SCTP-based transport layer secure connection method, apparatus and storage medium

Abstract

This invention provides a method, apparatus, and storage medium for SCTP-based transport layer secure connection. The SCTP-based transport layer secure connection method, applied to a client, includes: establishing an SCTP connection with a server to obtain an SCTP link; establishing a TLS connection with the server based on the SCTP link; encrypting an NG link establishment request message based on TLS parameters negotiated during the establishment of the TLS connection to obtain first ciphertext data, and sending the first ciphertext data to the server based on the SCTP link; receiving second ciphertext data sent by the server, and decrypting the second ciphertext data using the TLS parameters to obtain an NG link establishment response message. The SCTP-based transport layer secure connection method, apparatus, and storage medium provided by this invention establish an SCTP-based TLS encrypted connection, ensuring application data encryption requirements while saving message overhead.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a method, apparatus and storage medium for secure transport layer connection based on SCTP. Background Technology

[0002] In current 5G networks, encrypted communication of next-generation (NG) links is usually implemented based on network layer security protocols (IP Security, IPsec). Independent IPsec modules can be added to the 5G base station (the next generation NodeB, GNB) and the core network side, or IPsec devices can be deployed separately to achieve encrypted communication of NG links.

[0003] However, since IPsec operates at the network layer, encrypting and encapsulating the entire IP packet in tunnel mode adds significant overhead. Summary of the Invention

[0004] This invention provides a transport layer secure connection method, apparatus and storage medium based on SCTP to solve the technical problem of high message overhead in NG link encrypted communication in the prior art.

[0005] In a first aspect, the present invention provides a transport layer secure connection method based on SCTP, applied to a client, comprising the following steps: Establish a Flow Control Transport Protocol (SCTP) connection with the server to obtain an SCTP link; Based on the SCTP link, a transport layer secure TLS connection is established with the server; The next-generation NG link establishment request message is encrypted based on the TLS parameters negotiated and determined during the establishment of the TLS connection to obtain the first ciphertext data, and the first ciphertext data is sent to the server based on the SCTP link; The system receives the second encrypted data sent by the server and decrypts the second encrypted data using the TLS parameters to obtain the NG link establishment response message.

[0006] Secondly, the present invention provides a transport layer secure connection method based on SCTP, applied to the server side, comprising the following steps: Establish an SCTP connection with the client to obtain the SCTP link; Based on the SCTP link, a TLS connection is established with the client; Receive the first encrypted data sent by the client through the SCTP link; Based on the TLS parameters negotiated and determined during the establishment of the TLS connection, the first ciphertext data is decrypted to obtain the NG link establishment request message; An NG link establishment response message is generated based on the NG link establishment request message, and the NG link establishment response message is encrypted based on the TLS parameters to obtain the second ciphertext data; The second encrypted data is sent to the client via the SCTP link.

[0007] Thirdly, embodiments of this application provide a client, including a memory, a transceiver, and a processor; A memory for storing computer programs; a transceiver for sending and receiving data under the control of the processor; and a processor for reading the computer programs from the memory and performing the following operations: Establish a Flow Control Transport Protocol (SCTP) connection with the server to obtain an SCTP link; Based on the SCTP link, a transport layer secure TLS connection is established with the server; The next-generation NG link establishment request message is encrypted based on the TLS parameters negotiated and determined during the establishment of the TLS connection to obtain the first ciphertext data, and the first ciphertext data is sent to the server based on the SCTP link; The system receives the second encrypted data sent by the server and decrypts the second encrypted data using the TLS parameters to obtain the NG link establishment response message.

[0008] Fourthly, embodiments of this application provide a server, including a memory, a transceiver, and a processor; A memory for storing computer programs; a transceiver for sending and receiving data under the control of the processor; and a processor for reading the computer programs from the memory and performing the following operations: Establish an SCTP connection with the client to obtain the SCTP link; Based on the SCTP link, a TLS connection is established with the client; Receive the first encrypted data sent by the client through the SCTP link; Based on the TLS parameters negotiated and determined during the establishment of the TLS connection, the first ciphertext data is decrypted to obtain the NG link establishment request message; An NG link establishment response message is generated based on the NG link establishment request message, and the NG link establishment response message is encrypted based on the TLS parameters to obtain the second ciphertext data; The second encrypted data is sent to the client via the SCTP link.

[0009] Fifthly, the present invention provides a transport layer secure connection device based on SCTP, applied to a client, the device comprising the following modules: The first connection module is used to establish a Flow Control Transport Protocol (SCTP) connection with the server to obtain an SCTP link. The second connection module is used to establish a transport layer secure TLS connection with the server based on the SCTP link; The first sending module is used to encrypt the next-generation NG link establishment request message based on the TLS parameters negotiated and determined during the establishment of the TLS connection, obtain the first ciphertext data, and send the first ciphertext data to the server based on the SCTP link; The first receiving module is used to receive the second encrypted data sent by the server, and decrypt the second encrypted data using the TLS parameters to obtain the NG link establishment response message.

[0010] Sixthly, the present invention provides a transport layer secure connection device based on SCTP, applied to a server, the device comprising the following modules: The third connection module is used to establish an SCTP connection with the client and obtain the SCTP link; The fourth connection module is used to establish a TLS connection with the client based on the SCTP link; The second receiving module is used to receive the first encrypted data sent by the client through the SCTP link; The first decryption module is used to decrypt the first ciphertext data based on the TLS parameters negotiated and determined during the establishment of the TLS connection, and obtain the NG link establishment request message; The first encryption module is used to generate an NG link establishment response message based on the NG link establishment request message, and encrypt the NG link establishment response message based on the TLS parameters to obtain the second ciphertext data; The second sending module is used to send the second encrypted data to the client based on the SCTP link.

[0011] In a seventh aspect, the present invention also provides a processor-readable storage medium storing a computer program that, when executed by a processor, implements the SCTP-based transport layer secure connection method as described in the first or second aspect above.

[0012] Eighthly, the present invention also provides a non-transitory readable storage medium storing a computer program that, when executed by a processor, implements the SCTP-based transport layer secure connection method as described in the first or second aspect above.

[0013] In a ninth aspect, the present invention also provides a computer-readable storage medium storing a computer program for causing a computer to perform the SCTP-based transport layer secure connection method as described in the first or second aspect above.

[0014] This invention provides a transport layer secure connection method, apparatus, and storage medium based on SCTP. The client establishes an SCTP connection with a server, obtaining an SCTP link. Based on the SCTP link, a TLS connection is established with the server. An NG link establishment request message is encrypted using TLS parameters negotiated during the TLS connection establishment process to obtain first ciphertext data, which is then sent to the server via the SCTP link. Second ciphertext data sent by the server is received and decrypted using the TLS parameters to obtain an NG link establishment response message. This establishes a TLS encrypted connection based on SCTP, implementing a TLS over SCTP NG link secure communication method. Specifically, it uses a bidirectional SCTP stream to complete the TLS handshake and encryption parameter negotiation, using the negotiated TLS parameters for message encryption and decryption to ensure security, and the SCTP protocol to ensure reliable and ordered transmission. While meeting the application data encryption requirements, it avoids the encryption and encapsulation of the entire IP packet, saving packet overhead. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0016] Figure 1 This is one of the flowcharts of the SCTP-based transport layer secure connection method provided by the present invention.

[0017] Figure 2 This is a schematic diagram of the overall service process of the SCTP-based transport layer secure connection method provided by the present invention.

[0018] Figure 3 This is the second flowchart of the SCTP-based transport layer secure connection method provided by the present invention.

[0019] Figure 4 This is a schematic diagram of the structure of a client device provided by the present invention.

[0020] Figure 5 This is a schematic diagram of the structure of a server-side device provided by the present invention.

[0021] Figure 6 This is one of the structural schematic diagrams of the SCTP-based transport layer secure connection device provided by the present invention.

[0022] Figure 7 This is the second schematic diagram of the SCTP-based transport layer secure connection device provided by the present invention. Detailed Implementation

[0023] The current encrypted communication methods for NG links are as follows: one is to add an IPsec module to the local communication equipment to establish a Virtual Private Network (VPN) tunnel. Due to the encapsulation of Internet Protocol (IP) packets, processing is required at the network layer. The other method is to add an IPsec device, with both ends of the system accessing as IPsec clients. The IPsec device establishes a VPN tunnel. This method adds two layers of processing: network layer, link layer, and physical layer.

