Hypertext transfer protocol network security access method and device and storage medium
By porting TLS handshake logic to the application layer under the HTTP protocol and adopting a random number-pre-master key mechanism, the security issues of network access under the HTTP protocol are solved, data encryption and integrity protection are achieved in the HTTP environment, and the client's requirement to support both HTTP and HTTPS is met.
Patent Information
- Application Number
- CN202511493726.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-10-20
- Publication Date
- 2026-02-10
AI Technical Summary
Under the HTTP protocol, network access security is difficult to guarantee, especially when the client needs to support both HTTP and HTTPS protocols. Existing technologies cannot effectively solve the problems of man-in-the-middle attacks and data leakage.
By porting the TLS handshake logic to the application layer and adopting a random number-pre-master key mechanism, the client generates and encrypts the first random number, the server decrypts and generates the second random number, and the two parties compare the consistency of the random numbers. If they are consistent, a session key is generated to achieve data encryption and integrity protection.
In an environment that only supports the HTTP protocol, it achieves near-HTTPS anti-eavesdropping, anti-tampering, and anti-spoofing capabilities, meets the client's requirement to be compatible with both HTTP and HTTPS on the same port, and is simple to deploy and compatible with existing resources.
Smart Images
Figure CN121508912A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security access technology, and in particular to a method, apparatus and storage medium for network security access to Hypertext Transfer Protocol (HTTP). Background Technology
[0002] Data security in browser / server (BS) architectures has always been a major concern. Data transmission over the network is vulnerable to cyberattacks and data breaches, therefore, login and authorization are typically required before data transmission. When accessing the network, if the current transmission protocol is HTTP (Hypertext Transfer Protocol Secure) instead of HTTPS, hackers can use man-in-the-middle attacks to obtain the execution logic of the web application and tamper with the returned results. Even if the transmitted executable file is obfuscated, it only delays the cracking process and does not fundamentally solve the problem.
[0003] Clients typically require servers to support both HTTP and HTTPS protocols, and ensuring secure network access under the Hypertext Transfer Protocol is a pressing need. Summary of the Invention
[0004] In view of this, the present invention provides a method, apparatus and storage medium for secure access to Hypertext Transfer Protocol networks.
[0005] Specifically, the present invention is achieved through the following technical solution: According to a first aspect of the present invention, a method for secure access to Hypertext Transfer Protocol networks is provided, the method comprising the steps of: Determine whether the network server has received an encrypted communication connection session request; If so, the network server returns request parsing information; If not, maintain the current state; Determine whether the executable file on the web homepage has passed the verification of the requested parsing information; If so, the web homepage executable file generates and encrypts a first random number to obtain a pre-master key; If not, terminate the process; The network server decrypts the pre-master key and obtains a second random number; Determine whether the first random number and the second random number are the same; If so, the network server and the network homepage executable file establish a network security access session; If not, terminate the process.
[0006] Optionally, determining whether the network server has received an encrypted communication connection session request includes the following steps: Configure the encrypted communication connection session request instruction for the executable file of the web homepage; Configure the network server with an encrypted communication connection session request parsing instruction.
[0007] Optionally, the network server returning request parsing information includes the following steps: Return the network server certificate; Return the public key of the network server; Return the random number generated by the network server; Return the algorithm negotiation suite supported by the network server.
[0008] Optionally, determining whether the web homepage executable file has passed the verification of the request parsing information includes the following steps: Configure the encrypted communication connection session request verification command for the executable file of the web homepage; Obtain the network server certificate from the request parsing information; Obtain the authentication certificate from the network server; The network server certificate is verified using the authentication certificate.
[0009] Optionally, the process of generating and encrypting a first random number and obtaining a pre-master key in the web homepage executable file includes the following steps: Obtain the first random number from the encrypted communication connection session request; Obtain the network server public key from the request parsing information; The first random number is encrypted using the public key of the network server to obtain the pre-master key; The pre-master key is sent to the network server.
