A method for modifying a VPN using national cryptographic standards

Abstract

This invention discloses a VPN modification method based on Chinese national cryptographic algorithms, belonging to the field of computer network communication technology. It inserts an Nginx proxy layer supporting Chinese national cryptographic algorithms between the client and server in a traditional OpenConnect VPN architecture. By modifying the OpenConnect client, its dependent encryption library is replaced with a Chinese national cryptographic algorithm encryption library, enabling the client to initiate a Chinese national cryptographic TLS handshake. The modified client establishes a Chinese national cryptographic encrypted channel with the Nginx proxy layer. Data is decrypted by Nginx and forwarded in plaintext to the backend standard ocserv server. This invention requires no modification to the ocserv server, adding support for Chinese national cryptographic algorithms to the standard OpenConnect VPN service with minimal cost, meeting the cryptographic application requirements of the Cybersecurity Classified Protection 2.0 standard, and supporting dual-certificate adaptive access for a smooth business transition.

Description

Technical Field

[0001] This invention relates to the field of computer network communication technology, specifically to a method for modifying a VPN using Chinese national cryptographic standards. Background Technology

[0002] With the increasing demands for cybersecurity compliance in key sectors such as government affairs, finance, and energy in China, encrypted communication for data transmission must meet national standards such as the "Basic Requirements for Cryptographic Applications in Information Security Technology" (GB / T 38636), which mandates the use of Chinese cryptographic algorithms (SM2 / SM3 / SM4, etc.) to replace traditional international encryption protocols (such as SSL / TLS, RSA, AES, etc.).

[0003] Openconnect, as an open-source VPN client, and ocserv, as a complementary server, are widely used in scenarios such as remote enterprise work and cross-regional data transmission due to their advantages of lightweight design, cross-platform compatibility, and strong compatibility. However, Openconnect and ocserv natively only support the SSL / TLS protocol suite and international encryption algorithms, which cannot directly meet the requirements of China's national cryptographic standards.

[0004] In practical deployments, to reduce the risks of modification and protect existing IT assets, users typically want to achieve encrypted communication between the client and server using Chinese national cryptographic standards without refactoring the ocserv server (to avoid service interruptions and compatibility issues). Meanwhile, in some scenarios, the client and ocserv server need to achieve network reachability through an intermediate forwarding node (such as Nginx) (e.g., cross-network segment deployment, load balancing requirements). This necessitates addressing the compatibility issues between the encrypted channel and the existing forwarding architecture and plaintext server, ensuring a balance between encryption compliance and communication stability.

[0005] Existing technology 1: OpenConnect-ocserv native VPN technology: The OpenConnect client and ocserv server establish a VPN connection via SSL / TLS protocol. The core process includes: the client initiating an SSL / TLS handshake (based on TLS 1.2 / 1.3 protocol), completing authentication and key negotiation using RSA / ECC algorithms, and subsequently transmitting VPN data using symmetric encryption algorithms to achieve data confidentiality and integrity verification. The core advantages of this technology are strong compatibility and simple deployment. However, the encryption protocol and algorithms are entirely dependent on international standards and are incompatible with the SM2 / SM3 / SM4 Chinese national cryptographic algorithms, failing to meet the encryption compliance requirements of key domestic sectors. This limits its application in government, finance, and other scenarios, and it cannot establish secure connections with intermediate forwarding nodes that support Chinese national cryptographic algorithms.

[0006] Existing technology 2: Full-chain national cryptographic transformation: If the encryption protocol stacks of both the client and server are modified simultaneously, and a national cryptographic algorithm module is implanted to replace the original SSL / TLS protocol to achieve end-to-end national cryptographic communication, this solution requires a deep reconstruction of the OpenConnect client and the ocserv server, involving modifications to core modules such as protocol parsing, key negotiation, and data encryption. This not only results in high development costs and a long development cycle, but may also break the native compatibility of ocserv (such as compatibility with other VPN clients), leading to risks such as service interruption and abnormal data transmission, which does not meet the actual needs of enterprises for "minimal modification and rapid deployment". Summary of the Invention

[0007] The purpose of this invention is to provide a VPN modification method based on national cryptographic standards to solve the problems mentioned in the background section.