[0024] The current encrypted communication method of NG links, due to the addition of the Authentication Header (AH), Encapsulating Security Payload (ESP) header and new IP packet header by IPsec, not only increases the complexity of packet processing and affects network performance, but also the IPsec protocol operates at the network layer, and in tunnel mode, it needs to encrypt and encapsulate the entire IP packet, which adds a lot of additional packet overhead.

[0025] IPSec (IP Security) is a network layer security protocol primarily used to protect the security of IP data packets during transmission. It provides two security mechanisms: authentication and encryption. The authentication mechanism, using IPSec's AH protocol, allows the data receiver in IP communication to verify the sender's identity and whether the data has been tampered with during transmission. This mechanism effectively prevents the risk of data forgery or alteration. The encryption mechanism, using IPSec's ESP protocol, encodes the data to ensure confidentiality and prevent eavesdropping during transmission. This mechanism ensures data confidentiality and protects user privacy.

[0026] Stream Control Transmission Protocol (SCTP) is a message-stream-based protocol that enables the simultaneous transmission of multiple data streams between two endpoints of a network connection. Operating at the network layer, SCTP provides multiple streams between connected endpoints, each reliably delivering messages in order. The loss of a message in one stream does not block the delivery of messages on other streams of the same association. An SCTP packet contains a common header and several chunks of data, each chunk potentially containing either control information or user data. SCTP uses a periodic heatbeat message mechanism to ensure association availability.

[0027] Transport Layer Security (TLS) resides between the application layer and the network layer, typically based on a TCP connection. Its predecessor, Secure Sockets Layer (SSL), is a communication protocol used by applications to ensure secure communication over a network, providing security guarantees for application layer protocols or preventing eavesdropping. It encrypts application layer messages before passing them to the network layer for transmission. It requires the server to provide a valid digital certificate to verify identity and establish a secure connection. If both the client and server can provide their own digital certificates, they can authenticate each other. The SSL / TLS protocol primarily performs encryption and decryption operations at the application layer, having a relatively small impact on network performance.

[0028] To address the aforementioned technical issues, this invention proposes a transport layer secure connection method based on SCTP. The client establishes an SCTP connection with the server, obtaining an SCTP link. Based on the SCTP link, a TLS connection is established with the server. An NG link establishment request message is encrypted using TLS parameters negotiated during the TLS connection establishment process to obtain first ciphertext data, which is then sent to the server via the SCTP link. Second ciphertext data sent by the server is received and decrypted using the TLS parameters to obtain an NG link establishment response message. This establishes a TLS-encrypted connection based on SCTP, realizing a TLS over SCTP NG link secure communication method. While ensuring application data encryption requirements, it saves message overhead, improves communication efficiency and reliability, and can meet more flexible networking requirements.

[0029] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0030] Figure 1 This is one of the flowcharts illustrating the SCTP-based transport layer secure connection method provided by the present invention, such as... Figure 1 As shown, this invention provides a transport layer secure connection method based on SCTP, the execution subject of which can be a client. The method includes: Step 101: Establish a Flow Control Transport Protocol (SCTP) connection with the server to obtain the SCTP link.

[0031] Specifically, the client establishes an SCTP connection with the server, that is, associating the client's SCTP address and port with the server's SCTP address and port to obtain an SCTP link. Different application threads correspond to different SCTP links. One application thread can correspond to one or more SCTP links, and one SCTP link can also correspond to one or more application threads.

[0032] For example, when an application requests to establish an NG link, the client and server complete the SCTP association establishment through a four-way SCTP handshake.

[0033] For example, when an application requests to establish an NG link, the client establishes an SCTP connection with the server based on the SCTP connection information pre-configured in the core network.

[0034] In this embodiment of the application, after establishing the SCTP connection corresponding to the application thread, the SCTP connection information corresponding to the application thread is stored in the local database.

[0035] Step 102: Based on the SCTP link, establish a Transport Layer Security (TLS) connection with the server.

[0036] Specifically, after establishing an SCTP connection, a TLS connection is established with the server via a TLS handshake on the SCTP link.

[0037] For example, after establishing an SCTP connection, the TLS context is associated with the SCTP socket, the client initiates a TLS handshake with the server to complete the TLS connection establishment, and saves the ticket and key information corresponding to the application thread in the local database.

[0038] Step 103: Encrypt the next-generation NG link establishment request message based on the TLS parameters negotiated and determined during the establishment of the TLS connection to obtain the first ciphertext data, and send the first ciphertext data to the server based on the SCTP link.

[0039] Specifically, during the TLS connection process, the client and server negotiate and determine the TLS parameters through a TLS three-way handshake. The TLS parameters are used to encrypt and decrypt application messages, and may include the TLS encryption algorithm, TLS session identifier (Session Id), and TLS session ticket period, etc.

[0040] After establishing the SCTP and TLS connections, the client uses the negotiated TLS parameters to encrypt the NG link establishment request message, obtains the first ciphertext data, and then sends the first ciphertext data to the server through the SCTP link.

[0041] The server receives the first ciphertext data sent by the client, decrypts the first ciphertext data using the negotiated TLS parameters to obtain the NG link establishment request message, processes the NG link establishment request message and generates an NG link establishment response message, encrypts the NG link establishment response message based on the negotiated TLS parameters to obtain the second ciphertext data, and sends the second ciphertext data to the client through the SCTP link.

[0042] Step 104: Receive the second encrypted data sent by the server, and decrypt the second encrypted data using the TLS parameters to obtain the NG link establishment response message.

[0043] Specifically, the client receives the second encrypted data sent by the server, decrypts the second encrypted data using the negotiated TLS parameters, obtains the NG link establishment response message, and the NG link establishment is completed.

[0044] In this embodiment of the application, before establishing the SCTP connection and the TLS connection, it is also necessary to import the TLS certificate offline. This certificate is a self-signed certificate, which is obtained without going through a Certificate Authority (CA). The key parameters such as TLS, Stream and SCTP are planned and determined.

[0045] For example, Table 1 is a table of SCTP stream ID convention parameters provided in the embodiments of this application. As shown in Table 1, Stream ID is the stream ID or stream identifier. It is agreed that when the SCTP stream ID is 0, the protocol type is TLS handshake protocol; when the SCTP stream ID is 1, the message type is 5G network access control protocol (Next Generation Access Protocol, NGAP) setup request message or NGAP setup response message; when the SCTP stream ID is 2, the message type is GNB NGAP message or 5GC NGAP message; when the SCTP stream ID is any value from 3 to 15, the message type is GNB Non-Access Stratum (NAS) message or 5GC NAS message.

[0046] Table 1 SCTP Stream ID Convention Parameter Table

[0047] The sending application thread organizes the message packet and passes the Stream parameter (i.e., the SCTP stream ID). Each application thread uses the aforementioned custom SCTP stream to send and receive application messages.

[0048] For example, Table 2 is a table of key parameters provided in the embodiments of this application. As shown in Table 2, the embodiments of this application configure the TLS authentication method, whether to support TLS connection fast recovery, TLS Session Ticket period, encryption algorithm and SCTP port, etc.

[0049] Table 2 Key Parameters

[0050] Figure 2 This is a schematic diagram of the overall service process of the SCTP-based transport layer secure connection method provided by the present invention, as shown below. Figure 2As shown, a transport layer TLS / SSL is added between the application layer (APP / NGAP) and the network layer (IP) to protect the security and confidentiality of application data during transmission. When the client and server establish a TLS connection, a statically configured bidirectional SCTP stream is used to complete the TLS handshake and negotiate encryption parameters. Reliable and ordered transmission is ensured by the specific transfer serial number (TSN) and stream serial number (SSN) of the SCTP protocol. The socket layer binding is not specifically bound to the stream, so that the TLS environment negotiated through a single stream can be applied to other streams. The client and server record layer protocols (TLS Record Protocol) use statically configured bidirectional streams to complete decryption and transmission. Reliable and ordered transmission is ensured by the SCTP protocol's TSN and SSN, as well as the Selective ACK (SACK) control block TSN ACK (relative) (i.e., an acknowledgment message relative to a specific TSN, where ACK stands for acknowledgment message) parameter. After encrypting the application message, the network layer groups the IP packet, and the data link layer (DLL) encapsulates the Layer 2 frame header to obtain the final encrypted data and sends it to the peer. Upon receiving it, the peer parses the Layer 2 frame header and IP header, and submits it to SCTP for processing. If there is message fragmentation, SCTP reassembles the message and decrypts the message using the negotiated TLS parameters to obtain the plaintext packet.

