A GoProxy-based UDP traffic encryption and decryption method, device, equipment and medium

Abstract

The application discloses a GoProxy-based UDP traffic encryption and decryption method and device, equipment and medium, and relates to the technical field of network security, which comprises the following steps: intercepting UDP data packets through GoProxy; generating a first check value and sending it to a server, receiving a second check value generated by the server, so that the client and the server respectively perform consistency check; after the consistency check passes, a first encryption key and a first check key are generated, the UDP data packet is encrypted by using the first encryption key to obtain target ciphertext, and the target check value of the target ciphertext is generated by using the first check key; the encrypted data packet generated based on the target ciphertext and the target check value is sent to the server, so that the server checks the target check value based on the second check key, and decrypts the target ciphertext based on the second encryption key to obtain the UDP data packet after the check passes. The application can realize UDP traffic compliance encryption and guarantee operation performance.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, apparatus, device, and medium for UDP traffic encryption and decryption based on GoProxy. Background Technology

[0002] In the field of network security and data transmission, the UDP (User Datagram Protocol) protocol, due to its connectionless nature, cannot reuse the TLS / SSL encryption system of the TCP (Transmission Control Protocol), leading to risks of eavesdropping, tampering, and identity impersonation. Existing Chinese national cryptographic algorithms SM2 / SM3 / SM4 face bottlenecks in adapting to UDP: SM2 key exchange relies on bidirectional interaction, which is difficult to match UDP's "connectionless + unreliable" characteristics; SM4 encryption mode requires a fixed block size, conflicting with UDP's variable packet length, and lacks a national cryptographic verification scheme for UDP 5-tuples.

[0003] Existing proxy-based UDP encryption schemes have the following problems: general proxy frameworks, such as Squid and Nginx, do not integrate national cryptographic algorithms, resulting in a performance loss of over 30% after secondary development; dedicated encryption proxies, such as Shadowsocks UDP mode, use non-national cryptographic algorithms AES (Advanced Encryption Standard), which do not meet compliance requirements and lack a dynamic key update mechanism.

[0004] In summary, how to achieve compliant encryption of UDP traffic while ensuring operational performance is a pressing technical problem that needs to be solved. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide a UDP traffic encryption and decryption method, apparatus, device, and medium based on GoProxy, which can achieve compliant encryption of UDP traffic while ensuring operational performance. The specific solution is as follows:

[0006] Firstly, this application provides a UDP traffic encryption / decryption method based on GoProxy, applied to a client, including:

[0007] The client proxy intercepts target UDP packets in the client's local UDP traffic using GoProxy. If the session state between the client and the server is determined to be a new session based on the target UDP packets, session information is generated and sent to the server.

[0008] Based on the session information, a first verification value corresponding to the client is generated and sent to the server. The client receives a second verification value corresponding to the server generated by the server based on the session information, so that the client and the server can perform consistency verification on the first verification value and the second verification value respectively.

[0009] After the consistency check passes, a first encryption key and a first verification key are generated. The first encryption key is used to encrypt the target UDP data packet to obtain the target ciphertext. The first verification key is used to generate the target verification value corresponding to the target ciphertext.

[0010] An encrypted data packet generated based on the target ciphertext and the target checksum is sent to the server, so that the server can verify the target checksum in the encrypted data packet based on the second verification key generated by the server after the consistency verification is passed, and after the verification is passed, decrypt the target ciphertext in the encrypted data packet based on the second encryption key generated by the server after the consistency verification is passed, to obtain the target UDP data packet.

[0011] Optionally, the step of using a client proxy to intercept target UDP packets in the client's local UDP traffic via GoProxy includes:

[0012] The client proxy uses the hook function of GoProxy to intercept the target UDP packet in the client's local UDP traffic and extracts the five-tuple information corresponding to the target UDP packet; the five-tuple information includes source IP address, source port, destination IP address, destination port and transport layer protocol;

[0013] The session table is queried based on the quintuple information to determine whether the session state between the client and the server is a new session.

[0014] Optionally, the UDP traffic encryption / decryption method based on GoProxy further includes:

[0015] The target SM2 elliptic curve parameters are determined with the server;

[0016] The first identity identifier corresponding to the client and the second identity identifier corresponding to the server are determined so that the server can generate the second temporary private key corresponding to the server using the first preset random number generator, and generate the second temporary public key corresponding to the server based on the target SM2 elliptic curve parameters and the second temporary private key, and generate the hash value of the second identity identifier corresponding to the server based on the SM3 algorithm, the second identity identifier and the target SM2 elliptic curve parameters.

[0017] A first temporary private key corresponding to the client is generated using a second preset random number generator, and a first temporary public key corresponding to the client is generated based on the target SM2 elliptic curve parameters and the first temporary private key.

[0018] The hash value of the first identity identifier corresponding to the client is generated based on the SM3 algorithm, the first identity identifier, and the target SM2 elliptic curve parameters.

[0019] Optionally, generating the first verification value corresponding to the client includes:

[0020] A first data packet is generated based on the first temporary public key and the first identity hash value, and the first data packet is sent to the server so that the server determines the first secret point based on the ECDH algorithm, the second temporary private key and the first temporary public key in the first data packet, extracts the coordinates of the first secret point, and generates the second verification value corresponding to the server based on the SM3 algorithm, the coordinates of the first secret point, the second identity hash value and the first identity hash value in the first data packet.

[0021] The server receives a second data packet and determines a second secret point based on the ECDH algorithm, the first temporary private key, and the second temporary public key in the second data packet; the second data packet is a data packet generated by the server based on the second temporary public key and the hash value of the second identity identifier.

[0022] Extract the coordinates of the second secret point, and generate the first verification value corresponding to the client based on the SM3 algorithm, the coordinates of the second secret point, the hash value of the first identity identifier, and the hash value of the second identity identifier in the second data packet.

[0023] Optionally, generating the first encryption key and the first verification key includes:

[0024] An initial session key is generated based on the SM3 algorithm, the key derivation function, the coordinates of the second secret point, and the target random number. An iterative hash operation is then performed on the initial session key to obtain the corresponding target session key.