[0010] Optionally, the process of the network server decrypting the pre-master key and obtaining the second random number includes the following steps: Configure the network server with an encrypted communication connection session request decryption command; Obtain the private key of the network server; The network server uses its private key to decrypt the pre-master key and obtain the second random number.
[0011] Optionally, the network server and the network homepage executable file establishing a network security access session include the following steps: A session key is generated by negotiating the first random number, the second random number, and the pre-master key. The message data field is decrypted and the return message is encrypted based on the request method name of the network server.
[0012] According to a second aspect of the present invention, a Hypertext Transfer Protocol (HTTP) network security access device is provided, comprising: The first judgment module is used to determine whether the network server has received an encrypted communication connection session request; The first execution module is configured to return request parsing information when the judgment result of the first judgment module is yes; and to maintain the current state when the judgment result of the first judgment module is no. The second judgment module is used to determine whether the executable file of the web homepage has passed the verification of the request parsing information; The second execution module is used to generate and encrypt a first random number and obtain a pre-master key when the judgment result of the second judgment module is yes; and to terminate the process when the judgment result of the second judgment module is no. The decryption module is used by the network server to decrypt the pre-master key and obtain a second random number; The third judgment module is used to determine whether the first random number and the second random number are consistent; The third execution module is used to establish a network security access session between the network server and the network homepage executable file when the judgment result of the third judgment module is yes; and to terminate the process when the judgment result of the third judgment module is no.
[0013] According to a third aspect of the present invention, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of any of the preceding methods.
[0014] According to a fourth aspect of the present invention, a storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the methods described above.
[0015] The technical solution provided by this invention brings at least the following beneficial effects: This application provides a method for secure access to Hypertext Transfer Protocol (HTTP) networks. This method, in a pure HTTP environment, transplants the TLS handshake logic to the application layer through a "random number-pre-master key" mechanism, solving the pain point of "secure access without TLS." ① The client (web homepage executable) first sends an "encrypted communication connection session request" in plaintext. If the server agrees, it sends back a one-time "request parsing information" (including timestamp, session ID, RSA public key, etc.) to achieve intent negotiation. ② The client encrypts a locally generated first random number using its public key to form a "pre-master key" and sends it back. The server decrypts the second random number using its corresponding private key. ③ Both parties compare the two random numbers: if they match, it proves that the public key has not been tampered with and the channel has not been controlled by a man-in-the-middle. A symmetric session key is then derived from this random number, and subsequent HTTP messages are encrypted or MAC-enabled using this key to achieve confidentiality and integrity. If they do not match, the connection is terminated immediately. The entire process requires no certificate chain and does not modify the transport layer, making it plug-and-play even for older devices and intranet scenarios. Random numbers are generated only once, and the private key remains on the server side, ensuring forward security. In the event of a replay attack, timestamps and session IDs can be used to reject older packets. Thus, near-HTTPS-level anti-eavesdropping, anti-tampering, and anti-spoofing capabilities are achieved on HTTP-only networks, meeting the urgent customer need for "simultaneous compatibility with HTTP / HTTPS on the same port, and secure access via HTTP." In other words, it enables secure access to sensitive data under the HTTP protocol, with simple deployment, improved efficiency, compatibility with existing resources, and simultaneous support for both HTTP and HTTPS. Attached Figure Description
[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.
[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, those skilled in the art can obtain other drawings based on these drawings without creative effort.
[0018] Figure 1 A flowchart illustrating a method for secure access to Hypertext Transfer Protocol networks provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of a Hypertext Transfer Protocol network security access device provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention; Figure 4This is a schematic diagram of the structure of a storage medium provided in an embodiment of the present invention. Detailed Implementation
[0019] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0020] Figure 1 The illustration shows a flowchart of a Hypertext Transfer Protocol network security access method applicable to embodiments of the present invention.