[0051] The SCTP-based transport layer secure connection method provided in this application establishes a TLS encrypted connection based on SCTP, realizing a TLS over SCTP NG link secure communication mode. That is, it uses SCTP bidirectional stream to complete the TLS handshake and encryption parameter negotiation, and uses the negotiated TLS parameters to encrypt and decrypt messages to ensure security. The specific TSN and SSN of the SCTP protocol jointly ensure reliable and ordered transmission. Compared with the IPsec method commonly used in NG interfaces, it does not require the addition of an IPsec client, eliminates the encryption and decryption processing of network layer data packets, reduces the impact on network performance, and saves message overhead, improves communication efficiency and reliability while ensuring the encryption requirements of application data, and can meet more flexible networking methods.

[0052] In some embodiments, establishing an SCTP connection with the server includes: Establish an SCTP connection with the server based on the first configuration information; The first configuration information includes the following: SCTP connection information corresponding to different application threads, wherein the SCTP connection information is the correspondence between the client's SCTP location information and the server's SCTP location information; and / or The first indication information and the SCTP location information of the client, wherein the first indication information is used to indicate that the local end is a client.

[0053] Specifically, the first configuration information is system-defined static configuration information, which may include SCTP connection information corresponding to different application threads, as well as SCTP location information of the local end (i.e., the client) and first indication information. The SCTP connection information is the correspondence between the client's SCTP location information and the server's SCTP location information; the SCTP location information includes the SCTP address and port. The first indication information is used to indicate that the local end is a client.

[0054] The client establishes an SCTP connection with the server based on the first configuration information. The SCTP connection can be established based on the SCTP connection information corresponding to the application thread in the first configuration information, or it can be established based on the client's SCTP location information and the first indication information in the first configuration information.

[0055] For the server, an SCTP connection is established with the client based on the second configuration information. The second configuration information includes the SCTP connection information corresponding to the application thread, the SCTP location information of the server, and / or the second indication information, which is used to indicate that the local end is the server.

[0056] Specifically, the second configuration information is a system-defined static configuration information. The server can establish an SCTP connection based on the SCTP connection information corresponding to the application thread in the second configuration information, or it can establish an SCTP connection based on the server's SCTP location information and the second indication information in the second configuration information.

[0057] The SCTP-based transport layer secure connection method provided in this application enables both ends to quickly and effectively establish an SCTP connection by statically configuring SCTP link establishment parameters for the client and server, thereby improving communication efficiency.

[0058] In some embodiments, if SCTP connection information corresponding to the application thread exists in the first configuration information, establishing an SCTP connection with the server based on the first configuration information includes: Match the SCTP connection information corresponding to the application thread from the first configuration information; An SCTP connection is established with the server based on the SCTP connection information.

[0059] Specifically, when an application requests to establish an NG link, the client first checks if the first configuration information contains SCTP connection information corresponding to the application thread. If the first configuration information contains SCTP connection information corresponding to the application thread, then an SCTP connection is established with the server based on the matched SCTP connection information in the first configuration information.

[0060] For example, if the first configuration information contains SCTP connection information corresponding to the application thread, an SCTP_INIT connection establishment request is sent to the server, and an SCTP connection is established with the server based on the matched SCTP connection information.

[0061] For the server, once the application thread starts, if the server determines that there is SCTP connection information corresponding to the application thread in the second configuration information, it will establish an SCTP connection with the client based on the SCTP connection information in the second configuration information after receiving the SCTP_INIT connection request sent by the client.

[0062] The SCTP-based transport layer secure connection method provided in this application provides a pre-configured association between client and server application threads and SCTP connection information. This allows the client and server to quickly determine the SCTP connection information corresponding to the application thread when the application thread requests to establish a connection, thereby rapidly establishing an SCTP connection, improving NG link establishment efficiency, and enhancing communication efficiency.

[0063] In some embodiments, if there is no SCTP connection information corresponding to the application thread in the first configuration information, establishing an SCTP connection with the server based on the first configuration information includes: The first SCTP socket is obtained based on the client's SCTP location information, and the first TLS context is obtained based on the first indication information; An SCTP connection is established with the server based on the first SCTP socket and the first TLS context.

[0064] Specifically, when an application requests to establish an NG link, if the client determines that there is no SCTP connection information corresponding to the application thread in the first configuration information, then it establishes an SCTP connection based on the client's SCTP location information and the second indication information in the first configuration information.

[0065] First, a first SCTP socket is created based on the client's SCTP location information in the first configuration information, and a first TLS context is created based on the first indication information in the first configuration information. Then, the first SCTP socket and the first TLS context are associated, and an SCTP handshake is initiated to the server based on the associated first SCTP socket and the first TLS context to complete the SCTP connection establishment.

[0066] After determining that there is no SCTP connection information corresponding to the application thread in the second configuration information, the server creates a second SCTP socket based on the server's SCTP location information in the second configuration information and starts listening for SCTP_INIT connection establishment requests from clients. When the server receives an SCTP_INIT connection establishment request from a client, it performs an SCTP handshake with the client based on the second SCTP socket, creates a second TLS context based on the second indication information in the second configuration information, associates the second SCTP socket with the second TLS context, and completes the SCTP connection establishment.

[0067] The SCTP-based transport layer secure connection method provided in this application embodiment can perform SCTP handshake based on other information in the configuration information, such as the local SCTP location information, when there is no SCTP connection information corresponding to the application thread in the configuration information, thus ensuring the effective establishment of the SCTP connection.

[0068] In some embodiments, establishing a Transport Layer Security (TLS) connection with the server based on the SCTP link includes: Based on the SCTP link and the first SCTP stream identifier ID, a TLS connection is established with the server, whereby the first SCTP stream ID is used to indicate that the message type is a TLS handshake message.

[0069] Specifically, after establishing an SCTP connection, a statically configured bidirectional SCTP stream is used to complete the TLS handshake and negotiate encryption parameters. Based on the SCTP link, the first SCTP stream identifier ID, which indicates that the message type is a TLS handshake message, is used to initiate a TLS handshake to the server and establish a TLS connection.

[0070] For example, in the SCTP Stream ID convention parameters, an SCTP Stream ID of 0 indicates that the message type is a TLS handshake message. After establishing an SCTP connection, the client associates the first TLS context with the first SCTP socket, sets the SCTP Stream ID to 0, and initiates a TLS handshake to the server through the SCTP link to complete the TLS connection establishment. The server receives the TLS handshake message sent by the client and also sends a handshake message to the client using the first SCTP Stream Identifier ID (i.e., 0), completing the 5-way 13-packet handshake of the TLS handshake protocol and establishing the TLS connection.

[0071] The SCTP-based transport layer secure connection method provided in this application embodiment performs TLS handshake based on the SCTP link and statically configured SCTP stream ID, realizing the combined application of SCTP and TLS, establishing SCTP-based TLS secure transmission, ensuring the security and privacy of application data, saving message overhead, improving communication efficiency, and enabling flexible deployment.

[0072] In some embodiments, sending the first encrypted data to the server based on the SCTP link includes: Based on the SCTP link and the second SCTP stream ID, the first encrypted data is sent to the server. The second SCTP stream ID is used to indicate whether the message type is an access request message or an access response message.

[0073] Specifically, after the client obtains the first ciphertext data by encrypting the NG link establishment request message using the negotiated TLS parameters, it sends the first ciphertext data to the server using a second SCTP stream ID indicating whether the message type is an access request message or an access response message, based on the SCTP link. Similarly, after the server obtains the second ciphertext data by encrypting the NG link establishment response message, it sends the second ciphertext data to the client using the second SCTP stream ID, based on the SCTP link.

[0074] For example, in the SCTP Stream ID convention parameters, an SCTP Stream ID of 1 indicates that the message type is an access request message or an access response message. The client encrypts the NG link establishment request message, obtains the first ciphertext data, sets the SCTP Stream ID to 1, and sends the first ciphertext data to the server through the SCTP link.

[0075] For example, after receiving the first ciphertext data, the server decrypts the first ciphertext data using the negotiated TLS parameters to obtain the NG link establishment request message, generates an NG link establishment response message based on the NG link establishment request message, encrypts the NG link establishment response message using the negotiated TLS parameters to obtain the second ciphertext data, sets the SCTP stream ID to 1, and sends the second ciphertext data to the client through the SCTP link.

[0076] The SCTP-based transport layer secure connection method provided in this application embodiment sends and receives application messages based on SCTP links and statically configured SCTP stream IDs, realizing the combined application of SCTP and TLS, establishing SCTP-based TLS secure transmission, ensuring the security and privacy of application data, saving message overhead, improving communication efficiency, and enabling flexible deployment.