[0025] The first byte is extracted from the target session key according to the first preset extraction condition and used as the first encryption key, and the second byte is extracted from the target session key according to the second preset extraction condition and used as the first verification key.

[0026] Optionally, before encrypting the target UDP packet using the first encryption key to obtain the target ciphertext, the method further includes:

[0027] The traffic characteristics corresponding to the UDP traffic are determined, and the traffic characteristics are analyzed based on a preset machine learning model to obtain the corresponding analysis results;

[0028] Based on the analysis results, the target operating mode of the SM4 algorithm is determined so that, under the target operating mode of the SM4 algorithm, the target UDP data packet is encrypted using the first encryption key to obtain the target ciphertext, and the target verification value corresponding to the target ciphertext is generated using the first verification key.

[0029] Secondly, this application provides a UDP traffic encryption / decryption method based on GoProxy, applied to a server, including:

[0030] Receive session information sent by the client proxy; the session information is generated by the client proxy when it determines that the session state between the client and the server is a new session based on the target UDP data packet, and the target UDP data packet is a data packet obtained by the client proxy through GoProxy intercepting the client's local UDP traffic;

[0031] Based on the session information, a second verification value corresponding to the server is generated and sent to the client. The client receives a first verification value corresponding to the client generated by the client based on the session information, so that the client and the server can perform consistency verification on the first verification value and the second verification value respectively.

[0032] After the consistency check passes, a second encryption key and a second verification key are generated, and the encrypted data packet sent by the client is received. The encrypted data packet is a data packet generated by the client based on the target ciphertext and the target verification value. The target ciphertext is the ciphertext obtained by the client encrypting the target UDP data packet using the first encryption key generated by the client after the consistency check passes. The target verification value is the verification value corresponding to the target ciphertext generated by the client using the first verification key generated by the client after the consistency check passes.

[0033] The target verification value in the encrypted data packet is verified based on the second verification key, and after the verification is passed, the target ciphertext in the encrypted data packet is decrypted based on the second encryption key to obtain the target UDP data packet.

[0034] Thirdly, this application provides a UDP traffic encryption / decryption device based on GoProxy, applied to a client, including:

[0035] The UDP packet interception module is used to intercept target UDP packets in the client's local UDP traffic through GoProxy using the client proxy. If the session state between the client and the server is determined to be a new session based on the target UDP packets, session information is generated and sent to the server.

[0036] A consistency verification module is used to generate a first verification value corresponding to the client based on the session information, send the first verification value to the server, and receive a second verification value corresponding to the server generated by the server based on the session information, so that the client and the server can perform consistency verification on the first verification value and the second verification value respectively.

[0037] The key generation module is used to generate a first encryption key and a first verification key after the consistency check passes, and to encrypt the target UDP data packet with the first encryption key to obtain the target ciphertext, and to generate the target verification value corresponding to the target ciphertext with the first verification key.

[0038] An encrypted data packet sending module is used to send an encrypted data packet generated based on the target ciphertext and the target checksum to the server, so that the server can verify the target checksum in the encrypted data packet based on the second verification key generated by the server after the consistency verification is passed, and after the verification is passed, decrypt the target ciphertext in the encrypted data packet based on the second encryption key generated by the server after the consistency verification is passed, to obtain the target UDP data packet.

[0039] Fourthly, this application provides an electronic device, comprising:

[0040] Memory, used to store computer programs;

[0041] A processor is used to execute the computer program to implement the aforementioned UDP traffic encryption and decryption method based on GoProxy.

[0042] Fifthly, this application provides a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned UDP traffic encryption and decryption method based on GoProxy.

[0043] In this application, the client first uses a client proxy to intercept target UDP packets in the client's local UDP traffic via GoProxy. If the client determines that the session state between the client and the server is a new session based on the target UDP packets, session information is generated and sent to the server. Then, a first checksum corresponding to the client is generated based on the session information and sent to the server. The client receives a second checksum corresponding to the server generated by the server based on the session information, so that the client and the server can perform consistency checks on the first checksum and the second checksum respectively. Subsequently, after the consistency check passes, a first encryption key and a first verification key are generated. The first encryption key is used to encrypt the target UDP packets to obtain target ciphertext, and the first verification key is used to generate a target checksum corresponding to the target ciphertext. Finally, an encrypted data packet generated based on the target ciphertext and the target checksum is sent to the server, so that the server can verify the target checksum in the encrypted data packet based on the second verification key generated by the server after the consistency check passes. After the verification passes, the server decrypts the target ciphertext in the encrypted data packet based on the second encryption key generated by the server after the consistency check passes, obtaining the target UDP packets. As can be seen from the above, this application first uses a client proxy to allow GoProxy to intercept local target UDP packets. If a new session is determined between the client and the server, session information is generated and sent to the server. Next, a first checksum is generated and sent to the server, while simultaneously receiving a second checksum generated by the server. Both the client and server perform consistency verification. After successful verification, the client generates a first encryption key and a first verification key. The first encryption key is used to encrypt the target UDP packet to obtain the target ciphertext, and the first verification key is used to generate the corresponding target checksum. Finally, the encrypted packet containing the target ciphertext and the target checksum is sent to the server, enabling the server to complete verification and decryption using its own generated second verification key and second encryption key, thus restoring the target UDP packet. In this way, this application achieves secure encrypted transmission of UDP data in a new session without modifying the application layer code, and ensures data consistency and legitimacy through a verification mechanism, ensuring that both communicating parties can complete data interaction securely and accurately. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0045] Figure 1 This is a schematic diagram of the system framework applicable to the UDP traffic encryption and decryption scheme based on GoProxy disclosed in this application;

[0046] Figure 2 A flowchart of a UDP traffic encryption / decryption method based on GoProxy is provided for this application;

[0047] Figure 3 A schematic diagram illustrating the specific working mode selection of the SM4 algorithm provided in this application;

[0048] Figure 4 This application provides a flowchart of a specific UDP traffic encryption / decryption method based on GoProxy;

[0049] Figure 5 A schematic diagram of a UDP traffic encryption / decryption device based on GoProxy is provided for this application;

