deployed with a preset dynamic plugin; the second message carries a second hybrid key combination; If the second hybrid key combination passes the client's evaluation, a corresponding session key is generated based on the first and second hybrid key combinations. Then, a service processing request from the client is received; wherein the service processing request carries the client's hybrid certificate, which includes a national cryptographic signature and a post-quantum signature. Subsequently, the gateway server performs dual-signature verification on the hybrid certificate. If the hybrid certificate passes verification, target request data obtained by encrypting the service request data using the session key is received from the client. The gateway server further decrypts the target request data to obtain the corresponding service request content, processes the service request content to obtain the corresponding service response data, and finally, the gateway server encrypts the service response data using the session key to obtain the corresponding target response data, and sends the target response data to the client. Based on the above automated processing flow, this application extracts a first hybrid key combination from the first message using a gateway server. After the first hybrid key combination passes evaluation, a second message is sent to the client. If the second hybrid key combination passes the client's evaluation, a corresponding session key is generated based on the first and second hybrid key combinations. Then, the hybrid certificate carried in the client's business processing request is double-signed. Only after the hybrid certificate passes verification is the target request data (encrypted using the session key) received from the client. The gateway server then decrypts the target request data to obtain the business request content, processes it to obtain the business response data, and finally encrypts the business response data using the session key to obtain the target response data, which is then sent to the client. Thus, by using double-signature verification and session key-based encryption and decryption, secure data transmission between the client, gateway, and backend server is effectively guaranteed, preventing data theft or tampering during transmission, thereby improving the security and standardization of request processing. Attached Figure Description

[0010] To more clearly illustrate the solutions in this application, the accompanying drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is an exemplary system architecture diagram to which this application can be applied; Figure 2 This is a flowchart of one embodiment of the request processing method according to this application; Figure 3 This is a schematic diagram of the structure of one embodiment of the request processing apparatus according to this application; Figure 4 This is a schematic diagram of the structure of one embodiment of the computer device according to this application. Detailed Implementation

[0012] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein in the specification of the application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application; the terms "comprising" and "having," and any variations thereof, in the specification, claims, and foregoing drawings of this application, are intended to cover non-exclusive inclusion. The terms "first," "second," etc., in the specification, claims, or foregoing drawings of this application are used to distinguish different objects, not to describe a particular order.

[0013] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0014] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0015] like Figure 1As shown, system architecture 100 may include terminal device 101, network 102, and server 103. Terminal device 101 may be a laptop 1011, tablet 1012, or mobile phone 1013. Network 102 is used as a medium to provide a communication link between terminal device 101 and server 103. Network 102 may include various connection types, such as wired, wireless communication links, or fiber optic cables, etc.

[0016] Users can use terminal device 101 to interact with server 103 via network 102 to receive or send messages, etc. Various communication client applications can be installed on terminal device 101, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social media platform software, etc.

[0017] Terminal device 101 can be various electronic devices with a display screen and support web browsing. In addition to laptops 1011, tablets 1012, or mobile phones 1013, terminal device 101 can also be an e-book reader, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 player (Moving Picture Experts Group Audio Layer IV), a laptop computer, and a desktop computer, etc.

[0018] Server 103 can be a server that provides various services, such as a backend server that provides support for the pages displayed on terminal device 101.

[0019] It should be noted that the request processing method provided in this application embodiment is generally executed by a server / terminal device, and correspondingly, the request processing device is generally set in the server / terminal device.

[0020] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0021] Continue to refer to Figure 2 A flowchart illustrating an embodiment of the request processing method according to this application is shown. The order of steps in the flowchart can be changed, and some steps can be omitted, depending on different requirements. The request processing method provided by this application embodiment can be applied to any scenario requiring request processing, and therefore can be applied to products in these scenarios, such as request processing products in the financial insurance field. The request processing method includes the following steps: Step S201: Receive a first message sent by the client; wherein the first message carries a first hybrid key combination.

[0022] In this embodiment, the request processing method runs on an electronic device (e.g., Figure 1 The server / terminal device shown can obtain the first message sent by the client via a wired or wireless connection. It should be noted that the aforementioned wireless connection methods may include, but are not limited to, 3G / 4G / 5G connections, WiFi connections, Bluetooth connections, WiMAX connections, Zigbee connections, UWB (ultra-wideband) connections, and other currently known or future wireless connection methods. The executing entity of this application is specifically a server.

[0023] In this process, when the client (ClientHello) sends its first message (the ClientHello message) to the server (ServerHello), it negotiates a hybrid key group (the first hybrid key combination) in the `supported_groups` and `key_share` extensions. Additionally, when sending the ClientHello message, besides including standard TLS handshake parameters (such as supported protocol versions and a list of cipher suites), the client adds a dynamic key group indicator field. This field can contain a specified key group algorithm combination chosen by the client based on its local security policy and current environment preferences; this is the first hybrid key combination.

[0024] Step S202: Based on a preset gateway server, the first hybrid key combination is extracted from the first message and evaluated. After the first hybrid key combination passes the evaluation, a second message is sent to the client. The gateway server is equipped with a preset dynamic plugin. The second message carries a second hybrid key combination.

[0025] In this embodiment, the deployment process of the gateway server includes: introducing a new TLS module or dynamic plugin into the NGINX layer to act as a gateway server. Specifically, this can be achieved by modifying the NGINX configuration file to specify the path to load the new module, or by using dynamic plugin loading. This is achieved by integrating OpenSSL 3.x with the liboqs library. liboqs is an open-source post-quantum cryptography library containing implementations of various post-quantum cryptography algorithms. By installing the liboqs library on the system and configuring it accordingly during OpenSSL 3.x compilation, it can call the algorithms in the liboqs library. Furthermore, the Provider mechanism of OpenSSL 3.0 is utilized to load providers supporting Chinese national cryptographic standards and PQC algorithms. For domestic encryption libraries supporting SM2 / SM4, such as OpenSSL with Chinese national cryptographic patches, they can be loaded as a provider. Simultaneously, the OQS Provider module (such as oqsprovider.so) is loaded. This module provides implementations of post-quantum algorithms such as Kyber and Dilithium. By specifying the loading of these providers in the OpenSSL configuration file, OpenSSL can use these algorithms.