[0077] In some embodiments, the method further includes: The secure connection information is saved to the client's database; the secure connection information includes one or more of the following: A TLS connection identifier, which is used to uniquely identify a TLS connection; The second SCTP stream ID is used to indicate whether the message type is an access request message or an access response message. Message ID; Thread ID; SCTP connection information, which is the correspondence between the client's SCTP location information and the server's SCTP location information; TLS parameters.

[0078] Specifically, after the NG link is established, the secure connection information corresponding to each application thread is stored in the databases of the client and the server. The secure connection information includes SCTP connection information obtained during the establishment of the SCTP connection, TLS parameters obtained during the establishment of the TLS connection, the ID of the corresponding application thread, the TLS connection identifier, the second SCTP stream ID, and the message ID, etc.

[0079] The SCTP-based transport layer secure connection method provided in this application stores information such as SCTP connection information, TLS parameters, second SCTP stream ID, TLS connection identifier, thread ID, and message ID used for establishing an NG link and communicating on the NG link in a local database. When the corresponding application thread initiates a link establishment request or when application messages need to be sent or received, the link establishment information and message encryption / decryption parameters related to the application thread can be queried from the database, which facilitates rapid link establishment and maintenance and improves communication efficiency.

[0080] The following specific examples further illustrate the SCTP-based transport layer secure connection methods provided in the above embodiments: Example 1: The client application link establishment process is as follows: Step 1: Complete static parameter configuration, system, application processes, threads, etc. start up, and database starts; Step 2: The application requests to establish an NG link, and the client receives the application's NG link establishment request message; Step 3: The platform management thread checks the configuration table (i.e., the first configuration information) to see if there is SCTP connection information for each thread of the application. If it exists, proceed to step 7; if it does not exist, proceed to step 4. Step 4: If the corresponding SCTP connection information does not exist in the configuration table, then according to the first instruction information in the parameter configuration table, create a TLS context, obtain the server certificate, and configure the encryption parameters and algorithms such as key exchange algorithm, signature algorithm, fast encryption algorithm, authentication code algorithm, and key store supported by the client. Step 5: Based on the parameter configuration table, obtain the local SCTP address and port, create an SCTP socket, send an SCTP_INIT connection request to the server, and complete the SCTP association establishment with the server through a four-way SCTP handshake; save the SCTP connection information corresponding to the application thread to the information record table in the database. Step 6: Associate the TLS context with the SCTP socket; set the SCTP stream ID to 0, initiate a TLS handshake with the server and complete the TLS connection establishment, and save information such as the ticket and key to the database memory; Step 7: After encrypting the application message using the negotiated TLS parameters, the application thread sets the stream ID to 1 and sends the encrypted data to the peer via the sctp_sendmsg function; Step 8: Save the association information of the application thread, such as TLS connection identifier, SCTP stream ID, message ID, and thread ID, to the database information record table; Step 9: After receiving the encrypted data, the server sends the NG link establishment response ciphertext data to the client. The client decrypts the data into plaintext using the negotiated TLS parameters. After application processing, the NG link is established and the client process is complete.

[0081] Example 2: The server-side application link establishment process is as follows: Step 1: Complete static parameter configuration, system, application processes, threads, etc. start up, and database starts; Step 2: The platform management thread checks the configuration table (i.e., the second configuration information) to see if there is SCTP connection information for each thread of the application. If it exists, proceed to step 4; if it does not exist, proceed to step 3. Step 3: If no corresponding SCTP connection information exists, obtain the local SCTP address and port according to the configuration table, create an SCTP socket, and start listening; Step 4: Receive the SCTP association establishment INIT message from the client. The SCTP port number is 38512. According to the agreement, the client requests to establish an association based on TLS encryption. Step 5: Complete the SCTP four-way handshake with the client to establish the SCTP association; and save the SCTP connection information to the information record table in the database; Step 6: Create a TLS context and associate it with an SCTP socket, and configure the encryption parameters and algorithms supported by the server, such as key exchange algorithms, signature algorithms, fast encryption algorithms, authentication code algorithms, and key stores; Step 7: Based on the static parameter configuration, set the SCTP stream ID to 0, complete the 5-way 13-packet handshake of the TLS handshake protocol, and complete the TLS connection establishment; and save the Session ID, Ticket, key and other information to memory; Step 8: Receive the SCTP layer encrypted data through the sctp_recvmsg function, and decrypt it into plaintext using the negotiated TLS parameters; Step 9: The application thread processes the plaintext request message, then organizes the NG link response message, encrypts the message using the negotiated TLS parameters, sets the SCTP stream ID to 1 according to the configuration, and calls the sctp_sendmsg function to send the encrypted data; Step 10: Save the association information of the application thread, such as TLS connection identifier, stream ID, message ID, and thread ID, to the information record table of the database; Step 11: The NG link is successfully established, and the server-side process is complete.

[0082] In some embodiments, the method further includes: Receive messages from the current application and send request messages; Determine whether the TLS session corresponding to the current application is normal; If the TLS session corresponding to the current application is normal, send encrypted application messages to the server; In the event of an anomaly in the TLS session corresponding to the current application, NG link recovery or reconstruction is performed based on the SCTP link status and / or TLS connection status.

[0083] Specifically, after receiving the message sending request message from the current application, the client determines whether the TLS session corresponding to the current application is normal.

[0084] For example, the system can be checked to see if there is TLS session information corresponding to the current application. If it exists, it indicates that the TLS session is normal; if it does not exist, it indicates that the TLS session is abnormal.

[0085] If the TLS session corresponding to the current application is normal, the client sends encrypted application messages to the server; if the TLS session corresponding to the current application is abnormal, the client needs to perform NG link recovery or reconstruction based on the SCTP link status and / or TLS connection status.

[0086] Similarly, after receiving the message sending request message from the current application, the server first determines whether the TLS session corresponding to the current application is normal.

[0087] If the TLS session corresponding to the current application is normal, the server sends an encrypted application message to the client; if the TLS session corresponding to the current application is abnormal, the server needs to perform NG link recovery or reconstruction based on the SCTP link status and / or TLS connection status.

[0088] The SCTP-based transport layer secure connection method provided in this application first determines whether the TLS session corresponding to the application is normal before sending application messages. Application messages can only be sent if the TLS session is normal. If the TLS session is abnormal, NG link recovery or reconstruction is required, thus ensuring the effectiveness of application message sending.

[0089] In some embodiments, when the TLS session corresponding to the current application is normal, sending the encrypted application message to the server includes: If the client's database contains secure connection information corresponding to the application thread of the current application, an encrypted application message is sent to the server based on the SCTP stream ID in the secure connection information corresponding to the application thread of the current application; and / or If the secure connection information corresponding to the application thread of the current application does not exist in the database of the client, an encrypted application message is sent to the server based on the second SCTP stream ID, which is used to indicate whether the message type is an access request message or an access response message.

[0090] Specifically, when the TLS session corresponding to the current application is normal, the client sends an encrypted application message to the server. If the client's database contains secure connection information corresponding to the application thread of the current application, the client can use the SCTP stream ID in the existing secure connection information to send the encrypted application message to the server. If the client's database does not contain secure connection information corresponding to the current application, the client calls the sctp_sendmsg function to send the encrypted application message to the server based on the second SCTP stream ID (used to indicate that the message type is an access request message) in the statically configured or agreed SCTP stream ID parameter table.

[0091] When the server needs to send encrypted application messages, the TLS session is normal. If the server's database contains secure connection information corresponding to the application thread of the current application, it can use the SCTP stream ID in the existing secure connection information to send encrypted application messages to the client. If the server's database does not contain secure connection information corresponding to the application thread of the current application, it calls the sctp_sendmsg function to send encrypted application messages to the client based on the second SCTP stream ID (used to indicate that the message type is an access request message) in the statically configured or agreed SCTP stream ID parameter table.

[0092] In this embodiment of the application, if the database of the local end (client or server) does not contain the secure connection information corresponding to the application thread of the current application, after setting the SCTP stream ID according to the configuration or agreement and sending the message, the SCTP stream ID, TLS connection identifier, SCTP connection information, TLS parameters, thread ID and message ID are also stored in the database of the local end as the secure connection information corresponding to the application thread.