[0050] Figure 6 A schematic diagram of a UDP traffic encryption / decryption device based on GoProxy is provided for this application;

[0051] Figure 7 This application provides a structural diagram of an electronic device. Detailed Implementation

[0052] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0053] In the field of network security and data transmission, the UDP protocol, due to its connectionless nature, cannot reuse the TLS / SSL encryption system of the TCP protocol, leading to risks of eavesdropping, tampering, and identity impersonation. Existing Chinese national cryptographic algorithms SM2 / SM3 / SM4 face bottlenecks in UDP adaptation: SM2 key exchange relies on bidirectional interaction, which is difficult to match the "connectionless + unreliable" characteristics of UDP; SM4 encryption mode requires a fixed block size, conflicting with UDP's variable packet length, and lacks a national cryptographic verification scheme for UDP 5-tuples. Meanwhile, existing proxy-based UDP encryption schemes have the following problems: general proxy frameworks, such as Squid and Nginx, do not integrate national cryptographic algorithms, resulting in performance losses exceeding 30% after secondary development; dedicated encryption proxies, such as Shadowsocks UDP mode, use the non-national cryptographic algorithm AES, failing to meet compliance requirements and lacking a dynamic key update mechanism. Therefore, this application provides a UDP traffic encryption and decryption scheme based on GoProxy, which can achieve compliant UDP traffic encryption while ensuring operational performance.

[0054] It should be noted that the system framework used in the UDP traffic encryption and decryption scheme based on GoProxy in this embodiment can be found in [link to relevant documentation]. Figure 1 As shown, this can specifically include a client and a server. After the client's request module initiates a request, the session management module queries or creates a session and synchronizes it through the session table synchronization interface. The client's encryption engine module calls an algorithm through the encryption interface to encrypt the data, which is then transmitted to the server via the data sending module. The server's data receiving module obtains the encrypted data, which is then decrypted by the decryption engine module based on the encryption interface. The data is then verified by the session table verification module. Upon successful verification, the server response module processes the data and returns the result. Throughout the entire process, the session table synchronization interface ensures consistency of session information between the two parties, realizing a complete process of encrypted request transmission, decryption verification, and response.

[0055] See Figure 2 As shown, this embodiment of the invention discloses a UDP traffic encryption and decryption method based on GoProxy, applied to a client, and may include:

[0056] Step S11: Use the client proxy to intercept the target UDP data packet in the client's local UDP traffic through GoProxy. If the session state between the client and the server is determined to be a new session based on the target UDP data packet, then generate session information and send the session information to the server.

[0057] In this embodiment, the client proxy first intercepts target UDP packets in the client's local UDP traffic using GoProxy. Then, it determines whether the session state between the client and server corresponding to the target UDP packet is a new session. The specific process includes: first, the client proxy uses GoProxy's hook function to intercept target UDP packets in the client's local UDP traffic and extracts the corresponding five-tuple information. The five-tuple information includes the source IP address, source port, destination IP address, destination port, and transport layer protocol. Then, based on the five-tuple information, the client proxy queries the session table to determine whether the session state between the client and server is a new session. Specifically, the client proxy can use GoProxy's hook function to intercept target UDP packets between the client's local application layer and network layer and extract the corresponding five-tuple information. Afterward, the client proxy can query the session table, using the source IP address, source port, destination IP address, and destination port from the five-tuple information to determine if there is a record of session information between the client and server in the session table. If not, the session state between the client and server is determined to be a new session. It should be noted that the session table can use a hash table with a timeout mechanism to store session information, such as keys, encryption modes, and sequence numbers of each end.

[0058] It should be noted that if it is determined that the session state between the client and the server corresponding to the target UDP packet is a new session, session information can be generated and sent to the server to inform the server that the session state between the current client and the server is a new session, thereby initiating the key negotiation process between the client and the server.

[0059] Step S12: Generate a first verification value corresponding to the client based on the session information, and send the first verification value to the server. Receive a second verification value corresponding to the server generated by the server based on the session information, so that the client and the server can perform consistency verification on the first verification value and the second verification value respectively.

[0060] In this embodiment, the client and server initiate a key negotiation process, denoted as client A and server B. First, both parties generate temporary key pairs. The specific process may include: first, the client and server determine the target SM2 elliptic curve parameters; then, they determine the client's first identity identifier and the server's second identity identifier, so that the server can generate its second temporary private key using a first preset random number generator, and generate its second temporary public key based on the target SM2 elliptic curve parameters and the second temporary private key, as well as generate a hash value for the server's second identity identifier based on the SM3 algorithm, the second identity identifier, and the target SM2 elliptic curve parameters; subsequently, the client's first temporary private key is generated using the second preset random number generator, and a first temporary public key is generated based on the target SM2 elliptic curve parameters and the first temporary private key; finally, a hash value for the client's first identity identifier is generated based on the SM3 algorithm, the first identity identifier, and the target SM2 elliptic curve parameters.

[0061] Specifically, the communicating parties share the target SM2 elliptic curve parameters, including the recommended prime field, base point G, and order n. Then, they share publicly disclosed long-term identity identifiers: the client's first identity identifier ID_A and the server's second identity identifier ID_B. Next, the client uses a second preset random number generator to generate a random number as the first temporary private key sk_A, and through elliptic curve multiplication, generates a first temporary public key pk_A based on the target SM2 elliptic curve parameters and the first temporary private key, i.e., pk_A = sk_A × G. Simultaneously, the client uses the SM3 algorithm, the first identity identifier, and the target SM2 elliptic curve parameters to generate a hash value Z_A for the first identity identifier, i.e., Z_A = SM3(ID_A || SM2 elliptic curve parameters || G). Correspondingly, the server uses the first preset random number generator to generate a random number as the second temporary private key sk_B, and through elliptic curve multiplication, generates a second temporary public key pk_B based on the target SM2 elliptic curve parameters and the second temporary private key, i.e., pk_B = sk_B × G. At the same time, the server uses the SM3 algorithm, the second identity identifier, and the target SM2 elliptic curve parameters to generate the second identity identifier hash value Z_B, that is, Z_B=SM3(ID_B||SM2 elliptic curve parameters||G).