[0026] The deployment of plugins provides software-level support for the entire communication processing flow at the gateway layer (gateway server). NGINX, a commonly used gateway server, enables support for both traditional and post-quantum cryptographic algorithms by introducing new TLS modules or plugins and integrating the OpenSSL and Liboqs libraries. This allows NGINX to use these algorithms for key negotiation and certificate verification during the subsequent TLS handshake phase, laying the foundation for establishing a secure communication channel. Furthermore, the plugin intercepts ClientHello / ServerHello messages during the TLS handshake phase, calls the OpenSSL API to complete key negotiation and certificate verification, completely decoupling the handshake process from data forwarding. Moreover, NGINX does not need to connect to the backend to decrypt data; the encrypted client flow is transparently transmitted by the plugin after the handshake is complete. This achieves seamless encrypted access between the client and server: the client completes a hybrid handshake with the gateway, while the gateway and backend can continue to communicate using existing TLS or internal network protocols.

[0027] Furthermore, the aforementioned gateway server can extract the first hybrid key combination from the first message. If the server detects that the first hybrid key combination meets its security requirements, it determines that the first hybrid key combination has passed the evaluation and then sends a second message carrying the second hybrid key combination to the client. The generation process of the second hybrid key combination will be described in more detail in subsequent embodiments of this application and will not be elaborated upon here. Additionally, the aforementioned second message may refer to a ServerHello message sent by the server. A dynamic key group indication field can be added to the ServerHello message to confirm the finally selected key group algorithm combination (the second hybrid key combination), and the ServerHello message can then be sent back to the client.

[0028] Step S203: If the second hybrid key combination passes the client's evaluation, a corresponding session key is generated based on the first hybrid key combination and the second hybrid key combination.

[0029] In this embodiment, the specific implementation process of generating the corresponding session key based on the first hybrid key combination and the second hybrid key combination will be further described in detail in subsequent specific embodiments of this application, and will not be elaborated on here.

[0030] Step S204: Receive a service processing request from the client; wherein the service processing request carries the client's hybrid certificate, the hybrid certificate including a national cryptographic signature and a post-quantum signature.

[0031] In this embodiment, the hybrid certificate is structured as follows: based on the X.509v3 standard, a post-quantum public key field and a post-quantum signature field are added to the certificate extension field, forming a hybrid certificate that simultaneously supports SM2 and PQC. Specifically, the certificate body contains two public keys: one is an SM2 algorithm public key (used for traditional elliptic curve cryptography), and the other is a post-quantum public key (e.g., a public key encapsulated in Kyber keys). The certificate authority uses its SM2 private key to generate an SM2 signature (Chinese national cryptographic signature) on the certificate content (including the hybrid public key information), and simultaneously uses its PQC private key (e.g., a Dilithium private key) to generate a post-quantum signature; both are appended to the certificate. The certificate identifies the use of the composite signature algorithm by specifying a new OID, ensuring compatibility of the extension information with the existing X.509 format.

[0032] This invention employs a hybrid certificate structure to integrate the public keys and signature information of both traditional cryptographic algorithms (SM2) and post-quantum cryptographic algorithms into a single certificate. The aim is to ensure compatibility with existing cryptographic systems in future communication environments while addressing the potential threats posed by quantum computing to traditional cryptographic algorithms. The dual signature generated by the certificate authority guarantees the integrity and authenticity of the certificate, providing reliable credentials for subsequent certificate verification and key negotiation.

[0033] Step S205: Perform dual-signature verification on the hybrid certificate based on the gateway server.

[0034] In this embodiment, the specific implementation process of performing dual signature verification on the hybrid certificate based on the gateway server will be further described in detail in subsequent specific embodiments of this application, and will not be elaborated on here.

[0035] Step S206: If the hybrid certificate passes verification, receive the target request data sent by the client after encrypting the business request data using the session key.

[0036] In this embodiment, after the TLS handshake and hybrid certificate verification phases are successfully completed, a secure communication channel has been established between the client and the server, and both parties possess the final session key for encrypting and decrypting data. At this point, the client can begin sending service requests. The client uses the final session key to encrypt the service request data, and then sends the encrypted target request data to the server through the gateway server.

[0037] Step S207: Based on the gateway server, the target request data is decrypted to obtain the corresponding business request content, and the business request content is processed to obtain the corresponding business response data.

[0038] In this embodiment, the gateway server forwards the plaintext application data obtained by decrypting the aforementioned target request data through another secure channel with the backend server. This secure channel can be established using methods such as standard TLS or intranet encryption. For example, if the backend server is on an internal network, an intranet encryption protocol can be used to encrypt the data before forwarding; if the backend server is on an external network, a standard TLS protocol can be used to establish a secure connection for data forwarding.

[0039] In this process, after the encrypted request sent by the client reaches the gateway, the gateway server uses the final session key generated during the TLS handshake phase to decrypt the target request data, obtaining plaintext application data. Then, the gateway server uses the key used to establish the secure channel with the backend server to re-encrypt the plaintext application data and sends the encrypted data to the server. Subsequently, the server receives the encrypted data, decrypts it using the corresponding key, processes the application request, and generates business response data.

[0040] Step S208: The gateway server uses the session key to encrypt the service response data to obtain the corresponding target response data, and then sends the target response data to the client.

[0041] In this embodiment, the server encrypts the generated business response data before sending it to the gateway server. The gateway server then decrypts the encrypted business response data using the final session key, re-encrypts it, and forwards it to the client. All of this is transparent to the application layer, and both client and server applications can be compatible without modification.