[0008] To achieve the above objectives, the present invention provides the following technical solution: a VPN modification method based on national cryptographic standards, comprising the following steps: Step S1: Deploy an Nginx proxy layer that supports Chinese cryptographic algorithms: An Nginx server is deployed between the public network and the internal network. The Nginx server adopts the Tengine branch and integrates the Tongsuo national cryptographic library, is configured with dual national cryptographic certificates, and listens for national cryptographic TLS connection requests on a specified port. Step S2: Modify the OpenConnect VPN client: Based on the OpenConnect client open source code, the encryption library it depends on is replaced from OpenSSL / GnuTLS to an encryption library that supports Chinese cryptographic algorithms, and the TLS handshake logic is modified so that the client can initiate a Chinese cryptographic TLS handshake and negotiate Chinese cryptographic encryption suites; Step S3: Establish a national cryptographic encryption channel: The modified client initiates a VPN connection request to the Nginx proxy layer, uses the national cryptographic TLS protocol for handshaking, negotiates national cryptographic encryption suites such as SM2-SM4-SM3, and establishes a national cryptographic encryption channel between the client and the Nginx proxy layer; Step S4: Nginx proxy layer decryption and forwarding: After receiving encrypted data from the client, the Nginx proxy layer decrypts it using the Chinese national cryptographic private key to restore the plaintext VPN protocol data packet. As a TCP layer reverse proxy, the Nginx proxy layer forwards the plaintext data packet to the backend standard ocserv server. Step S5, ocserv server processing and response: After receiving a plaintext request forwarded by Nginx, the standard ocserv server processes it according to the standard OpenConnect VPN protocol and generates response data to return to the Nginx proxy layer. Step S6: Encrypt and return the response data. After receiving the plaintext response from ocserv, the Nginx proxy layer encrypts the response data using the national cryptographic algorithm through the established national cryptographic encryption channel with the client and returns it to the modified client.

[0009] Preferably, the Nginx proxy layer adopts the Tengine branch and integrates the Tongsuo national cryptographic library, and is configured with a national cryptographic dual certificate system, including a signature certificate and an encryption certificate, which are used for identity authentication and key exchange, respectively.

[0010] Preferably, the modification of the OpenConnect VPN client specifically includes: modifying the client's build script to replace the dependent OpenSSL or GnuTLS encryption library with an encryption library that supports Chinese cryptographic algorithms; and modifying the TLS handshake logic to add Chinese cryptographic algorithms to the list of encryption suites supported by the client.

[0011] Preferably, the national cryptographic encryption suite includes ECC-SM2-SM4-GCM-SM3. This suite uses SM2 for key exchange and authentication, SM4 for data encryption, and SM3 for integrity verification.

[0012] Preferably, the Nginx proxy layer communicates with the backend ocserv server in plaintext, and the Nginx proxy layer only acts as an SSL terminator and does not change the content of the VPN protocol data packets.

[0013] Preferably, the Nginx proxy layer is configured with both Chinese cryptographic certificates and international algorithm certificates, and automatically selects the appropriate certificate based on the client's handshake request, while supporting access from both modified Chinese cryptographic clients and unmodified standard clients.

[0014] Preferably, the Nginx proxy layer acts as a Layer 4 TCP reverse proxy, using the stream module to forward TCP traffic to the backend ocserv server.

[0015] Preferably, the encryption library supporting the national cryptographic algorithm is Tongsuo or GmSSL.

[0016] Compared with the prior art, the beneficial effects of the present invention are: 1. Low transformation cost: Only the client needs to be modified and a proxy layer needs to be added. The backend ocserv server does not need any modification, which greatly reduces the development difficulty and testing cost and shortens the project cycle.

[0017] 2. National Cryptographic Compliance: Through the national cryptographic encryption channel between the client and the proxy layer, the requirements of Cybersecurity Classified Protection 2.0 and related regulations for cryptographic applications are met, enabling the application of national cryptographic algorithms such as SM2 / SM3 / SM4.

[0018] 3. Smooth transition capability: The Nginx proxy layer supports dual certificate configuration, which can simultaneously serve the modified national cryptographic client and the unmodified standard client, supporting the smooth migration and transition of business.

[0019] 4. High reusability: Fully utilizes the mature Nginx national cryptographic ecosystem (Tengine+Tongsuo), the proxy layer is simple to configure, reliable in performance, and easy to expand and cluster for deployment.

[0020] 5. Zero intrusion into the core system: The standard ocserv server remains running as is, without the need for downtime modifications, ensuring the stability and reliability of the core system.