[0062] It should be noted that after generating the temporary key pair, both communicating parties generate check values ​​and perform consistency verification. The specific process may include: First, generating a first data packet based on the first temporary public key and the hash value of the first identity identifier, and sending the first data packet to the server. The server then determines the first secret point based on the ECDH algorithm, the second temporary private key, and the first temporary public key in the first data packet, extracts the coordinates of the first secret point, and generates a second check value corresponding to the server based on the SM3 algorithm, the coordinates of the first secret point, the hash value of the second identity identifier, and the hash value of the first identity identifier in the first data packet. Next, receiving the second data packet sent by the server, and determining the second secret point based on the ECDH algorithm, the first temporary private key, and the second temporary public key in the second data packet; the second data packet is a data packet generated by the server based on the second temporary public key and the hash value of the second identity identifier. Finally, extracting the coordinates of the second secret point, and generating a first check value corresponding to the client based on the SM3 algorithm, the coordinates of the second secret point, the hash value of the first identity identifier, and the hash value of the second identity identifier in the second data packet.

[0063] Specifically, the client generates a first data packet [pk_A, Z_A] based on the first temporary public key and the hash value of the first identity identifier, and sends it to the server. Simultaneously, the server generates a second data packet [pk_B, Z_B] based on the second temporary public key and the hash value of the second identity identifier, and sends it to the client. After receiving the second data packet from the server, the client determines the second secret point P2 based on the ECDH algorithm, the first temporary private key sk_A, and the second temporary public key pk_B in the second data packet, i.e., P2 = sk_A × pk_B = sk_A × sk_B × G. Then, the client extracts the coordinates of the second secret point P2, x_P2 and y_P2, and generates a first verification value hash_A based on the SM3 algorithm, the coordinates of the second secret point, the hash value of the first identity identifier, and the hash value of the second identity identifier in the second data packet. That is, x_P2||y_P2||Z_A||Z_B are used as input for SM3 hashing to obtain the first verification value hash_A. Accordingly, the server determines the first secret point P1 based on the ECDH algorithm, the second temporary private key sk_B, and the first temporary public key pk_A in the first data packet, i.e., P1 = sk_B × pk_A = sk_B × sk_A × G. Then, the server extracts the coordinates of the first secret point P1, x_P1 and y_P1, and generates a second verification value hash_B based on the SM3 algorithm, the coordinates of the first secret point, the hash value of the second identity identifier, and the hash value of the first identity identifier in the first data packet. That is, x_P1||y_P1||Z_A||Z_B are used as input for SM3 hashing to obtain the second verification value hash_B.

[0064] In this embodiment, after the client calculates the first verification value hash_A and the server calculates the second verification value hash_B, the two communicating parties exchange their respective verification values ​​so that they can perform consistency verification separately.

[0065] Step S13: After the consistency check passes, generate a first encryption key and a first verification key, encrypt the target UDP data packet with the first encryption key to obtain the target ciphertext, and generate the target verification value corresponding to the target ciphertext with the first verification key.

[0066] It is understandable that, given P1 = sk_B × pk_A = sk_B × sk_A × G and P2 = sk_A × pk_B = sk_A × sk_B × G, the first secret point P1 and the second secret point P2 are the same. Therefore, the coordinates x_P1 and y_P1 of the first secret point P1 are the same as the coordinates x_P2 and y_P2 of the second secret point P2. Consequently, the first checksum hash_A determined based on x_P2||y_P2||Z_A||Z_B should also be the same as the second checksum hash_B determined based on x_P1||y_P1||Z_A||Z_B. Consistency checks can verify whether the information has been tampered with and verify the validity of the secret points; if they are inconsistent, key negotiation is terminated.

[0067] In this embodiment, after both communicating parties verify that the first verification value hash_A and the second verification value hash_B are consistent, they can further generate an encryption key and a verification key. The specific process for the client to generate the first encryption key and the first verification key can include: firstly, generating an initial session key based on the SM3 algorithm, a key derivation function, the coordinates of the second secret point, and a target random number; then performing an iterative hash operation on the initial session key to obtain the corresponding target session key; subsequently, extracting the first byte from the target session key as the first encryption key according to a first preset extraction condition, and extracting the second byte from the target session key as the first verification key according to a second preset extraction condition. Specifically, the client uses the SM3 algorithm and KDF (Key Derivation Function) to concatenate the coordinates x_P2 and y_P2 of the second secret point with the target random number to obtain the initial session key. It should be noted that when generating the initial session key, the coordinates x_P2 and y_P2 of the second secret point can also be concatenated with the session identifier. After obtaining the initial session key, an iterative hash operation can be performed on the initial session key to obtain the target session key. In one specific implementation, the initial session key can be iterated and hashed 1024 times to obtain the target session key. Then, bytes 1-16 of the target session key can be extracted as the first encryption key K1, and bytes 17-32 as the first verification key M1. Correspondingly, the server also uses the same steps to generate the second encryption key K2 and the second verification key M2, and stores the generated keys in the server's local session table. Since the coordinates of the first secret point and the second secret point are the same, and the key generation steps are the same, the first encryption key K1 is the same as the second encryption key K2, and the first verification key M1 is the same as the second verification key M2. Finally, both communicating parties delete the first temporary private key, the second temporary private key, and the secret point.