[0093] Each application thread has its own set of secure connection information, which may include one or more of the following: A TLS connection identifier, which is used to uniquely identify a TLS connection; The second SCTP stream ID is used to indicate whether the message type is an access request message or an access response message. Message ID; Thread ID; SCTP connection information, which is the correspondence between the client's SCTP location information and the server's SCTP location information; TLS parameters.

[0094] The SCTP-based transport layer secure connection method provided in this application uses the SCTP stream IDs stored in the database to send encrypted application messages. When the corresponding SCTP stream ID is not stored in the database, the encrypted application message is sent according to the configured or agreed SCTP stream ID settings, and the relevant secure connection information is saved to the database. This facilitates the continued use of the SCTP stream IDs in the database to send application messages for the same application thread in the future, ensuring the smooth transmission of application messages and improving communication efficiency.

[0095] In some embodiments, before sending the encrypted application message to the server, the method further includes: Determine whether the length of the encrypted application message exceeds the length of the network's maximum transmission unit; If the length of the encrypted application message exceeds the length of the network's maximum transmission unit, the encrypted application message is fragmented.

[0096] Specifically, before sending an encrypted application message, the client or server needs to determine whether the length of the encrypted application message exceeds the length of the network's Maximum Transmission Unit (MTU). If the length of the encrypted application message exceeds the length of the network MTU, it means that the encrypted application message cannot pass through the link and needs to be fragmented before being sent.

[0097] The SCTP-based transport layer secure connection method provided in this application determines whether message fragmentation is required before message transmission. If the application message cannot pass through, message fragmentation is required before transmission. After the receiving end receives the fragmented message, the fragmented message needs to be reassembled and then decrypted, thus ensuring reliable and effective transmission of application messages and improving communication quality.

[0098] In some embodiments, the method further includes: Receive encrypted data sent by the server; Determine whether the TLS session corresponding to the current application is normal; If the TLS session corresponding to the current application is normal, the encrypted data is decrypted using the TLS parameters corresponding to the TLS session corresponding to the current application. In the event of an anomaly in the TLS session corresponding to the current application, NG link recovery or reconstruction is performed based on the SCTP link status and / or TLS connection status.

[0099] Specifically, after receiving encrypted data from the server, the client determines whether the TLS session corresponding to the current application is normal.

[0100] For example, the system can be checked to see if there is TLS session information corresponding to the current application. If it exists, it indicates that the TLS session is normal; if it does not exist, it indicates that the TLS session is abnormal.

[0101] If the TLS session corresponding to the current application is normal, the client uses the TLS parameters corresponding to the TLS session corresponding to the current application to decrypt the encrypted data; if the TLS session corresponding to the current application is abnormal, the client needs to perform NG link recovery or reconstruction based on the SCTP link status and / or TLS connection status.

[0102] Similarly, after receiving encrypted data from the client, the server first determines whether the TLS session corresponding to the current application is normal.

[0103] If the TLS session corresponding to the current application is normal, the server uses the TLS parameters corresponding to the TLS session corresponding to the current application to decrypt the encrypted data; if the TLS session corresponding to the current application is abnormal, the server needs to perform NG link recovery or reconstruction based on the SCTP link status and / or TLS connection status.

[0104] The SCTP-based transport layer secure connection method provided in this application first determines whether the TLS session corresponding to the application is normal after receiving encrypted data sent by the peer. If the TLS session is normal, the encrypted data is decrypted to obtain the plaintext message. If the TLS session is abnormal, NG link recovery or reconstruction is required, which ensures the smooth reception of application messages and improves communication quality.

[0105] The following specific examples further illustrate the SCTP-based transport layer secure connection methods provided in the above embodiments: Example 3: The application message sending process is as follows: Step 1: Receive message sending request from application thread Step 2: The platform management searches and determines whether there is TLS session information corresponding to the application; if it exists, it means that the application's TLS session is normal, and proceeds to step 4; if it does not exist, it means that the application's TLS session is abnormal, and proceeds to step 3. Step 3: TLS session error, proceed to client / server TLS session recovery / reconstruction process; Step 4: The TLS session is successful. Use the negotiated TLS parameters to encrypt application messages. Step 5: Search the database for the security connection information corresponding to the application thread, including TLS connection identifier, SCTP stream ID, message ID, and thread ID; if it exists, proceed to step 6; if it does not exist, proceed to step 7. Step 6: If it exists, use the SCTP stream ID corresponding to the application thread stored in the database to call the sctp_sendmsg function to send encrypted data; Step 7: If it does not exist, set the SCTP stream ID to 1 according to the configuration, call the sctp_sendmsg function to send encrypted data; then save the TLS connection identifier, SCTP stream ID, message ID and thread ID corresponding to the application thread to the information record table of the database; Step 8: Message sent.

[0106] Example 4: The application message receiving process is as follows: Step 1: Receive encrypted SCTP data sent by the peer; Step 2: The platform management searches and determines whether there is TLS session information corresponding to the application; if it exists, it means that the application's TLS session is normal, and proceeds to step 4; if it does not exist, it means that the application's TLS session is abnormal, and proceeds to step 3. Step 3: If the TLS session fails, proceed to the client / server TLS session recovery / reconstruction process; Step 4: If the TLS session is successful, decrypt the data using the negotiated TLS parameters; then transfer the processing to the application thread. Step 5: Message received.

[0107] In some embodiments, if the TLS session corresponding to the current application is abnormal, the method further includes: Detect SCTP link status and / or TLS connection status.

[0108] Specifically, when an anomaly is detected in the TLS session corresponding to the current application, the NG link recovery or reconstruction phase begins. First, the SCTP link state and / or TLS connection state are checked for anomalies, and then NG link recovery or reconstruction is performed based on the SCTP link state and / or TLS connection state.

[0109] In some embodiments, the SCTP link status is first checked to see if it is normal. If the SCTP link status is normal, the TLS connection status is then checked to see if it is normal. If the SCTP link status fails, it means that the entire NG link needs to be rebuilt, that is, the SCTP connection and TLS connection need to be re-established. At this time, it is not necessary to check the TLS connection status again.

[0110] In some embodiments, detecting the SCTP link status includes: Determine whether the SCTP link has experienced a heartbeat timeout, or whether a disconnect abort message has been sent to the server, or whether an abort message has been received from the server; If a heartbeat timeout occurs on the SCTP link, or if an abort message has been sent to the server or received from the server, the state of the SCTP link is determined to be abnormal. If no heartbeat timeout occurs on the SCTP link, and no abort message is sent to or received from the server, the SCTP link is considered to be in normal condition.

[0111] Specifically, the status of an SCTP link can be detected by checking whether a heartbeat timeout has occurred, whether an abort message has been sent to the server, or whether an abort message has been received from the server.

[0112] If a heartbeat timeout occurs, or if an abort message has been sent to the server or an abort message has been received from the server, it indicates that the SCTP link status is abnormal.

[0113] If the SCTP link does not experience heartbeat timeout, does not send an abort message to the server, and does not receive an abort message from the server, then the SCTP link is considered to be in normal condition.

[0114] For the server, the SCTP link status can be detected by checking whether the SCTP link has experienced a heartbeat timeout, whether a disconnect abort message has been sent to the client, or whether an abort message has been received from the client.

[0115] If a heartbeat timeout occurs, or if an abort message has been sent to the client or an abort message has been received from the client, it indicates that the SCTP link status is abnormal.

[0116] If the SCTP link does not experience heartbeat timeouts, does not send an abort message to the client, and does not receive an abort message from the client, then the SCTP link is considered to be in normal condition.

[0117] In some embodiments, detecting the TLS connection state includes: Determine whether TLS connection information exists, wherein the TLS connection information includes the server certificate of the server. If the TLS connection information is not present, the TLS connection status is determined to be abnormal. If the TLS connection information exists, the TLS connection status is determined to be normal.

[0118] Specifically, the TLS connection status can be detected by determining whether TLS connection information exists, including the server certificate. If TLS connection information exists, the TLS connection status is considered normal; if TLS connection information does not exist, the TLS connection status is considered abnormal.

[0119] In some embodiments, the NG link recovery or reconstruction based on SCTP link state and / or TLS connection state includes: If the SCTP link status and the TLS connection status are normal, the TLS connection will be restored. If the SCTP link is in normal condition but the TLS connection is in abnormal condition, re-establish the TLS connection with the server on the SCTP link. In the event of an abnormal SCTP link status, re-establish the SCTP connection and TLS connection with the server.

[0120] Specifically, if the SCTP link status and the TLS connection status are both normal, the TLS connection can be restored using the fast recovery method, which will restore the NG link.