[0042] This application first receives a first message sent by a client, wherein the first message carries a first hybrid key combination; then, based on a preset gateway server, the first hybrid key combination is extracted from the first message and evaluated, and a second message is sent to the client after the first hybrid key combination passes the evaluation; wherein the gateway server is deployed with a preset dynamic plugin; the second message carries a second hybrid key combination; if the second hybrid key combination passes the client's evaluation, a corresponding session key is generated based on the first hybrid key combination and the second hybrid key combination; then, a service processing request sent by the client is received; wherein the service processing request carries the client's hybrid certificate, the hybrid certificate including a national cryptographic signature and a post-quantum signature; subsequently, the hybrid certificate is verified by dual signature based on the gateway server; if the hybrid certificate passes the verification, target request data obtained by encrypting the service request data using the session key sent by the client is received; further, the target request data is decrypted by the gateway server to obtain the corresponding service request content, and the service request content is processed to obtain the corresponding service response data; finally, the service response data is encrypted by the gateway server using the session key to obtain the corresponding target response data, and the target response data is sent to the client. Based on the above automated processing flow, this application extracts a first hybrid key combination from the first message using a gateway server. After the first hybrid key combination passes evaluation, a second message is sent to the client. If the second hybrid key combination passes the client's evaluation, a corresponding session key is generated based on the first and second hybrid key combinations. Then, the hybrid certificate carried in the client's business processing request is double-signed. Only after the hybrid certificate passes verification is the target request data (encrypted using the session key) received from the client. The gateway server then decrypts the target request data to obtain the business request content, processes it to obtain the business response data, and finally encrypts the business response data using the session key to obtain the target response data, which is then sent to the client. Thus, by using double-signature verification and session key-based encryption and decryption, secure data transmission between the client, gateway, and backend server is effectively guaranteed, preventing data theft or tampering during transmission, thereby improving the security and standardization of request processing.

[0043] In some alternative implementations, step S203 includes the following steps: Get multiple preset mixing modes.

[0044] In this embodiment, the above-mentioned hybrid methods may include at least hash function hybrid methods, symmetric encryption function hybrid methods, and XOR operation hybrid methods.

[0045] Specifically, hash function hybridization methods include: designing a hash function-based hybridization approach, such as concatenating a shared key from a traditional cryptographic algorithm and a shared key from a post-quantum cryptographic algorithm, and then using a secure hash function (such as SHA-3) to perform hash operations to generate the final session key. Hash functions can effectively fuse key information from different sources, increasing the randomness and security of the key.

[0046] Hybrid symmetric encryption functions include using symmetric encryption algorithms (such as AES) to encrypt shared keys for both traditional cryptographic algorithms and post-quantum cryptographic algorithms. A temporary symmetric encryption key can be chosen (this key can be pre-negotiated and generated by the client and server), with both shared keys used as plaintext input, and the encrypted ciphertext used as the final session key. This method can increase key complexity and security.

[0047] The XOR operation can be used to combine shared keys from traditional cryptographic algorithms with shared keys from post-quantum cryptographic algorithms. XOR is a simple yet effective method that can alter the distribution characteristics of the key and increase its randomness.

[0048] Select the target blending method from all the blending methods described.

[0049] In this embodiment, the specific implementation process of selecting the target mixing method from all the described mixing methods will be further described in detail in subsequent specific embodiments of this application, and will not be elaborated on here.

[0050] The first hybrid key combination and the second hybrid key combination are processed based on the target mixing method to obtain the corresponding calculation result.

[0051] In this embodiment, the specific implementation process of performing calculations on the first hybrid key combination and the second hybrid key combination based on the target mixing method to obtain the corresponding calculation results will be further described in detail in subsequent specific embodiments of this application, and will not be elaborated on here.

[0052] The result of the calculation is used as the session key.

[0053] This application obtains multiple preset mixing methods; then selects a target mixing method from all the mixing methods; subsequently, it performs calculations on the first mixing key combination and the second mixing key combination based on the target mixing method to obtain the corresponding calculation result; and finally, it uses the calculation result as the session key. Based on the above processing flow, this application, by selecting a target mixing method from multiple obtained mixing methods, and then performing calculations on the first mixing key combination and the second mixing key combination based on the use of the target mixing method, and using the obtained calculation result as the final session key, increases the complexity and randomness of session key generation based on a multi-algorithm mixing key generation method, improves the security of the final session key, and effectively resists various attack methods.

[0054] In some optional implementations of this embodiment, selecting the target mixing method from all the mixing methods includes the following steps: Obtain current network environment information.

[0055] In this embodiment, a connection can be established with network monitoring equipment (such as a network traffic analyzer, network topology detector, etc.) to collect current network environment information in real time. This information may include network performance metrics such as network bandwidth, latency, and packet loss rate, as well as information on changes in network topology. The collected network environment information is then analyzed based on pre-set environmental assessment rules to obtain corresponding environmental assessment results. These results may include assessments of network security or the presence of security threats in the network environment.

[0056] Obtain the preset blending mode selection strategy.

[0057] In this embodiment, the strategy for selecting the hybrid method includes: periodically negotiating and selecting different hybrid methods based on factors such as the network environment. Specifically, when the network environment is relatively secure, a simpler XOR operation hybrid method can be selected; when the network environment faces a high security threat, a hybrid method based on a hash function or a symmetric encryption function is selected. The parameters of the hybrid function, such as the salt value of the hash function and the initial vector of the symmetric encryption algorithm, can be updated periodically to increase the randomness and security of key generation.

[0058] The network environment information is analyzed based on the hybrid mode selection strategy to determine the specified hybrid mode corresponding to the network environment information from all the hybrid modes.

[0059] In this embodiment, the network environment information can be analyzed based on the strategy content of the above-mentioned hybrid method selection strategy, and then the specified hybrid method corresponding to the network environment information can be determined from multiple hybrid methods, and used as the final target hybrid method.

[0060] The specified mixing method is used as the target mixing method.