[0068] It should be noted that before encrypting the target UDP data packet, the client needs to determine the operating mode of the SM4 algorithm. The specific process may include: first, determining the traffic characteristics corresponding to the UDP traffic, and analyzing the traffic characteristics based on a preset machine learning model to obtain the corresponding analysis results; then, determining the target operating mode of the SM4 algorithm based on the analysis results, so that under the target operating mode of the SM4 algorithm, the target UDP data packet is encrypted using the first encryption key to obtain the target ciphertext, and the target check value corresponding to the target ciphertext is generated using the first check key. Specifically, the preset machine learning model, such as a random forest, can obtain the corresponding analysis results by analyzing the average length, interval time, and jitter coefficient of the UDP traffic. In one specific implementation, when the average length of the UDP traffic is <1024 bytes and the interval time is <50ms, the CTR mode (Counter Mode) can be selected as the target operating mode of the SM4 algorithm. In another specific implementation, see... Figure 3 As shown, the processing requirements for UDP traffic can be analyzed: For high real-time requirements, ECB (Electronic Codebook Mode) can be selected; for short data processing, CBC (Cipher Block Chaining Mode) can be selected; for parallel processing, CTR mode can be selected; for preventing data pattern leakage, OFB (Output Feedback Mode) can be selected; and for message authentication, CFB (Cipher Feedback Mode) can be selected. In the third specific implementation, if the UDP traffic is game traffic, CTR mode can be selected; if the UDP traffic is industrial data, GCM (Galois / Counter Mode) can be selected.

[0069] In this way, the client can encrypt the target UDP packet and generate a checksum under the defined target operating mode of the SM4 algorithm. Specifically, the client can use the first encryption key K1 to encrypt the target UDP packet to obtain the target ciphertext and append a 16-byte IV (Initialization Vector). Then, the client uses the first verification key M1 to generate the corresponding target checksum based on the five-tuple information of the target UDP packet, the sequence number of the target UDP packet, and the target ciphertext.

[0070] Step S14: Send the encrypted data packet generated based on the target ciphertext and the target check value to the server, so that the server can verify the target check value in the encrypted data packet based on the second verification key generated by the server after the consistency verification is passed, and after the verification is passed, decrypt the target ciphertext in the encrypted data packet based on the second encryption key generated by the server after the consistency verification is passed to obtain the target UDP data packet.

[0071] In this embodiment, the client concatenates the target ciphertext and the target checksum to obtain an encrypted data packet. The target checksum, as a 32-byte checksum field at the end of the data packet, is used as the header. Furthermore, a key negotiation identifier can be embedded in the header of the encrypted data packet. This allows the server to determine if the encrypted data packet needs decryption after the client sends it to the server, by checking the header. Specifically, since the first encryption key K1 is the same as the second encryption key K2, and the first checksum M1 is the same as the second checksum M2, the server can query the second encryption key K2 and the second checksum M2 from its local session table. The server then uses the second checksum M2 to verify the target checksum in the encrypted data packet. If the verification passes, it indicates that the ciphertext has not been tampered with. The server can then use the second encryption key K2 to decrypt the target ciphertext in the encrypted data packet to obtain the target UDP data packet. If the verification fails, the encrypted data packet is discarded and logged.

[0072] It should be noted that the client and server can maintain the session lifecycle through a session timeout mechanism and a key rolling policy. Specifically, when the session data transmission volume reaches 1GB or the lifespan reaches 30 minutes, a new key negotiation process can be triggered. The time between the new and old keys taking effect can be set to 10 seconds to avoid data loss. In addition, if the session between the client and server is idle for more than 10 minutes, the encryption key and verification key will be automatically destroyed.

[0073] In addition, the client and server also include an exception handling module, which can handle exceptions such as key negotiation failure and consistency verification failure, and supports session reconstruction and alarm output.

[0074] As can be seen from the above, in this embodiment, the client first uses a client proxy to intercept the target UDP data packet in the client's local UDP traffic through GoProxy. If the client determines that the session state between the client and the server is a new session based on the target UDP data packet, session information is generated and sent to the server. Then, a first verification value corresponding to the client is generated based on the session information and sent to the server. The client receives a second verification value corresponding to the server generated by the server based on the session information, so that the client and the server can perform consistency verification on the first verification value and the second verification value respectively. Subsequently, after the consistency verification is passed, a first encryption key and a first verification key are generated, and the target UDP data packet is encrypted using the first encryption key to obtain the target ciphertext. The target verification value corresponding to the target ciphertext is generated using the first verification key. Finally, the encrypted data packet generated based on the target ciphertext and the target verification value is sent to the server, so that the server can verify the target verification value in the encrypted data packet based on the second verification key generated by the server after the consistency verification is passed. After the verification is passed, the target ciphertext in the encrypted data packet is decrypted based on the second encryption key generated by the server after the consistency verification is passed, to obtain the target UDP data packet. As shown above, in this embodiment, the client proxy first provides GoProxy with the means to intercept the target UDP data packets locally. If it is determined that a new session exists between the client and the server, session information is generated and sent to the server. Next, a first checksum is generated and sent to the server, while simultaneously receiving a second checksum generated by the server. The client and server perform a consistency check. After successful verification, the client generates a first encryption key and a first verification key. The first encryption key is used to encrypt the target UDP data packet to obtain the target ciphertext, and the first verification key is used to generate the corresponding target checksum. Finally, the encrypted data packet containing the target ciphertext and the target checksum is sent to the server, allowing the server to complete the verification and decryption using its own generated second verification key and second encryption key, thus restoring the target UDP data packet. In this way, this embodiment achieves secure encrypted transmission of UDP data in a new session without modifying the application layer code, and ensures data consistency and legitimacy through a verification mechanism, ensuring that both communicating parties can complete data interaction securely and accurately.

[0075] See Figure 4 As shown in the figure, this embodiment of the invention further discloses a UDP traffic encryption and decryption method based on GoProxy, applied to a server, which may include:

[0076] Step S21: Receive session information sent by the client proxy; the session information is generated by the client proxy when it determines that the session state between the client and the server is a new session based on the target UDP data packet, and the target UDP data packet is a data packet obtained by the client proxy through GoProxy intercepting the client's local UDP traffic.

[0077] Step S22: Generate a second verification value corresponding to the server based on the session information, and send the second verification value to the client. Receive the first verification value corresponding to the client generated by the client based on the session information, so that the client and the server can perform consistency verification on the first verification value and the second verification value respectively.

[0078] Step S23: After the consistency check passes, generate a second encryption key and a second verification key, and receive the encrypted data packet sent by the client; the encrypted data packet is a data packet generated by the client based on the target ciphertext and the target verification value, the target ciphertext is the ciphertext obtained by the client encrypting the target UDP data packet using the first encryption key generated by the client after the consistency check passes, and the target verification value is the verification value corresponding to the target ciphertext generated by the client using the first verification key generated by the client after the consistency check passes.