[0021] This invention adds support for national cryptographic algorithms to the standard OpenConnect VPN service at minimal cost without modifying the ocserv server, meeting the requirements of the Cybersecurity Classified Protection 2.0 for cryptographic applications. It also supports dual-certificate adaptive access, enabling a smooth transition of services. Attached Figure Description

[0022] Figure 1 This is a schematic diagram of the process of the present invention. Detailed Implementation

[0023] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] Please see Figure 1 This invention provides a technical solution: a method for modifying a VPN using Chinese national cryptographic standards, comprising the following steps: Step S1: Deploy an Nginx proxy layer that supports Chinese cryptographic algorithms: An Nginx server is deployed between the public network and the internal network. The Nginx server adopts the Tengine branch and integrates the Tongsuo national cryptographic library, is configured with dual national cryptographic certificates, and listens for national cryptographic TLS connection requests on a specified port. Step S2: Modify the OpenConnect VPN client: Based on the OpenConnect client open source code, the encryption library it depends on is replaced from OpenSSL / GnuTLS to an encryption library that supports Chinese cryptographic algorithms, and the TLS handshake logic is modified so that the client can initiate a Chinese cryptographic TLS handshake and negotiate Chinese cryptographic encryption suites; Step S3: Establish a national cryptographic encryption channel: The modified client initiates a VPN connection request to the Nginx proxy layer, uses the national cryptographic TLS protocol for handshaking, negotiates national cryptographic encryption suites such as SM2-SM4-SM3, and establishes a national cryptographic encryption channel between the client and the Nginx proxy layer; Step S4: Nginx proxy layer decryption and forwarding: After receiving encrypted data from the client, the Nginx proxy layer decrypts it using the Chinese national cryptographic private key to restore the plaintext VPN protocol data packet. As a TCP layer reverse proxy, the Nginx proxy layer forwards the plaintext data packet to the backend standard ocserv server. Step S5, ocserv server processing and response: After receiving a plaintext request forwarded by Nginx, the standard ocserv server processes it according to the standard OpenConnect VPN protocol and generates response data to return to the Nginx proxy layer. Step S6: Encrypt and return the response data. After receiving the plaintext response from ocserv, the Nginx proxy layer encrypts the response data using the national cryptographic algorithm through the established national cryptographic encryption channel with the client and returns it to the modified client.

[0025] In this invention, the Nginx proxy layer adopts the Tengine branch and integrates the Tongsuo national cryptographic library, and is configured with a national cryptographic dual certificate system, including a signature certificate and an encryption certificate, which are used for identity authentication and key exchange, respectively.

[0026] In this invention, the modification of the OpenConnect VPN client specifically includes: modifying the client's build script to replace the dependent OpenSSL or GnuTLS encryption library with an encryption library that supports Chinese cryptographic algorithms; and modifying the TLS handshake logic to add Chinese cryptographic algorithms to the list of encryption suites supported by the client.

[0027] In this invention, the national cryptographic encryption suite includes ECC-SM2-SM4-GCM-SM3. This suite uses SM2 for key exchange and authentication, SM4 for data encryption, and SM3 for integrity verification.

[0028] In this invention, the Nginx proxy layer communicates with the backend ocserv server in plaintext. The Nginx proxy layer acts only as an SSL terminator and does not change the content of the VPN protocol data packets.

[0029] In this invention, the Nginx proxy layer is configured with both Chinese cryptographic certificates and international algorithm certificates, and automatically selects the appropriate certificate based on the client's handshake request. It also supports access from both modified Chinese cryptographic clients and unmodified standard clients.

[0030] In this invention, the Nginx proxy layer acts as a Layer 4 TCP reverse proxy, using the stream module to forward TCP traffic to the backend ocserv server.

[0031] In this invention, the encryption library supporting the national cryptographic algorithm is Tongsuo or GmSSL.

[0032] Example 1: Client-side National Cryptographic Standard Modification The encryption protocol stack of the OpenConnect client is modified to incorporate Chinese cryptographic algorithm modules (SM2 key exchange, SM3 authentication, and SM4 data encryption), making it compatible with the original SSL / TLS protocol suite. The client interface allows users to select between Chinese cryptographic and standard RSA encryption, adapts to the handshake process of the Chinese cryptographic standard, and resolves the compatibility issues between the native OpenConnect protocol and the Chinese cryptographic protocol. The client retains its original VPN connection logic (such as routing configuration and data forwarding), and only modifies the "encrypted communication layer" to achieve compatibility between "national cryptographic encryption + original VPN functions".

[0033] Example 2: Nginx National Cryptographic Standard Modification Modify nginx to support Chinese cryptographic standards. Use open-source nginx and GmSSL to implement the Chinese cryptographic standard modification of nginx. The client establishes a Chinese cryptographic channel with the nginx proxy, and then establishes a plaintext channel with the ocserv server.

[0034] Example 3: ocserv Modification Modify the ocserv server, making minimal changes to enable it to receive plaintext data.

[0035] The present invention is characterized as follows: Layered Proxy Architecture: Unlike methods that directly modify the server, this invention inserts an independent national cryptographic proxy layer between the client and the server, decoupling the implementation of the national cryptographic algorithm from the core VPN business logic. The proxy layer only handles encryption and decryption at the SSL / TLS layer, while the upper-layer VPN protocol is transparently transmitted to the backend server.