[0061] This application obtains current network environment information; then obtains a preset mixing method selection strategy; subsequently analyzes the network environment information based on the mixing method selection strategy to determine a specified mixing method corresponding to the network environment information from all the mixing methods; and then uses the specified mixing method as the target mixing method. Based on the above processing flow, this application obtains current network environment information and a preset mixing method selection strategy, and then analyzes the network environment information based on the use of the mixing method selection strategy. This enables the automatic and intelligent determination of a specified mixing method corresponding to the network environment information from all mixing methods and uses it as the desired target mixing method. This effectively improves the accuracy of target mixing method selection and facilitates increased randomness and security in session key generation when using the target mixing method.

[0062] In some optional implementations, the step of performing calculations on the first hybrid key combination and the second hybrid key combination based on the target hybridization method to obtain the corresponding calculation result includes the following steps: Obtain the first shared key generated by the client corresponding to the second hybrid key combination; wherein the first shared key is generated by the client using a preset first key combination to calculate and process the second hybrid key combination.

[0063] In this embodiment, when the client (ClientHello) sends its first message (i.e., the ClientHello message) to the server (ServerHello), it negotiates a hybrid key group (i.e., the first hybrid key combination) in the supported_groups and key_share extensions. For example, a new group (such as SM2DH + Kyber768) is defined, and the ClientHello message carries both the SM2 elliptic curve Diffie-Hellman public key and the Kyber public key. These two public keys can be concatenated together according to a specific format or listed separately.

[0064] Subsequently, after receiving the first message (the ClientHello message), the server responds with the mixed key set (the first mixed key combination) proposed by the client in the second message (the ServerHello message). If the server supports this mixed key set, it confirms its use in the ServerHello message, carrying the corresponding SM2 and Kyber public keys from the server side. The choice of key set can be controlled through OpenSSL configuration, for example, by specifying SM2:Kyber768 in the server's OpenSSL configuration file to include both SM2 and Kyber public keys. During the subsequent handshake process, the client and server use SM2DH and Kyber respectively to complete their respective half-key negotiations.

[0065] Specifically, the client uses its own first SM2 private key and the SM2 public key sent by the server to perform SM2 elliptic curve Diffie-Hellman computation to generate a first SM2 half-key; simultaneously, it uses its own first Kyber private key and the Kyber public key sent by the server to perform Kyber algorithm computation to generate a first Kyber half-key. The generated first SM2 half-key and first Kyber half-key are then combined to obtain the corresponding first shared key. Furthermore, the aforementioned first key combination includes the client's corresponding first SM2 private key and first Kyber private key.

[0066] The first hybrid key combination is calculated and processed based on a preset second key combination to obtain the corresponding second shared key.

[0067] In this embodiment, the second key combination includes the server's own second SM2 private key and second Kyber private key. Referring to the method for generating the first shared key described above, the server performs a similar operation: using its own second SM2 private key and the client's SM2 public key to generate a second SM2 half-key, using its own second Kyber private key and the client's Kyber public key to generate a second Kyber half-key, and combining the generated second SM2 half-key and second Kyber half-key to obtain the corresponding second shared key.

[0068] The first shared key and the second shared key are processed based on the target mixing method to obtain the corresponding calculation results.

[0069] In this embodiment, the calculation processing of the first shared key and the second shared key can be performed based on the selected target mixing method, and the obtained calculation result is used as the corresponding operation result.

[0070] The calculation result is taken as the operation result.

[0071] This application obtains a first shared key generated by the client corresponding to the second hybrid key combination. The first shared key is generated by the client using a preset first key combination to calculate the second hybrid key combination. Then, a second shared key is obtained by calculating the first hybrid key combination based on a preset second key combination. Subsequently, the first shared key and the second shared key are calculated based on the target mixing method to obtain the corresponding calculation result. This calculation result is then used as the final operation result. Based on this process, this application obtains a first shared key generated by the client corresponding to the second hybrid key combination, calculates the first hybrid key combination based on a preset second key combination to obtain the corresponding second shared key, and then calculates the first shared key and the second shared key based on the target mixing method, using the calculated result as the corresponding operation result. This allows for automatic and accurate calculation of the first and second hybrid key combinations, ensuring the accuracy of the obtained operation result. The operation result is then used as the final session key, increasing the complexity and randomness of session key generation, improving the security of the generated session key, and effectively resisting various attack methods.

[0072] In some alternative implementations, step S205 includes the following steps: The gateway server obtains the target national cryptographic public key and the target post-quantum public key corresponding to the hybrid certificate from a preset certificate authority.

[0073] In this embodiment, a first public key (target national cryptographic public key) for verifying the SM2 signature (Chinese national cryptographic signature) in the hybrid certificate is obtained from a trusted Certificate Authority (CA) based on the use of the gateway server. This is typically obtained through pre-configuration or extraction from the CA's certificate. Similarly, a second public key (target post-quantum public key) for verifying the post-quantum signature (such as a Dilithium signature) in the hybrid certificate is also obtained from the CA.

[0074] The national cryptographic signature in the hybrid certificate is verified based on the target national cryptographic public key.

[0075] In this embodiment, the content of the hybrid certificate, excluding the signature portion of the national cryptographic signature, is hashed according to the rules of the SM2 signature algorithm to obtain the corresponding first hash value. Then, the SM2 signature in the hybrid certificate is decrypted using the obtained CA's SM2 public key to obtain the corresponding second hash value. The second hash value obtained through signature decryption is then compared with the calculated first hash value. If they match, it indicates that the SM2 signature verification is successful, the relevant content in the hybrid certificate has not been tampered with during transmission, and it was indeed issued by the CA possessing the corresponding SM2 private key.

[0076] If the national cryptographic signature fails verification, the entire certificate verification process is deemed to have failed, meaning the hybrid certificate has failed verification, and the TLS handshake will terminate.