[0079] Step S24: Verify the target verification value in the encrypted data packet based on the second verification key, and after the verification is successful, decrypt the target ciphertext in the encrypted data packet based on the second encryption key to obtain the target UDP data packet.

[0080] For more detailed processing procedures of steps S21 to S24, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0081] As can be seen from the above, in this embodiment, the server generates a second verification value based on the received session information and sends it to the client, while simultaneously receiving the first verification value generated by the client. Both parties perform a consistency check to ensure the reliability of the communication. After the consistency check passes, the server generates a second encryption key and a second verification key, and simultaneously receives an encrypted data packet composed of the target ciphertext obtained by the client encrypting the target UDP data packet using the first encryption key and the target verification value generated using the first verification key. The server then uses the second verification key to verify the target verification value in the encrypted data packet. After the verification passes, the server uses the second encryption key to decrypt the target ciphertext, finally obtaining the original target UDP data packet. In this way, this embodiment can effectively ensure the security and reliability of UDP data transmission between the client and the server, prevent data from being tampered with or stolen during transmission, and ensure the integrity and confidentiality of the communication.

[0082] Accordingly, see Figure 5 As shown in the illustration, this application also provides a UDP traffic encryption / decryption device based on GoProxy, applied to a client, which may include:

[0083] The UDP packet interception module 11 is used to intercept target UDP packets in the client's local UDP traffic through GoProxy using the client proxy. If the session state between the client and the server is determined to be a new session based on the target UDP packets, session information is generated and the session information is sent to the server.

[0084] The consistency verification module 12 is used to generate a first verification value corresponding to the client based on the session information, send the first verification value to the server, and receive a second verification value corresponding to the server generated by the server based on the session information, so that the client and the server can perform consistency verification on the first verification value and the second verification value respectively.

[0085] The key generation module 13 is used to generate a first encryption key and a first verification key after the consistency check passes, and to encrypt the target UDP data packet with the first encryption key to obtain the target ciphertext, and to generate the target verification value corresponding to the target ciphertext with the first verification key.

[0086] The encrypted data packet sending module 14 is used to send an encrypted data packet generated based on the target ciphertext and the target check value to the server, so that the server can verify the target check value in the encrypted data packet based on the second verification key generated by the server after the consistency verification is passed, and after the verification is passed, decrypt the target ciphertext in the encrypted data packet based on the second encryption key generated by the server after the consistency verification is passed to obtain the target UDP data packet.

[0087] In some specific embodiments, the UDP packet interception module 11 may include:

[0088] The five-tuple information extraction unit is used to intercept the target UDP data packet in the client's local UDP traffic using the client proxy through the hook function of GoProxy, and extract the five-tuple information corresponding to the target UDP data packet; the five-tuple information includes source IP address, source port, destination IP address, destination port and transport layer protocol;

[0089] The session state determination unit is used to query the session table based on the five-tuple information to determine whether the session state between the client and the server is a new session.

[0090] In some specific embodiments, the GoProxy-based UDP traffic encryption / decryption device may further include:

[0091] A parameter determination unit is used to determine the target SM2 elliptic curve parameters with the server.

[0092] An identity identification unit is used to determine a first identity identifier corresponding to the client and a second identity identifier corresponding to the server, so that the server generates a second temporary private key corresponding to the server using a first preset random number generator, generates a second temporary public key corresponding to the server based on the target SM2 elliptic curve parameters and the second temporary private key, and generates a hash value of the second identity identifier corresponding to the server based on the SM3 algorithm, the second identity identifier and the target SM2 elliptic curve parameters.

[0093] The first temporary private key generation unit is used to generate a first temporary private key corresponding to the client using a second preset random number generator, and to generate a first temporary public key corresponding to the client based on the target SM2 elliptic curve parameters and the first temporary private key.

[0094] The first identity hash value generation unit is used to generate the first identity hash value corresponding to the client based on the SM3 algorithm, the first identity, and the target SM2 elliptic curve parameters.

[0095] In some specific embodiments, the consistency verification module 12 may include:

[0096] The first data packet generation unit is configured to generate a first data packet based on the first temporary public key and the first identity hash value, and send the first data packet to the server, so that the server determines the first secret point based on the ECDH algorithm, the second temporary private key and the first temporary public key in the first data packet, extracts the coordinates of the first secret point, and generates the second verification value corresponding to the server based on the SM3 algorithm, the coordinates of the first secret point, the second identity hash value and the first identity hash value in the first data packet;

[0097] The second secret point determination unit is used to receive the second data packet sent by the server and determine the second secret point based on the ECDH algorithm, the first temporary private key, and the second temporary public key in the second data packet; the second data packet is a data packet generated by the server based on the second temporary public key and the hash value of the second identity identifier;

[0098] The first verification value generation unit is used to extract the coordinates of the second secret point and generate the first verification value corresponding to the client based on the SM3 algorithm, the coordinates of the second secret point, the hash value of the first identity identifier, and the hash value of the second identity identifier in the second data packet.

[0099] In some specific embodiments, the key generation module 13 may include:

[0100] The session key generation unit is used to generate an initial session key based on the SM3 algorithm, the key derivation function, the coordinates of the second secret point and the target random number, and to perform an iterative hash operation on the initial session key to obtain the corresponding target session key;

[0101] The first verification key generation unit is used to extract a first byte from the target session key as the first encryption key according to a first preset extraction condition, and to extract a second byte from the target session key as the first verification key according to a second preset extraction condition.

[0102] In some specific embodiments, the GoProxy-based UDP traffic encryption / decryption device may further include:

[0103] The traffic feature analysis unit is used to determine the traffic features corresponding to the UDP traffic, and analyze the traffic features based on a preset machine learning model to obtain the corresponding analysis results;

[0104] The working mode determination unit is used to determine the target working mode of the SM4 algorithm based on the analysis results, so that in the target working mode of the SM4 algorithm, the target UDP data packet is encrypted with the first encryption key to obtain the target ciphertext, and the target verification value corresponding to the target ciphertext is generated with the first verification key.