[0021] See Figure 1 This invention provides a method for secure access to Hypertext Transfer Protocol networks, the method comprising the following steps: S1: Determine whether the network server has received the encrypted communication connection session request; For example, determining whether the network server has received an encrypted communication connection session request includes the following steps: Configure the encrypted communication connection session request instruction for the executable file of the web homepage; Configure the network server with an encrypted communication connection session request parsing instruction.
[0022] In this embodiment, the SSL / TLS (Encrypted Communication Connection Session) protocol is configured on the web homepage executable file. The SSL / TLS protocol allows the web homepage executable file to issue encrypted communication connection session request instructions. The SSL / TLS protocol is also configured on the web server, allowing the web server to parse the received encrypted communication connection session requests.
[0023] S2: If so, the network server returns the request parsing information; For example, the network server returning request parsing information includes the following steps: Return the network server certificate; Return the public key of the network server; Return the random number generated by the network server; Return the algorithm negotiation suite supported by the network server.
[0024] In this embodiment, when the network server receives an encrypted communication connection session request, it parses the request and returns parsed information according to the SSL / TLS protocol specification. The parsed information includes the network server certificate (containing CA certification authority information), the network server public key, a random number generated by the network server, and the algorithm negotiation suite supported by the network server.
[0025] S3: If not, maintain the current state; In this embodiment of the application, when the network server does not receive an encrypted communication connection session request, it can maintain the status quo.
[0026] S4: Determine whether the request parsing information has been successfully verified by the executable file of the web homepage; For example, determining whether the executable file of the web homepage has passed the verification of the request parsing information includes the following steps: Configure the encrypted communication connection session request verification command for the executable file of the web homepage; Obtain the network server certificate from the request parsing information; Obtain the authentication certificate from the network server; The network server certificate is verified using the authentication certificate.
[0027] In this embodiment, after configuring the SSL / TLS (Encrypted Communication Connection Session) protocol on the web homepage executable, the SSL / TLS protocol also allows the web homepage executable to verify encrypted communication connection session requests. Specifically, when the web homepage executable receives request parsing information returned by the web server, the web homepage executable reads the authentication certificate of the web server and uses the authentication certificate to verify the web server's certificate.
[0028] S5: If so, the web homepage executable file generates and encrypts a first random number and obtains a pre-master key; For example, the process of generating and encrypting a first random number and obtaining a pre-master key in the web homepage executable file includes the following steps: Obtain the first random number from the encrypted communication connection session request; Obtain the network server public key from the request parsing information; The first random number is encrypted using the public key of the network server to obtain the pre-master key; The pre-master key is sent to the network server.
[0029] In this embodiment of the application, if authentication is successful, the web homepage executable file uses the public key of the web server in the parsed information to encrypt the first random number in the encrypted communication connection session request, generates a pre-master key, and sends the pre-master key to the web server.
[0030] S6: If not, terminate the process; In this embodiment of the application, if the certificate verification fails, the subsequent process is terminated.
[0031] S7: The network server decrypts the pre-master key and obtains a second random number; For example, the process by which the network server decrypts the pre-master key and obtains the second random number includes the following steps: Configure the network server with an encrypted communication connection session request decryption command; Obtain the private key of the network server; The network server uses its private key to decrypt the pre-master key and obtain the second random number.
[0032] In this embodiment, after configuring the SSL / TLS (Encrypted Communication Connection Session) protocol on the network server, the SSL / TLS protocol also allows the network server to decrypt the pre-master key generated by the encrypted first random number. Specifically, the network server itself contains a network server private key, which the network server can use to decrypt the pre-master key and obtain the second random number.
[0033] S8: Determine whether the first random number and the second random number are the same; In this embodiment of the application, the first random number and the second random number are compared. If they match, a 200 OK (HTTP status code) is sent to indicate that the request has been successful. If they do not match, the subsequent process is terminated.
[0034] S9: If so, the network server and the network homepage executable file establish a network security access session; For example, the network server and the network homepage executable file establishing a network security access session include the following steps: A session key is generated by negotiating the first random number, the second random number, and the pre-master key. The message data field is decrypted and the return message is encrypted based on the request method name of the network server.