[0077] If the national cryptographic signature passes verification, then the post-quantum signature in the hybrid certificate is verified based on the target post-quantum public key.

[0078] In this embodiment, the content of the hybrid certificate, excluding the signature portion of the post-quantum signature, is hashed according to the rules of a post-quantum signature algorithm (such as Dilithium) to obtain a corresponding third hash value. Then, the obtained target post-quantum public key of the CA (such as the Dilithium public key) is used to decrypt the post-quantum signature in the hybrid certificate, obtaining a corresponding fourth hash value. Finally, the fourth hash value obtained through signature decryption is compared with the calculated third hash value. If they match, the Dilithium signature verification is successful.

[0079] If the post-quantum signature passes verification, the hybrid certificate is deemed to have passed verification; otherwise, the hybrid certificate is deemed to have failed verification.

[0080] In this embodiment, the hybrid certificate is considered valid only if both the SM2 signature and the Dilithium signature pass verification, thus determining that the hybrid certificate has passed verification. If either signature fails verification, the entire certificate verification process fails, the TLS handshake terminates, and the hybrid certificate is deemed unverified.

[0081] The system also includes degradation strategies, including: **Existing Client Identification:** During the handshake process, the system can identify the client's type and capabilities through handshake messages (such as the ClientHello message). For example, it checks the client's supported algorithm list and extended fields to determine if the client supports post-quantum algorithms. **Policy Selection and Execution:** **SM2 Signature Verification Only:** If an existing client is detected as not supporting post-quantum algorithms, the server can choose to verify only the SM2 signature in the certificate. If the SM2 signature verification passes, the client is allowed to access. However, this approach may reduce security because it only uses traditional signature algorithms and does not fully utilize the security advantages of post-quantum signatures in hybrid certificates. **Access Denial:** To ensure communication security, the system can also choose to deny access to existing clients. When an existing client is detected as not supporting post-quantum algorithms, the server directly returns an error message and terminates the handshake process. This approach ensures that all accessing clients support higher security standards but may affect system compatibility.

[0082] This application obtains the target national cryptographic public key and the target post-quantum public key corresponding to the hybrid certificate from a preset certificate authority based on the gateway server; then, it verifies the national cryptographic signature in the hybrid certificate based on the target national cryptographic public key; if the national cryptographic signature passes verification, it verifies the post-quantum signature in the hybrid certificate based on the target post-quantum public key; if the post-quantum signature passes verification, the hybrid certificate is deemed to have passed verification; otherwise, the hybrid certificate is deemed to have failed verification. Based on the above processing flow, the hybrid certificate verification stage of this embodiment is a process of verifying the legality of the certificate. It uses a dual-signature parallel checking method to verify the national cryptographic signature and the post-quantum signature in the hybrid certificate. Only when both signatures pass verification is the hybrid certificate considered valid; otherwise, the handshake fails, thereby effectively ensuring the authenticity and legality of the identities of the communicating parties and preventing attacks by forged certificates.

[0083] In some optional implementations of this embodiment, before step S202, the electronic device may further perform the following steps: Invoke the default security management tools.

[0084] In this embodiment, the aforementioned security management tool is a pre-built automated tool with data collection, analysis, and policy generation functions.

[0085] The security management tool collects current network information related to security assessment.

[0086] In this embodiment, the information collection of the security management tool includes: Network environment information: By establishing a connection with network monitoring devices (such as network traffic analyzers, network topology detectors, etc.), real-time collection of network performance indicators such as network bandwidth, latency, and packet loss rate, as well as information on changes in network topology. Security threat intelligence: Integration with multiple security threat intelligence sources (such as security vendor threat intelligence platforms, open-source threat intelligence projects, etc.) to regularly obtain the latest security vulnerability information, malware characteristics, attack methods, and other threat intelligence. Server security policies: Security policy configurations reported by the server, including supported cryptographic algorithms, key length requirements, certificate trust policies, etc.

[0087] The current network information is evaluated and processed based on a preset security evaluation strategy to obtain the corresponding security evaluation result.

[0088] In this embodiment, the collected network environment information, security threat intelligence, and server security policies are comprehensively analyzed to generate corresponding security assessment results.

[0089] Based on the security assessment results, the corresponding key group algorithm combination is selected from the preset algorithm combination list.

[0090] In this embodiment, the aforementioned algorithm combination list can be a list of algorithm combinations provided according to actual business needs. Real-time security recommendations can be generated based on the obtained security assessment results and a preset security assessment model. For example, if an attack targeting a specific traditional cryptographic algorithm is detected in the network, the security recommendation will lower the priority of that algorithm or directly exclude it; if network bandwidth is sufficient, the security recommendation may favor algorithm combinations with higher computational complexity but stronger security. Then, based on the generated security recommendation, a key group algorithm combination matching the security recommendation is selected from the aforementioned algorithm combination list and used as the required second hybrid key combination.

[0091] The key group algorithm combination is used as the second hybrid key combination.

[0092] This application utilizes a pre-defined security management tool; then, based on the security management tool, it collects current network information related to security assessment; subsequently, it evaluates and processes the current network information based on a pre-defined security assessment strategy to obtain a corresponding security assessment result; next, based on the security assessment result, it selects a corresponding key group algorithm combination from a pre-defined algorithm combination list; finally, it uses the key group algorithm combination as the second hybrid key combination. Based on this processing flow, this application collects current network information related to security assessment using a security management tool, evaluates and processes the current network information based on a security assessment strategy, and then selects a corresponding key group algorithm combination from a pre-defined algorithm combination list based on the obtained security assessment result as the corresponding second hybrid key combination. This achieves dynamic selection of the hybrid key combination, improving the intelligence and adaptability of the generated second hybrid key combination.

[0093] In some optional implementations of this embodiment, after step S205, the electronic device may further perform the following steps: If the hybrid certificate fails verification, processing of the business processing request will be restricted.