[0105] Accordingly, see Figure 6 As shown in the illustration, this application also provides a UDP traffic encryption / decryption device based on GoProxy, applied to a server, which may include:

[0106] The information receiving module is used to receive session information sent by the client proxy; the session information is generated by the client proxy when it determines that the session state between the client and the server is a new session based on the target UDP data packet; the target UDP data packet is a data packet obtained by the client proxy through GoProxy intercepting the client's local UDP traffic.

[0107] The second verification value generation module is used to generate a second verification value corresponding to the server based on the session information, and send the second verification value to the client, and receive a first verification value corresponding to the client generated by the client based on the session information, so that the client and the server respectively perform consistency verification on the first verification value and the second verification value;

[0108] An encrypted data packet receiving module is used to generate a second encryption key and a second verification key after the consistency check passes, and to receive the encrypted data packet sent by the client; the encrypted data packet is a data packet generated by the client based on the target ciphertext and the target verification value, wherein the target ciphertext is the ciphertext obtained by the client encrypting the target UDP data packet using the first encryption key generated by the client after the consistency check passes, and the target verification value is the verification value corresponding to the target ciphertext generated by the client using the first verification key generated by the client after the consistency check passes;

[0109] The encrypted data packet decryption module is used to verify the target verification value in the encrypted data packet based on the second verification key, and after the verification is successful, to decrypt the target ciphertext in the encrypted data packet based on the second encryption key to obtain the target UDP data packet.

[0110] Furthermore, embodiments of this application also disclose an electronic device, Figure 7 This is a structural diagram of an electronic device 30 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application. Specifically, the electronic device 30 may include: at least one processor 31, at least one memory 32, a power supply 33, a communication interface 34, an input / output interface 35, and a communication bus 36. The memory 32 stores a computer program, which is loaded and executed by the processor 31 to implement the relevant steps in the GoProxy-based UDP traffic encryption / decryption method disclosed in any of the foregoing embodiments. Furthermore, the electronic device 30 in this embodiment may specifically be a computer.

[0111] In this embodiment, the power supply 33 is used to provide operating voltage for each hardware device on the electronic device 30; the communication interface 34 can create a data transmission channel between the electronic device 30 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 35 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0112] In addition, the memory 32, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 321, computer program 322, etc., and the storage method can be temporary storage or permanent storage.

[0113] The operating system 321 is used to manage and control the various hardware devices on the electronic device 30 and the computer program 322, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the GoProxy-based UDP traffic encryption / decryption method executed by the electronic device 30 as disclosed in any of the foregoing embodiments, the computer program 322 may further include computer programs capable of performing other specific tasks.

[0114] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned GoProxy-based UDP traffic encryption and decryption method. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0115] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0116] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0117] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0118] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0119] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A UDP traffic encryption / decryption method based on GoProxy, characterized in that, Applied to the client side, including: The client proxy intercepts target UDP packets in the client's local UDP traffic using GoProxy. If the session state between the client and the server is determined to be a new session based on the target UDP packets, session information is generated and sent to the server. Based on the session information, a first verification value corresponding to the client is generated and sent to the server. The client receives a second verification value corresponding to the server generated by the server based on the session information, so that the client and the server can perform consistency verification on the first verification value and the second verification value respectively. After the consistency check passes, a first encryption key and a first verification key are generated. The first encryption key is used to encrypt the target UDP data packet to obtain the target ciphertext. The first verification key is used to generate the target verification value corresponding to the target ciphertext. An encrypted data packet generated based on the target ciphertext and the target checksum is sent to the server, so that the server can verify the target checksum in the encrypted data packet based on the second verification key generated by the server after the consistency verification is passed, and after the verification is passed, decrypt the target ciphertext in the encrypted data packet based on the second encryption key generated by the server after the consistency verification is passed, to obtain the target UDP data packet; The generation of the first verification value corresponding to the client includes: A first data packet is generated based on the first temporary public key and the hash value of the first identity identifier corresponding to the client, and the first data packet is sent to the server. The server determines the first secret point based on the ECDH algorithm, the second temporary private key corresponding to the server and the first temporary public key in the first data packet, and extracts the coordinates of the first secret point. The server also generates the second verification value corresponding to the server based on the SM3 algorithm, the coordinates of the first secret point, the hash value of the second identity identifier corresponding to the server and the hash value of the first identity identifier in the first data packet. The server receives a second data packet and determines a second secret point based on the ECDH algorithm, the first temporary private key corresponding to the client, and the second temporary public key corresponding to the server in the second data packet; the second data packet is a data packet generated by the server based on the second temporary public key and the hash value of the second identity identifier. Extract the coordinates of the second secret point, and generate the first verification value corresponding to the client based on the SM3 algorithm, the coordinates of the second secret point, the hash value of the first identity identifier, and the hash value of the second identity identifier in the second data packet.

2. The UDP traffic encryption / decryption method based on GoProxy according to claim 1, characterized in that, The method of using a client proxy to intercept target UDP packets in the client's local UDP traffic via GoProxy includes: The client proxy uses the hook function of GoProxy to intercept the target UDP packet in the client's local UDP traffic and extracts the five-tuple information corresponding to the target UDP packet; the five-tuple information includes source IP address, source port, destination IP address, destination port and transport layer protocol; The session table is queried based on the quintuple information to determine whether the session state between the client and the server is a new session.

3. The UDP traffic encryption / decryption method based on GoProxy according to claim 1, characterized in that, Also includes: The target SM2 elliptic curve parameters are determined with the server; The first identity identifier corresponding to the client and the second identity identifier corresponding to the server are determined so that the server can generate the second temporary private key corresponding to the server using the first preset random number generator, and generate the second temporary public key corresponding to the server based on the target SM2 elliptic curve parameters and the second temporary private key, and generate the hash value of the second identity identifier corresponding to the server based on the SM3 algorithm, the second identity identifier and the target SM2 elliptic curve parameters. A first temporary private key corresponding to the client is generated using a second preset random number generator, and a first temporary public key corresponding to the client is generated based on the target SM2 elliptic curve parameters and the first temporary private key. The hash value of the first identity identifier corresponding to the client is generated based on the SM3 algorithm, the first identity identifier, and the target SM2 elliptic curve parameters.