[0035] In this embodiment of the application, when the first random number and the second random number are consistent, the network homepage executable file and the network server program generate a session key based on their respective random numbers and pre-master keys, combined with a negotiation algorithm; then the network server determines whether the message data field needs to be decrypted and whether the returned message needs to be encrypted based on the request method name of the network server.
[0036] S10: If not, terminate the process.
[0037] In this embodiment of the application, if the first random number and the second random number are inconsistent, the subsequent process is terminated.
[0038] like Figure 2 This application provides a Hypertext Transfer Protocol (HTTP) network security access device, comprising: The first judgment module 10 is used to determine whether the network server has received an encrypted communication connection session request; The first execution module 20 is configured to return request parsing information when the judgment result of the first judgment module is yes; and to maintain the current state when the judgment result of the first judgment module is no. The second judgment module 30 is used to determine whether the executable file of the web homepage has passed the verification of the request parsing information; The second execution module 40 is used to generate and encrypt a first random number and obtain a pre-master key when the judgment result of the second judgment module is yes; and to terminate the process when the judgment result of the second judgment module is no. Decryption module 50 is used by the network server to decrypt the pre-master key and obtain a second random number; The third judgment module 60 is used to determine whether the first random number and the second random number are consistent; The third execution module 70 is used to establish a network security access session between the network server and the network homepage executable file when the judgment result of the third judgment module is yes; and to terminate the process when the judgment result of the third judgment module is no.
[0039] The Hypertext Transfer Protocol (HTTP) network security access device provided in this application can perform the Hypertext Transfer Protocol network security access method provided in the above steps.
[0040] It should be understood that the specific embodiments described above are merely illustrative or explanatory of the principles of the invention and do not constitute a limitation thereof. Therefore, any modifications, equivalent substitutions, improvements, etc., made without departing from the spirit and scope of the invention should be included within the protection scope of the invention. Furthermore, the appended claims are intended to cover all variations and modifications falling within the scope and boundaries of the appended claims, or equivalent forms of such scope and boundaries.
[0041] The following is for reference. Figure 3 The diagram illustrates a structural schematic of an electronic device 100 suitable for implementing embodiments of the present disclosure. The electronic devices in the embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 3 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.
[0042] like Figure 3 As shown, the electronic device 100 may include a processing unit (e.g., a central processing unit, a graphics processing unit, etc.) 101, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 102 or a program loaded from a storage device 108 into a random access memory (RAM) 103. The RAM 103 also stores various programs and data required for the operation of the electronic device 100. The processing unit 101, ROM 102, and RAM 103 are interconnected via a bus 104. An input / output (I / O) interface 105 is also connected to the bus 104.
[0043] Typically, the following devices can be connected to I / O interface 105: input devices 106 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 107 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 108 including, for example, magnetic tapes, hard disks, etc.; and communication devices 109. Communication device 109 allows electronic device 100 to communicate wirelessly or wiredly with other devices to exchange data. Although an electronic device 100 with various devices is shown in the figure, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.
[0044] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication device 109, or installed from storage device 108, or installed from ROM 102. When the computer program is executed by processing device 101, it performs the functions defined in the methods of embodiments of this disclosure.
[0045] The following is for reference. Figure 4 It illustrates a schematic diagram of a computer-readable storage medium suitable for implementing embodiments of the present disclosure, the computer-readable storage medium storing a computer program that, when executed by a processor, can implement the Hypertext Transfer Protocol network security access method as described above.
[0046] This application also provides a computer program product. It includes a computer program / computer-executable instructions that, when executed by a processor of an electronic device, implement the steps of the Hypertext Transfer Protocol (HTTP) network security access method described in any of the preceding claims.