[0094] In this embodiment, if the hybrid certificate fails verification, the system will refuse access to the old client and refuse to process the above-mentioned business processing request in order to ensure the security of communication.

[0095] Get the preset error message.

[0096] In this embodiment, the error message is a pre-constructed message corresponding to the content of the hybrid certificate failing signature verification.

[0097] The error message is sent to the client.

[0098] In this embodiment, the handshake process can be terminated by sending the acquired error information to the client.

[0099] If this application detects that the hybrid certificate has failed verification, it restricts the processing of the business processing request; then it obtains preset error information; and subsequently sends the error information to the client. Based on the above processing flow, when this application detects that the hybrid certificate has failed verification, it automatically restricts the processing of the business processing request and intelligently sends error information to the client. This method can ensure that all connected clients support high security standards, effectively improving the standardization and security of business processing request processing.

[0100] In some alternative implementations, the user information obtained is subject to user consent and complies with relevant laws and policies.

[0101] Furthermore, any software tools or components not belonging to our company that appear in the embodiments of this application are merely illustrative examples and do not represent actual use.

[0102] Furthermore, this application proposes a hybrid certificate scheme based on the Chinese national cryptographic SM2 algorithm and the post-quantum PQC algorithm (using Kyber key encapsulation and Dilithium signature). An improved TLS 1.3 encryption module is deployed as a plug-in at the NGINX proxy layer to achieve dual-algorithm hybrid handshake and dual-signature verification, ensuring secure communication and application transparency. Specifically, a hybrid certificate structure is designed, containing both an SM2 public key and a PQC public key. An authoritative CA generates SM2 and PQC signatures for these two parts respectively (i.e., a "composite certificate"). Both the client and server use the standard TLS 1.3 process, but during the handshake, a new key exchange group containing classical and post-quantum components is negotiated. The plug-in takes over the handshake process at the NGINX layer, completing the dual-algorithm key negotiation and certificate verification without modifying the client or backend application. This method is compatible with existing TLS 1.3 protocols and can automatically fall back to classical key exchange when the client does not support PQC, offering flexible deployment.

[0103] Furthermore, this application has the following innovative aspects: 1. Zero-modification support for existing applications: This application enhances quantum security at the gateway layer while maintaining the client and server interfaces unchanged, requiring no upgrades to client software or modifications to backend application code. For the client, it only sees a valid TLS certificate and the completed handshake process; for the server, it can continue using its existing TLS / SSL configuration or establish a traditional secure channel with the gateway, significantly reducing deployment risks and costs. Apple's specification states that in quantum-secure TLS connections, automatic fallback to a traditional key exchange group is possible when the peer does not support the new algorithm; similarly, this invention adopts a flexible compatibility strategy, supporting on-demand fallback.

[0104] 2. Parallel Dual Authentication Enhances Authentication Strength: By employing a hybrid certificate design that incorporates both SM2 and PQC signatures, authentication requires both signatures to pass successfully. This parallel authentication mechanism significantly improves security and mitigates the risk of a single algorithm being compromised. For example, if future quantum attacks could partially threaten SM2 security, the Dilithium signature would still ensure the certificate's legitimacy, effectively avoiding the risks associated with traditional PKI single-point certificates.

[0105] 3. Pure software implementation, no HSM required: The solution implements post-quantum encryption and national cryptographic standard support based on software libraries such as OpenSSL 3.x and liboqs, without relying on expensive hardware security modules (HSMs) or dedicated chips. The OQS project has provided an oqs-provider for OpenSSL 3, supporting post-quantum KEM and signatures under TLS 1.3. Therefore, a high-strength quantum-resistant encryption environment can be deployed on ordinary x86 or ARM servers, reducing equipment costs and operational burden.

[0106] 4. Compatible with standard TLS 1.3 protocol, allowing for flexible fallback: The entire system is compatible with standard TLS 1.3, without changing the protocol format or port, and supports dynamic hybrid algorithm negotiation. Clients that support post-quantum handshakes use hybrid groups; otherwise, they automatically complete a traditional TLS 1.3 handshake with the gateway. This compatibility gives the system excellent progressive deployment capabilities: post-quantum enhancements can be gradually introduced in environments where all clients / servers are not updated simultaneously. The solution can also adjust priorities during the TLS handshake according to policies (e.g., prioritizing national cryptographic algorithms or post-quantum algorithms), providing flexible deployment options.

[0107] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0108] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing related hardware through computer-readable instructions. These computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above methods. The aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, optical disk, or read-only memory (ROM), or random access memory (RAM).

[0109] It should be understood that although the steps in the flowcharts of the accompanying figures are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the accompanying figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0110] Further reference Figure 3 As a response to the above Figure 2 To implement the method shown, this application provides an embodiment of a request processing apparatus, which is similar to... Figure 2 Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.

[0111] like Figure 3 As shown, the request processing device 300 described in this embodiment includes: a first receiving module 301, a first processing module 302, a generating module 303, a second receiving module 304, a verification module 305, a third receiving module 306, a second processing module 307, and a third processing module 308. Wherein: The first receiving module 301 is used to receive a first message sent by the client; wherein the first message carries a first hybrid key combination; The first processing module 302 is configured to extract the first hybrid key combination from the first message based on a preset gateway server and evaluate it, and send a second message to the client after the first hybrid key combination passes the evaluation; wherein, the gateway server is deployed with a preset dynamic plugin; the second message carries a second hybrid key combination; The generation module 303 is used to generate a corresponding session key based on the first hybrid key combination and the second hybrid key combination if the second hybrid key combination passes the evaluation of the client. The second receiving module 304 is used to receive a service processing request sent by the client; wherein the service processing request carries the client's hybrid certificate, and the hybrid certificate includes a national cryptographic signature and a post-quantum signature; Verification module 305 is used to perform dual-signature verification on the hybrid certificate based on the gateway server; The third receiving module 306 is used to receive target request data sent by the client after encrypting the business request data using the session key, if the hybrid certificate passes verification. The second processing module 307 is used to decrypt the target request data based on the gateway server to obtain the corresponding business request content, and to process the business request content to obtain the corresponding business response data. The third processing module 308 is used to encrypt the business response data using the session key through the gateway server to obtain the corresponding target response data, and then send the target response data to the client.