[0121] If the SCTP link status is detected as normal but the TLS connection status is abnormal, a new TLS handshake needs to be performed on the established SCTP link to re-establish the TLS connection. Specifically, this involves: if the SCTP link status is normal but the TLS connection status is abnormal, the security connection information corresponding to that TLS connection, such as the TLS connection identifier, stream ID, message ID, and thread ID, is cleared from the database; the client sets the SCTP stream ID to 0, initiates a TLS handshake to the server and completes the TLS connection establishment; the NG link establishment request message is encrypted using the negotiated TLS parameters; the SCTP stream ID is set to 1; and the encrypted NG link establishment request message is sent to the server based on the SCTP link. The server decrypts the NG link establishment request message and generates an NG link establishment response message; the NG link establishment response message is encrypted using the negotiated TLS parameters; the SCTP stream ID is set to 1; and the encrypted NG link establishment response message is sent to the client based on the SCTP link. The client receives and decrypts the NG link establishment response message, the NG link is established, and the client and server save the corresponding security connection information to the database.

[0122] If an abnormal SCTP link status is detected, the current NG link connection is closed, the corresponding secure connection information is deleted from the database, the SCTP connection establishment and TLS connection establishment processes are re-executed, new secure connection information is obtained and saved to the database.

[0123] The SCTP-based transport layer secure connection method provided in this application allows for the recovery of the NG link when both the SCTP link and TLS connection are in normal condition; when the SCTP link is in normal condition but the TLS connection is abnormal, the NG link can be recovered by rebuilding the TLS connection; and when the SCTP link is abnormal, both the SCTP connection and TLS connection need to be rebuilt. Different link recovery / reconstruction methods are adopted to recover / rebuild the NG link based on different link status detection results, achieving fast and effective link recovery or reconstruction, and improving communication efficiency and quality.

[0124] In some embodiments, when the SCTP link status is normal and the TLS connection status is normal, restoring the TLS connection includes: Send a client Hello message to the server. The client Hello message carries a Session Ticket and / or a Session ID. The Session Ticket or the Session ID is used to restore the TLS connection.

[0125] Specifically, when both the SCTP link and the TLS connection are in good condition, the TLS connection is restored using either Session ID fast recovery or Session Ticket fast recovery. The client sends a client hello message to the server, which carries the Session Ticket and / or Session ID.

[0126] When the server receives a client Hello message from the client, it determines whether the client Hello message carries a Session Ticket and / or Session ID. If the client Hello message carries a Session Ticket and / or Session ID, it determines whether the carried Session Ticket or Session ID is valid or legal.

[0127] If the client's Hello message carries a Session Ticket and the Session Ticket is valid (the client's Hello message may or may not carry a Session ID), then the TLS connection is restored based on that Session Ticket.

[0128] If the client's Hello message carries a Session Ticket but the Session Ticket is invalid (in this case, the client's Hello message may or may not carry a Session ID), then the TLS connection is rebuilt. This means that the security connection information corresponding to the TLS connection is cleared from the database, the server and client re-perform the TLS handshake and establish a TLS connection, and the new security connection information is saved to the database.

[0129] If the client's Hello message does not carry a Session Ticket but only a Session ID, and the Session ID is valid, then the TLS connection is restored based on the Session ID.

[0130] If the client's Hello message does not carry a Session Ticket but only a Session ID, and the Session ID is invalid, then the TLS connection is rebuilt. This means that the security connection information corresponding to this TLS connection is cleared from the database, the server and client re-perform a TLS handshake and establish a TLS connection, and the new security connection information is saved to the database.

[0131] The above-mentioned TLS fast recovery based on Session Ticket or Session ID is based on the premise that the server supports the fast recovery function. If the server does not support the fast recovery function, a complete TLS handshake process is required to establish a TLS connection.

[0132] The SCTP-based transport layer secure connection method provided in this application embodiment can restore the TLS connection using a fast recovery method based on Session Ticket or Session ID when both the SCTP link state and the TLS connection state are normal. It prioritizes the use of a valid Session Ticket for fast recovery, which can avoid the distributed load balancing problem caused by using Session ID for recovery, thus ensuring the success rate of TLS connection recovery and guaranteeing communication quality.

[0133] The following specific examples further illustrate the SCTP-based transport layer secure connection methods provided in the above embodiments: Example 5: The server-side link recovery / reconstruction process is as follows: Step 1: Check the SCTP link status to determine if a heartbeat timeout or link layer failure triggers an abort message, or if a abort message is received from the peer. If a heartbeat timeout occurs, or an abort message is sent or received, it indicates that the SCTP link status is abnormal or faulty, proceed to Step 2. If no heartbeat timeout occurs and no abort message is sent or received, it indicates that the SCTP link status is normal, proceed to Step 12. Step 2: SCTP link failure, close the current connection, and delete the SCTP connection information corresponding to the application thread from the database; Step 3: Close the TLS connection, release the TLS context, and clear information such as the TLS connection identifier, stream ID, message ID, and thread ID corresponding to the application thread from the database; Step 4: Based on the key parameter configuration, start listening on SCTP port 38512 to listen for messages sent by clients; Step 5: Upon receiving the SCTP association establishment initialization (INIT) message from the client, complete the SCTP four-way handshake with the client to establish the SCTP association; and save the SCTP connection information to the database memory. Step 6: Create a TLS context and associate it with an SCTP socket, and configure the encryption parameters and algorithms supported by the server, such as key exchange algorithms, signature algorithms, fast encryption algorithms, authentication code algorithms, and key stores; Step 7: Based on the static parameter configuration, set the SCTP stream ID to 0, complete the TLS connection handshake with the client, and establish the TLS connection; and save the TLS parameters such as Session ID, Ticket, and key to the database memory; Step 8: The application thread receives the SCTP-encrypted data through the sctp_recvmsg function, decrypts it into a plaintext message using the negotiated TLS parameters; Step 9: The application thread processes the plaintext request message, then organizes the NG link response message, encrypts the message using the negotiated TLS parameters, sets the SCTP stream ID to 1 according to the configuration, and calls the sctp_sendmsg function to send the encrypted data; Step 10: Save the TLS connection identifier, stream ID, message ID, and thread ID corresponding to the application thread to the database; Step 11: NG link established successfully, proceed to message sending and receiving process; Step 12: Check if TLS connection information exists. If not, clear the TLS connection identifier, stream ID, message ID, and thread ID corresponding to the application thread stored in the database, and proceed to step 6. If TLS connection information exists, it means that the TLS connection status is normal, and proceed to step 13. Step 13: If the TLS connection is normal, process the client hello message sent by the client; determine whether the client hello message carries the Session ID and / or Session Ticket parameters; if it does not carry the Session Ticket and only carries the Session ID, proceed to step 17; if it carries the Session Ticket, proceed to step 14. Step 14: Determine if the Session Ticket is valid or legal; if the Session Ticket is valid, proceed to Step 15; if the Session Ticket is invalid, proceed to Step 16. Step 15: If the Session Ticket is valid and the server supports fast recovery based on Session Ticket, execute TLS fast recovery based on Ticket; complete the TLS connection establishment and proceed to the message sending and receiving process; Step 16: If the Session Ticket is invalid or expired, perform the complete TLS handshake process to establish the TLS connection and proceed to the message sending and receiving process; Step 17: Determine if the Session ID is valid. If valid and the server supports fast recovery based on the Session ID, execute TLS fast recovery based on the Session ID, complete the TLS connection establishment, and proceed to the message sending and receiving process. If the Session ID is invalid, proceed to Step 18. Step 18: If the Session ID is empty or invalid, perform the complete TLS handshake process, complete the TLS connection establishment, and proceed to the message sending and receiving process; Step 19: Done. The application begins its normal encrypted message sending and receiving process.