[0047] This application provides a method, apparatus, and storage medium for secure access to Hypertext Transfer Protocol (HTTP) data, enabling secure access to sensitive data under the HTTP protocol. It is simple to deploy, efficient, compatible with existing resources, and can support both HTTP and HTTPS simultaneously.
[0048] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0049] The above description is merely a specific embodiment of the present invention, enabling those skilled in the art to understand or implement the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the present invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.
Claims
1. A method for secure access to Hypertext Transfer Protocol networks, characterized in that, The method includes the following steps: Determine whether the network server has received an encrypted communication connection session request; If so, the network server returns request parsing information; If not, maintain the current state; Determine whether the executable file on the web homepage has passed the verification of the requested parsing information; If so, the web homepage executable file generates and encrypts a first random number to obtain a pre-master key; If not, terminate the process; The network server decrypts the pre-master key and obtains a second random number; Determine whether the first random number and the second random number are the same; If so, the network server and the network homepage executable file establish a network security access session; If not, terminate the process.
2. The Hypertext Transfer Protocol network security access method according to claim 1, characterized in that, The step of determining whether the network server has received an encrypted communication connection session request includes the following steps: Configure the encrypted communication connection session request instruction for the executable file of the web homepage; Configure the network server with an encrypted communication connection session request parsing instruction.
3. The Hypertext Transfer Protocol network security access method according to claim 1, characterized in that, The steps involved in returning request parsing information from the network server are as follows: Return the network server certificate; Return the public key of the network server; Return the random number generated by the network server; Return the algorithm negotiation suite supported by the network server.
4. The Hypertext Transfer Protocol network security access method according to claim 1, characterized in that, The step of determining whether the executable file of the web homepage has passed the verification of the request parsing information includes the following steps: Configure the encrypted communication connection session request verification command for the executable file of the web homepage; Obtain the network server certificate from the request parsing information; Obtain the authentication certificate from the network server; The network server certificate is verified using the authentication certificate.
5. The Hypertext Transfer Protocol network security access method according to claim 1, characterized in that, The steps involved in generating and encrypting the first random number and obtaining the pre-master key in the web homepage executable file are as follows: Obtain the first random number from the encrypted communication connection session request; Obtain the network server public key from the request parsing information; The first random number is encrypted using the public key of the network server to obtain the pre-master key; The pre-master key is sent to the network server.
6. The Hypertext Transfer Protocol network security access method according to claim 1, characterized in that, The process of the network server decrypting the pre-master key and obtaining the second random number includes the following steps: Configure the network server with an encrypted communication connection session request decryption command; Obtain the private key of the network server; The network server uses its private key to decrypt the pre-master key and obtain the second random number.
7. The Hypertext Transfer Protocol network security access method according to claim 1, characterized in that, The network server and the network homepage executable file establish a network security access session, which includes the following steps: A session key is generated by negotiating the first random number, the second random number, and the pre-master key; The message data field is decrypted and the return message is encrypted based on the request method name of the network server.
8. A Hypertext Transfer Protocol (HTTP) network security access device, characterized in that, include: The first judgment module is used to determine whether the network server has received an encrypted communication connection session request; The first execution module is configured to return request parsing information when the judgment result of the first judgment module is yes; and to maintain the current state when the judgment result of the first judgment module is no. The second judgment module is used to determine whether the executable file of the web homepage has passed the verification of the request parsing information; The second execution module is used to generate and encrypt a first random number and obtain a pre-master key when the judgment result of the second judgment module is yes; The process terminates when the result of the second judgment module is negative. The decryption module is used by the network server to decrypt the pre-master key and obtain a second random number; The third judgment module is used to determine whether the first random number and the second random number are consistent; The third execution module is used to establish a network security access session between the network server and the network homepage executable file when the judgment result of the third judgment module is yes. The process terminates when the result of the third judgment module is negative.
9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method according to any one of claims 1-7.
10. A storage medium having a computer program stored thereon, characterized in that, When the program is executed by a processor, it implements the steps of the method according to any one of claims 1-7.