[0112] In this embodiment, the operations performed by the above modules or units correspond one-to-one with the steps of the request processing method in the aforementioned embodiments, and will not be repeated here.

[0113] In some optional implementations of this embodiment, the generation module 303 includes: The first acquisition submodule is used to acquire multiple preset mixing methods; A filtering submodule is used to filter out the target mixing method from all the said mixing methods; The computation submodule is used to perform computational processing on the first hybrid key combination and the second hybrid key combination based on the target hybridization method to obtain the corresponding computational result; A determination submodule is used to use the calculation result as the session key.

[0114] In this embodiment, the operations performed by the above modules or units correspond one-to-one with the steps of the request processing method in the aforementioned embodiments, and will not be repeated here.

[0115] In some optional implementations of this embodiment, the filtering submodule includes: The first acquisition unit is used to acquire current network environment information; The second acquisition unit is used to acquire a preset mixing method selection strategy; The first determining unit is used to analyze the network environment information based on the hybrid mode selection strategy, so as to determine the specified hybrid mode corresponding to the network environment information from all the hybrid modes; The second determining unit is used to select the specified mixing method as the target mixing method.

[0116] In this embodiment, the operations performed by the above modules or units correspond one-to-one with the steps of the request processing method in the aforementioned embodiments, and will not be repeated here.

[0117] In some optional implementations of this embodiment, the computation submodule includes: The third acquisition unit is used to acquire the first shared key generated by the client corresponding to the second hybrid key combination; wherein the first shared key is generated by the client using a preset first key combination to calculate and process the second hybrid key combination; The first calculation unit is used to perform calculation processing on the first hybrid key combination based on a preset second key combination to obtain the corresponding second shared key; The second calculation unit is used to perform calculations on the first shared key and the second shared key based on the target mixing method to obtain the corresponding calculation results; The third determining unit is used to take the calculation result as the operation result.

[0118] In this embodiment, the operations performed by the above modules or units correspond one-to-one with the steps of the request processing method in the aforementioned embodiments, and will not be repeated here.

[0119] In some optional implementations of this embodiment, the verification module 305 includes: The second acquisition submodule is used to acquire the target national cryptographic public key and the target post-quantum public key corresponding to the hybrid certificate from the preset certificate authority based on the gateway server; The first verification submodule is used to verify the national cryptographic signature in the hybrid certificate based on the target national cryptographic public key; The second verification submodule is used to verify the post-quantum signature in the hybrid certificate based on the target post-quantum public key if the national cryptographic signature passes the verification. The determination submodule is used to determine that the hybrid certificate has passed verification if the post-quantum signature has passed verification, and otherwise determine that the hybrid certificate has failed verification.

[0120] In this embodiment, the operations performed by the above modules or units correspond one-to-one with the steps of the request processing method in the aforementioned embodiments, and will not be repeated here. In some optional implementations of this embodiment, the request processing device further includes: The calling module is used to invoke preset security management tools; The data acquisition module is used to collect current network information related to security assessment based on the security management tool. The evaluation module is used to evaluate the current network information based on a preset security evaluation strategy to obtain the corresponding security evaluation result. The filtering module is used to filter out the corresponding key group algorithm combination from the preset algorithm combination list based on the security assessment results; A determining module is used to combine the key group algorithm as the second hybrid key combination.

[0121] In this embodiment, the operations performed by the above modules or units correspond one-to-one with the steps of the request processing method in the aforementioned embodiments, and will not be repeated here.

[0122] In some optional implementations of this embodiment, the request processing device further includes: The fourth processing module is used to restrict the processing of the business processing request if the hybrid certificate fails verification. The acquisition module is used to acquire preset error information; The sending module is used to send the error information to the client.

[0123] In this embodiment, the operations performed by the above modules or units correspond one-to-one with the steps of the request processing method in the aforementioned embodiments, and will not be repeated here. To address the aforementioned technical problems, embodiments of this application also provide a computer device. Please refer to [link / reference needed] for details. Figure 4 , Figure 4 This is a basic structural block diagram of the computer device in this embodiment.

[0124] The computer device 4 includes a memory 41, a processor 42, and a network interface 43 that are interconnected via a system bus. It should be noted that only the computer device 4 with components 41-43 is shown in the figure; however, it should be understood that it is not required to implement all the shown components, and more or fewer components can be implemented alternatively. Those skilled in the art will understand that the computer device described here is a device capable of automatically performing numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0125] The computer device can be a desktop computer, laptop, handheld computer, or cloud server, etc. The computer device can interact with the user via a keyboard, mouse, remote control, touchpad, or voice control.

[0126] The memory 41 includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 41 may be an internal storage unit of the computer device 4, such as the hard disk or memory of the computer device 4. In other embodiments, the memory 41 may also be an external storage device of the computer device 4, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the computer device 4. Of course, the memory 41 may include both the internal storage unit and its external storage device of the computer device 4. In this embodiment, the memory 41 is typically used to store the operating system and various application software installed on the computer device 4, such as computer-readable instructions for request processing methods. In addition, the memory 41 can also be used to temporarily store various types of data that have been output or will be output.

[0127] In some embodiments, the processor 42 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 42 is typically used to control the overall operation of the computer device 4. In this embodiment, the processor 42 is used to execute computer-readable instructions stored in the memory 41 or to process data, for example, to execute computer-readable instructions of the request processing method.

[0128] The network interface 43 may include a wireless network interface or a wired network interface, which is typically used to establish communication connections between the computer device 4 and other electronic devices.

[0129] This application also provides another embodiment, namely, providing a computer-readable storage medium storing computer-readable instructions that can be executed by at least one processor to cause the at least one processor to perform the steps of the request processing method described above.