[0134] Example 6: The link recovery / reconstruction process executed by the client is as follows: Step 1: Check the SCTP link status to determine if a heartbeat timeout or link layer failure triggers an abort message, or if a abort message is received from the peer. If a heartbeat timeout occurs, or an abort message is sent or received, it indicates that the SCTP link status is abnormal or faulty, proceed to Step 2. If no heartbeat timeout occurs and no abort message is sent or received, it indicates that the SCTP link status is normal, proceed to Step 10. Step 2: SCTP link failure, close the current connection, delete the SCTP connection information corresponding to the application thread in the database; release and rebuild the TLS context; Step 3: Send the SCTP_INIT handshake message to establish an SCTP association with the server and save the SCTP connection information table to the database; Step 4: Associate the TLS context with the SCTP socket; set the SCTP stream ID to 0, initiate a TLS handshake with the server and complete the TLS connection establishment, and save the TLS parameters such as the Ticket and key to the database; Step 5: The application thread encrypts the NG link establishment request message of the application organization using the negotiated TLS parameters, sets the flow ID to 1, and sends the encrypted data to the other end through the sctp_sendmsg function; Step 6: Save the TLS connection identifier, stream ID, message ID, and thread ID corresponding to the application thread to the database; Step 7: The application thread receives the SCTP-encrypted data through the sctp_recvmsg function, decrypts it into a plaintext message using the negotiated TLS parameters; Step 8: The application thread processes the plaintext message, and the NG link is established; proceed to the message sending and receiving process. Step 9: Check if TLS connection information exists. If not, clear the TLS connection identifier, stream ID, message ID, and thread ID information corresponding to the application thread stored in the database, and proceed to step 4. If TLS connection information exists, it means that the TLS connection status is normal, and proceed to step 10. Step 10: If the TLS connection is in good condition, send a client hello message to the server, and depending on the configuration, select to include a valid Session ID and / or Session Ticket parameter in the client hello message; this allows the server to perform TLS fast recovery based on the valid Session Ticket or valid Session ID, thus completing the TLS connection establishment. Step 11: Done. The application begins the normal encrypted message sending and receiving process.

[0135] The SCTP-based transport layer secure connection method provided in this application establishes a TLS encrypted connection between the client and server, realizing a TLS over SCTP NG link secure communication method. While ensuring application data encryption requirements, it saves message overhead and improves communication efficiency and reliability. Deployment restrictions are minimal, requiring no additional hardware, and compatibility is superior to IPsec. Since TLS primarily performs encryption and decryption operations at the application layer, this application embodiment has minimal impact on network performance. SSL can work through NAT-based firewalls, and this application embodiment inherently supports firewall traversal, allowing for flexible networking. The client requires no maintenance, has low requirements for client equipment, and reduces configuration and operating costs. Furthermore, SCTP control and service messages are processed independently, ensuring reliable and orderly transmission while reducing the impact of TCP head-to-head blocking and improving communication quality. In addition, TLS calls are controlled by the application, allowing encryption control down to the cell or user level, while IPsec encryption only recognizes the network layer (IP packets).

[0136] Figure 3 This is the second flowchart illustrating the SCTP-based transport layer secure connection method provided by the present invention, as shown below. Figure 3 As shown, this invention provides a transport layer secure connection method based on SCTP, the execution entity of which can be a server. The method includes: Step 301: Establish an SCTP connection with the client to obtain the SCTP link.

[0137] Step 302: Establish a TLS connection with the client based on the SCTP link.

[0138] Step 303: Receive the first encrypted data sent by the client through the SCTP link.

[0139] Step 304: Decrypt the first ciphertext data based on the TLS parameters negotiated and determined during the establishment of the TLS connection to obtain the NG link establishment request message.

[0140] Step 305: Generate an NG link establishment response message based on the NG link establishment request message, and encrypt the NG link establishment response message based on the TLS parameters to obtain the second ciphertext data.

[0141] Step 306: Send the second encrypted data to the client based on the SCTP link.

[0142] In some embodiments, establishing an SCTP connection with the client includes: Establish an SCTP connection with the client based on the second configuration information; The second configuration information includes the following: SCTP connection information corresponding to different application threads; the SCTP connection information is the correspondence between the client's SCTP location information and the server's SCTP location information; and / or The second indication information and the SCTP location information of the server are used to indicate that the local end is the server.

[0143] In some embodiments, if the second configuration information contains SCTP connection information corresponding to the application thread, establishing an SCTP connection with the client based on the second configuration information includes: Match the SCTP connection information corresponding to the application thread from the second configuration information; An SCTP connection is established with the client based on the SCTP connection information.

[0144] In some embodiments, if there is no SCTP connection information corresponding to the application thread in the second configuration information, establishing an SCTP connection with the client based on the second configuration information includes: The second SCTP socket is obtained based on the SCTP location information of the server, and the second TLS context is obtained based on the second indication information; An SCTP connection is established with the client based on the second SCTP socket and the second TLS context.

[0145] In some embodiments, establishing a TLS connection with the client based on the SCTP link includes: Based on the SCTP link and the first SCTP stream identifier ID, a TLS connection is established with the client, whereby the first SCTP stream ID indicates that the message type is a TLS handshake message.

[0146] In some embodiments, sending the second encrypted data to the client based on the SCTP link includes: Based on the SCTP link and the second SCTP stream ID, the second encrypted data is sent to the client. The second SCTP stream ID is used to indicate whether the message type is an access request message or an access response message.

[0147] In some embodiments, the method further includes: The secure connection information is saved to the server's database; the secure connection information includes one or more of the following: A TLS connection identifier, which is used to uniquely identify a TLS connection; The second SCTP stream ID is used to indicate whether the message type is an access request message or an access response message. Message ID; Thread ID; SCTP connection information, which is the correspondence between the client's SCTP location information and the server's SCTP location information; TLS parameters.

[0148] In some embodiments, the method further includes: Receive messages from the current application and send request messages; Determine whether the TLS session corresponding to the current application is normal; If the TLS session corresponding to the current application is normal, send encrypted application messages to the client; In the event of an anomaly in the TLS session corresponding to the current application, NG link recovery or reconstruction is performed based on the SCTP link status and / or TLS connection status.

[0149] In some embodiments, when the TLS session corresponding to the current application is normal, sending encrypted application messages to the client includes: If the server's database contains secure connection information corresponding to the application thread of the current application, an encrypted application message is sent to the client based on the SCTP stream ID in the secure connection information corresponding to the application thread of the current application; and / or If the secure connection information corresponding to the application thread of the current application does not exist in the database of the server, an encrypted application message is sent to the client based on the second SCTP stream ID, whereby the second SCTP stream ID is used to indicate whether the message type is an access request message or an access response message.

[0150] In some embodiments, before sending the encrypted application message to the client, the method further includes: Determine whether the length of the encrypted application message exceeds the length of the network's maximum transmission unit; If the length of the encrypted application message exceeds the length of the network's maximum transmission unit, the encrypted application message is fragmented.

[0151] In some embodiments, the method further includes: Receive encrypted application messages sent by the client; Determine whether the TLS session corresponding to the current application is normal; If the TLS session corresponding to the current application is normal, the encrypted application message is decrypted using the TLS parameters corresponding to the TLS session corresponding to the current application. In the event of an anomaly in the TLS session corresponding to the current application, NG link recovery or reconstruction is performed based on the SCTP link status and / or TLS connection status.

[0152] In some embodiments, the NG link recovery or reconstruction based on SCTP link state and / or TLS connection state includes: If the SCTP link status and the TLS connection status are normal, the TLS connection will be restored. If the SCTP link is in normal condition but the TLS connection is in abnormal condition, re-establish the TLS connection with the client on the SCTP link. In the event of an abnormal SCTP link status, re-establish the SCTP connection and TLS connection with the client.

[0153] In some embodiments, when the SCTP link status is normal and the TLS connection status is normal, restoring the TLS connection includes: Receive the client Hello message sent by the client, and determine whether the client Hello message carries a Session Ticket and / or Session ID; If the client Hello message carries a Session Ticket and / or Session ID, determine whether the carried Session Ticket or Session ID is valid. If the client's Hello message carries a Session Ticket and the Session Ticket is valid, the TLS connection is restored based on the Session Ticket. If the client's Hello message carries a Session Ticket and the Session Ticket is invalid, a new TLS connection will be established. If the client's Hello message only carries the Session ID and the Session ID is valid, the TLS connection is restored based on the Session ID; If the client's Hello message only carries the Session ID and the Session ID is invalid, the TLS connection will be re-established.

[0154] In some embodiments, if the TLS session corresponding to the current application is abnormal, the method further includes: Detect SCTP link status and / or TLS connection status.

[0155] In some embodiments, detecting the SCTP link status includes: Determine whether the SCTP link has experienced a heartbeat timeout, or whether a disconnect abort message has been sent to the client, or whether an abort message has been received from the client; If a heartbeat timeout occurs on the SCTP link, or if an abort message has been sent to the client or received from the client, the state of the SCTP link is determined to be abnormal. If no heartbeat timeout occurs on the SCTP link, no abort message is sent to the client, and no abort message is received from the client, the SCTP link is considered to be in normal condition.