[0036] Client encryption library replacement and modification: This invention modifies the OpenConnect client source code, replacing its dependent international algorithm encryption library with a Chinese national cryptographic algorithm encryption library, enabling the client to initiate a Chinese national cryptographic TLS handshake, while retaining the original VPN control protocol logic.

[0037] Nginx Chinese Cryptographic Proxy Forwarding: This invention uses Tengine with Tongsuo integrated as a Chinese cryptographic proxy, configures dual Chinese cryptographic certificates, realizes Chinese cryptographic TLS termination and TCP layer traffic forwarding, and communicates between the proxy layer and the backend ocserv in plaintext.

[0038] Dual-stack compatibility: The Nginx proxy layer described in this invention can be configured with both Chinese cryptographic certificates and international algorithm certificates (RSA / ECC) at the same time, and automatically selects the appropriate certificate according to the client's handshake request, so that both the modified Chinese cryptographic client and the unmodified standard client can access the network simultaneously.

[0039] The contents not described in detail in this specification are prior art known to those skilled in the art. Although embodiments of the present invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the present invention. The scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for modifying a VPN using national cryptographic standards, characterized in that: Includes the following steps: Step S1: Deploy an Nginx proxy layer that supports Chinese cryptographic algorithms: An Nginx server is deployed between the public network and the internal network. The Nginx server adopts the Tengine branch and integrates the Tongsuo national cryptographic library, is configured with dual national cryptographic certificates, and listens for national cryptographic TLS connection requests on a specified port. Step S2: Modify the OpenConnect VPN client: Based on the OpenConnect client open source code, the encryption library it depends on is replaced from OpenSSL / GnuTLS to an encryption library that supports Chinese cryptographic algorithms, and the TLS handshake logic is modified so that the client can initiate a Chinese cryptographic TLS handshake and negotiate Chinese cryptographic encryption suites; Step S3: Establish a national cryptographic encryption channel: The modified client initiates a VPN connection request to the Nginx proxy layer, uses the national cryptographic TLS protocol for handshaking, negotiates the SM2-SM4-SM3 national cryptographic encryption suite, and establishes a national cryptographic encryption channel between the client and the Nginx proxy layer. Step S4: Nginx proxy layer decryption and forwarding: After receiving encrypted data from the client, the Nginx proxy layer decrypts it using the Chinese national cryptographic private key to restore the plaintext VPN protocol data packet. As a TCP layer reverse proxy, the Nginx proxy layer forwards the plaintext data packet to the backend standard ocserv server. Step S5, ocserv server processing and response: After receiving a plaintext request forwarded by Nginx, the standard ocserv server processes it according to the standard OpenConnect VPN protocol and generates response data to return to the Nginx proxy layer. Step S6: Encrypt and return the response data. After receiving the plaintext response from ocserv, the Nginx proxy layer encrypts the response data using the national cryptographic algorithm through the established national cryptographic encryption channel with the client and returns it to the modified client.

2. The VPN modification method according to claim 1, characterized in that: The Nginx proxy layer adopts the Tengine branch and integrates the Tongsuo national cryptographic library, and is configured with a dual national cryptographic certificate system, including a signature certificate and an encryption certificate, which are used for identity authentication and key exchange, respectively.

3. The VPN modification method according to claim 1, characterized in that: The modification of the OpenConnectVPN client specifically includes: modifying the client's build script to replace the dependent OpenSSL or GnuTLS encryption library with an encryption library that supports Chinese cryptographic algorithms; and modifying the TLS handshake logic to add Chinese cryptographic algorithms to the list of encryption suites supported by the client.

4. The VPN modification method according to claim 3, characterized in that: The national cryptographic encryption suite includes ECC-SM2-SM4-GCM-SM3. This suite uses SM2 for key exchange and authentication, SM4 for data encryption, and SM3 for integrity verification.

5. The VPN modification method according to claim 1, characterized in that: The Nginx proxy layer communicates with the backend ocserv server in plaintext. The Nginx proxy layer only acts as an SSL terminator and does not change the content of the VPN protocol data packets.

6. The VPN modification method according to claim 1, characterized in that: The Nginx proxy layer is configured with both Chinese cryptographic certificates and international algorithm certificates, and automatically selects the appropriate certificate based on the client's handshake request. It also supports access from both modified Chinese cryptographic clients and unmodified standard clients.

7. A VPN modification method based on national cryptographic standards according to claim 1, characterized in that: The Nginx proxy layer acts as a Layer 4 TCP reverse proxy, using the stream module to forward TCP traffic to the backend ocserv server.

8. A VPN modification method based on national cryptographic standards according to claim 1, characterized in that: The encryption library that supports the national cryptographic algorithm is Tongsuo or GmSSL.

Images