[0130] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0131] Obviously, the embodiments described above are only some embodiments of this application, not all embodiments. The accompanying drawings show preferred embodiments of this application, but do not limit the patent scope of this application. This application can be implemented in many different forms; rather, the purpose of providing these embodiments is to provide a more thorough and comprehensive understanding of the disclosure of this application. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent substitutions for some of the technical features. Any equivalent structures made using the content of this application's specification and drawings, directly or indirectly applied to other related technical fields, are similarly within the scope of patent protection of this application.

Claims

1. A request processing method, characterized in that, Includes the following steps: Receive a first message sent by the client; wherein the first message carries a first hybrid key combination; The gateway server extracts and evaluates the first hybrid key combination from the first message based on a preset configuration, and sends a second message to the client after the first hybrid key combination passes the evaluation; wherein, the gateway server is deployed with a preset dynamic plugin; the second message carries a second hybrid key combination; If the second hybrid key combination passes the client's evaluation, a corresponding session key is generated based on the first hybrid key combination and the second hybrid key combination; Receive a service processing request sent by the client; wherein the service processing request carries the client's hybrid certificate, the hybrid certificate including a national cryptographic signature and a post-quantum signature; The gateway server performs dual-signature verification on the hybrid certificate; If the hybrid certificate is verified, the client sends target request data obtained by encrypting the business request data using the session key. The gateway server decrypts the target request data to obtain the corresponding business request content, and processes the business request content to obtain the corresponding business response data. The gateway server uses the session key to encrypt the service response data to obtain the corresponding target response data, and then sends the target response data to the client.

2. The request processing method according to claim 1, characterized in that, The step of generating a corresponding session key based on the first hybrid key combination and the second hybrid key combination specifically includes: Obtain multiple preset mixing modes; Select the target blending method from all the described blending methods; Based on the target mixing method, the first mixed key combination and the second mixed key combination are processed to obtain the corresponding calculation result; The result of the calculation is used as the session key.

3. The request processing method according to claim 2, characterized in that, The step of selecting the target mixing method from all the mixing methods specifically includes: Obtain current network environment information; Obtain the preset blending mode selection strategy; The network environment information is analyzed based on the hybrid mode selection strategy to determine the specified hybrid mode corresponding to the network environment information from all the hybrid modes. The specified mixing method is used as the target mixing method.

4. The request processing method according to claim 2, characterized in that, The step of performing calculations on the first hybrid key combination and the second hybrid key combination based on the target hybridization method to obtain the corresponding calculation result specifically includes: Obtain the first shared key generated by the client corresponding to the second hybrid key combination; wherein, the first shared key is generated by the client using a preset first key combination to calculate and process the second hybrid key combination; The first hybrid key combination is calculated and processed based on a preset second key combination to obtain the corresponding second shared key; Based on the target mixing method, the first shared key and the second shared key are processed to obtain the corresponding calculation results; The calculation result is taken as the operation result.

5. The request processing method according to claim 1, characterized in that, The step of performing dual-signature verification on the hybrid certificate based on the gateway server specifically includes: The gateway server obtains the target national cryptographic public key and the target post-quantum public key corresponding to the hybrid certificate from a preset certificate authority. The national cryptographic signature in the hybrid certificate is verified based on the target national cryptographic public key; If the national cryptographic signature passes verification, then the post-quantum signature in the hybrid certificate is verified based on the target post-quantum public key; If the post-quantum signature passes verification, the hybrid certificate is deemed to have passed verification; otherwise, the hybrid certificate is deemed to have failed verification.

6. The request processing method according to claim 1, characterized in that, Before the step of the gateway server extracting and evaluating the first hybrid key combination from the first message based on a preset value, and sending the second message to the client after the first hybrid key combination passes the evaluation, the method further includes: Invoke the preset security management tools; Based on the security management tools, current network information related to security assessment is collected; The current network information is evaluated and processed based on a preset security evaluation strategy to obtain the corresponding security evaluation result. Based on the security assessment results, the corresponding key group algorithm combination is selected from the preset algorithm combination list; The key group algorithm combination is used as the second hybrid key combination.

7. The request processing method according to claim 1, characterized in that, Following the step of performing dual-signature verification on the hybrid certificate based on the gateway server, the method further includes: If the hybrid certificate fails verification, processing of the business processing request will be restricted. Get the preset error message; The error message is sent to the client.

8. A request processing apparatus, characterized in that, include: The first receiving module is configured to receive a first message sent by the client; wherein the first message carries a first hybrid key combination; A first processing module is configured to extract the first hybrid key combination from the first message based on a preset gateway server and evaluate it, and send a second message to the client after the first hybrid key combination passes the evaluation; wherein, the gateway server is deployed with a preset dynamic plugin; the second message carries a second hybrid key combination; A generation module is configured to generate a corresponding session key based on the first hybrid key combination and the second hybrid key combination if the second hybrid key combination passes the evaluation of the client. The second receiving module is used to receive a service processing request sent by the client; wherein the service processing request carries the client's hybrid certificate, and the hybrid certificate includes a national cryptographic signature and a post-quantum signature; The verification module is used to perform dual-signature verification on the hybrid certificate based on the gateway server; The third receiving module is used to receive target request data sent by the client after encrypting the business request data using the session key, if the hybrid certificate passes verification. The second processing module is used to decrypt the target request data based on the gateway server to obtain the corresponding business request content, and to process the business request content to obtain the corresponding business response data. The third processing module is used to encrypt the business response data using the session key through the gateway server to obtain the corresponding target response data, and then send the target response data to the client.

9. A computer device, characterized in that, The device includes a memory and a processor, wherein the memory stores computer-readable instructions, and the processor, when executing the computer-readable instructions, implements the steps of the request processing method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-readable instructions that, when executed by a processor, implement the steps of the request processing method as described in any one of claims 1 to 7.

Images