4. The UDP traffic encryption / decryption method based on GoProxy according to claim 1, characterized in that, The generation of the first encryption key and the first verification key includes: An initial session key is generated based on the SM3 algorithm, the key derivation function, the coordinates of the second secret point, and the target random number. An iterative hash operation is then performed on the initial session key to obtain the corresponding target session key. The first byte is extracted from the target session key according to the first preset extraction condition and used as the first encryption key, and the second byte is extracted from the target session key according to the second preset extraction condition and used as the first verification key.

5. The UDP traffic encryption / decryption method based on GoProxy according to any one of claims 1 to 4, characterized in that, Before encrypting the target UDP packet using the first encryption key to obtain the target ciphertext, the method further includes: The traffic characteristics corresponding to the UDP traffic are determined, and the traffic characteristics are analyzed based on a preset machine learning model to obtain the corresponding analysis results; Based on the analysis results, the target operating mode of the SM4 algorithm is determined so that, under the target operating mode of the SM4 algorithm, the target UDP data packet is encrypted using the first encryption key to obtain the target ciphertext, and the target verification value corresponding to the target ciphertext is generated using the first verification key.

6. A UDP traffic encryption / decryption method based on GoProxy, characterized in that, Applied to servers, including: Receive session information sent by the client proxy; the session information is generated by the client proxy when it determines that the session state between the client and the server is a new session based on the target UDP data packet, and the target UDP data packet is a data packet obtained by the client proxy through GoProxy intercepting the client's local UDP traffic; Based on the session information, a second verification value corresponding to the server is generated and sent to the client. The client receives a first verification value corresponding to the client generated by the client based on the session information, so that the client and the server can perform consistency verification on the first verification value and the second verification value respectively. After the consistency check passes, a second encryption key and a second verification key are generated, and the encrypted data packet sent by the client is received. The encrypted data packet is a data packet generated by the client based on the target ciphertext and the target verification value. The target ciphertext is the ciphertext obtained by the client encrypting the target UDP data packet using the first encryption key generated by the client after the consistency check passes. The target verification value is the verification value corresponding to the target ciphertext generated by the client using the first verification key generated by the client after the consistency check passes. The target verification value in the encrypted data packet is verified based on the second verification key, and after the verification is passed, the target ciphertext in the encrypted data packet is decrypted based on the second encryption key to obtain the target UDP data packet; The process of generating the first verification value includes: The system receives a first data packet sent by the client, determines a first secret point based on the ECDH algorithm, the second temporary private key corresponding to the server, and the first temporary public key in the first data packet, extracts the coordinates of the first secret point, and generates a second verification value corresponding to the server based on the SM3 algorithm, the coordinates of the first secret point, the second identity hash value corresponding to the server, and the first identity hash value in the first data packet; the first data packet is a data packet generated by the client based on the first temporary public key and the first identity hash value corresponding to the client. A second data packet is generated based on the second temporary public key corresponding to the server and the hash value of the second identity identifier, and the second data packet is sent to the client so that the client can determine the second secret point based on the ECDH algorithm, the first temporary private key corresponding to the client and the second temporary public key in the second data packet, extract the coordinates of the second secret point, and generate the first verification value corresponding to the client based on the SM3 algorithm, the coordinates of the second secret point, the hash value of the first identity identifier and the hash value of the second identity identifier in the second data packet.

7. A UDP traffic encryption / decryption device based on GoProxy, characterized in that, Applied to the client side, including: The UDP packet interception module is used to intercept target UDP packets in the client's local UDP traffic through GoProxy using the client proxy. If the session state between the client and the server is determined to be a new session based on the target UDP packets, session information is generated and sent to the server. A consistency verification module is used to generate a first verification value corresponding to the client based on the session information, send the first verification value to the server, and receive a second verification value corresponding to the server generated by the server based on the session information, so that the client and the server can perform consistency verification on the first verification value and the second verification value respectively. The key generation module is used to generate a first encryption key and a first verification key after the consistency check passes, and to encrypt the target UDP data packet with the first encryption key to obtain the target ciphertext, and to generate the target verification value corresponding to the target ciphertext with the first verification key. An encrypted data packet sending module is used to send an encrypted data packet generated based on the target ciphertext and the target check value to the server, so that the server can verify the target check value in the encrypted data packet based on the second verification key generated by the server after the consistency verification is passed, and after the verification is passed, decrypt the target ciphertext in the encrypted data packet based on the second encryption key generated by the server after the consistency verification is passed to obtain the target UDP data packet; Specifically, the consistency verification module is used to generate a first data packet based on the first temporary public key and the hash value of the first identity identifier corresponding to the client, and send the first data packet to the server, so that the server determines a first secret point based on the ECDH algorithm, the second temporary private key corresponding to the server, and the first temporary public key in the first data packet, and extracts the coordinates of the first secret point, and generates a second verification value corresponding to the server based on the SM3 algorithm, the coordinates of the first secret point, the hash value of the second identity identifier corresponding to the server, and the hash value of the first identity identifier in the first data packet; receives a second data packet sent by the server, and determines a second secret point based on the ECDH algorithm, the first temporary private key corresponding to the client, and the second temporary public key corresponding to the server in the second data packet; the second data packet is a data packet generated by the server based on the second temporary public key and the hash value of the second identity identifier; extracts the coordinates of the second secret point, and generates the first verification value corresponding to the client based on the SM3 algorithm, the coordinates of the second secret point, the hash value of the first identity identifier, and the hash value of the second identity identifier in the second data packet.

8. An electronic device, characterized in that, The electronic device includes a processor and a memory; wherein the memory is used to store a computer program, which is loaded and executed by the processor to implement the UDP traffic encryption and decryption method based on GoProxy as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, Used to store computer programs, which, when executed by a processor, implement the UDP traffic encryption / decryption method based on GoProxy as described in any one of claims 1 to 6.

Images