[0156] In some embodiments, detecting the TLS connection state includes: Determine whether TLS connection information exists, wherein the TLS connection information includes the server certificate of the server. If the TLS connection information is not present, the TLS connection status is determined to be abnormal. If the TLS connection information exists, the TLS connection status is determined to be normal.

[0157] Specifically, the SCTP-based transport layer secure connection method provided by the present invention can refer to the above-described embodiment of the SCTP-based transport layer secure connection method with the client as the execution subject, and can achieve the same technical effect. Here, the parts and beneficial effects that are the same as those in the corresponding method embodiments described above will not be described in detail.

[0158] Figure 4 This is a schematic diagram of the structure of a client device provided by the present invention, such as... Figure 4 As shown, the terminal includes a memory 403, a transceiver 401, and a processor 402, wherein: The memory 403 is used to store computer programs; the transceiver 401 is used to send and receive data under the control of the processor 402; the processor 402 is used to read the computer program in the memory 403 and perform the following operations: Establish a Flow Control Transport Protocol (SCTP) connection with the server to obtain an SCTP link; Based on the SCTP link, a transport layer secure TLS connection is established with the server; The next-generation NG link establishment request message is encrypted based on the TLS parameters negotiated and determined during the establishment of the TLS connection to obtain the first ciphertext data, and the first ciphertext data is sent to the server based on the SCTP link; The system receives the second encrypted data sent by the server and decrypts the second encrypted data using the TLS parameters to obtain the NG link establishment response message.

[0159] Among them, Figure 4 In this context, the bus architecture can include any number of interconnected buses and bridges, specifically linking various circuits together, represented by one or more processors (processor 402) and memory (memory 403). The bus architecture can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. The transceiver 401 can be multiple elements, including transmitters and receivers, providing a unit for communicating with various other devices over transmission media, including wireless channels, wired channels, optical fibers, etc. The processor 402 is responsible for managing the bus architecture and general processing, and the memory 403 can store data used by the processor 402 during operation.

[0160] In some embodiments, the processor 402 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a complex programmable logic device (CPLD), and the processor may also adopt a multi-core architecture.

[0161] The processor executes any of the methods described in the embodiments of this application according to the obtained executable instructions by calling a computer program stored in memory. The processor and memory may also be physically separated.

[0162] In some embodiments, establishing an SCTP connection with the server includes: Establish an SCTP connection with the server based on the first configuration information; The first configuration information includes the following: SCTP connection information corresponding to different application threads; the SCTP connection information is the correspondence between the client's SCTP location information and the server's SCTP location information; and / or The first indication information and the SCTP location information of the client, wherein the first indication information is used to indicate that the local end is a client.

[0163] In some embodiments, if SCTP connection information corresponding to the application thread exists in the first configuration information, establishing an SCTP connection with the server based on the first configuration information includes: Match the SCTP connection information corresponding to the application thread from the first configuration information; An SCTP connection is established with the server based on the SCTP connection information.

[0164] In some embodiments, if there is no SCTP connection information corresponding to the application thread in the first configuration information, establishing an SCTP connection with the server based on the first configuration information includes: The first SCTP socket is obtained based on the client's SCTP location information, and the first TLS context is obtained based on the first indication information; An SCTP connection is established with the server based on the first SCTP socket and the first TLS context.

[0165] In some embodiments, establishing a Transport Layer Security (TLS) connection with the server based on the SCTP link includes: Based on the SCTP link and the first SCTP stream identifier ID, a TLS connection is established with the server, whereby the first SCTP stream ID is used to indicate that the message type is a TLS handshake message.

[0166] In some embodiments, sending the first encrypted data to the server based on the SCTP link includes: Based on the SCTP link and the second SCTP stream ID, the first encrypted data is sent to the server. The second SCTP stream ID is used to indicate whether the message type is an access request message or an access response message.

[0167] In some embodiments, the method further includes: The secure connection information is saved to the client's database; the secure connection information includes one or more of the following: A TLS connection identifier, which is used to uniquely identify a TLS connection; The second SCTP stream ID is used to indicate whether the message type is an access request message or an access response message. Message ID; Thread ID; SCTP connection information, which is the correspondence between the client's SCTP location information and the server's SCTP location information; TLS parameters.

[0168] In some embodiments, the method further includes: Receive messages from the current application and send request messages; Determine whether the TLS session corresponding to the current application is normal; If the TLS session corresponding to the current application is normal, send encrypted application messages to the server; In the event of an anomaly in the TLS session corresponding to the current application, NG link recovery or reconstruction is performed based on the SCTP link status and / or TLS connection status.

[0169] In some embodiments, when the TLS session corresponding to the current application is normal, sending the encrypted application message to the server includes: If the client's database contains secure connection information corresponding to the application thread of the current application, an encrypted application message is sent to the server based on the SCTP stream ID in the secure connection information corresponding to the application thread of the current application; and / or If the secure connection information corresponding to the application thread of the current application does not exist in the database of the client, an encrypted application message is sent to the server based on the second SCTP stream ID, which is used to indicate whether the message type is an access request message or an access response message.

[0170] In some embodiments, before sending the encrypted application message to the server, the method further includes: Determine whether the length of the encrypted application message exceeds the length of the network's maximum transmission unit; If the length of the encrypted application message exceeds the length of the network's maximum transmission unit, the encrypted application message is fragmented.

[0171] In some embodiments, the method further includes: Receive encrypted data sent by the server; Determine whether the TLS session corresponding to the current application is normal; If the TLS session corresponding to the current application is normal, the encrypted data is decrypted using the TLS parameters corresponding to the TLS session corresponding to the current application. In the event of an anomaly in the TLS session corresponding to the current application, NG link recovery or reconstruction is performed based on the SCTP link status and / or TLS connection status.

[0172] In some embodiments, the NG link recovery or reconstruction based on SCTP link state and / or TLS connection state includes: If the SCTP link status and the TLS connection status are normal, the TLS connection will be restored. If the SCTP link is in normal condition but the TLS connection is in abnormal condition, re-establish the TLS connection with the server on the SCTP link. In the event of an abnormal SCTP link status, re-establish the SCTP connection and TLS connection with the server.

[0173] In some embodiments, when the SCTP link status is normal and the TLS connection status is normal, restoring the TLS connection includes: Send a client Hello message to the server. The client Hello message carries a Session Ticket and / or a Session ID. The Session Ticket or the Session ID is used to restore the TLS connection.

[0174] In some embodiments, if the TLS session corresponding to the current application is abnormal, the method further includes: Detect SCTP link status and / or TLS connection status.

[0175] In some embodiments, detecting the SCTP link status includes: Determine whether the SCTP link has experienced a heartbeat timeout, or whether a disconnect abort message has been sent to the server, or whether an abort message has been received from the server; If a heartbeat timeout occurs on the SCTP link, or if an abort message has been sent to the server or received from the server, the state of the SCTP link is determined to be abnormal. If no heartbeat timeout occurs on the SCTP link, and no abort message is sent to or received from the server, the SCTP link is considered to be in normal condition.

[0176] In some embodiments, detecting the TLS connection state includes: Determine whether TLS connection information exists, wherein the TLS connection information includes the server certificate of the server. If the TLS connection information is not present, the TLS connection status is determined to be abnormal. If the TLS connection information exists, the TLS connection status is determined to be normal.

[0177] It should be noted that the client provided by the present invention can implement all the method steps implemented by the method embodiment with the client as the execution subject, and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiment and the beneficial effects will not be described in detail.

[0178] Figure 5 This is a schematic diagram of the structure of a server-side device provided by the present invention, as shown below. Figure 5 As shown, the server includes a memory 503, a transceiver 501, and a processor 502, wherein: The memory 503 is used to store computer programs; the transceiver 501 is used to send and receive data under the control of the processor 502; the processor 502 is used to read the computer program in the memory 503 and perform the following operations: Establish an SCTP connection with the client to obtain the SCTP link; Based on the SCTP link, a TLS connection is established with the client; Receive the first encrypted data sent by the client through the SCTP link; Based on the TLS parameters negotiated and determined during the establishment of the TLS connection, the first ciphertext data is decrypted to obtain the NG link establishment request message; An NG link establishment response message is generated based on the NG link establishment request message, and the NG link establishment response message is encrypted based on the TLS parameters to obtain the second ciphertext data; The second encrypted data is sent to the client via the SCTP link.

[0179] Among them, Figure 5 In this context, the bus architecture can include any number of interconnected buses and bridges, specifically linking various circuits together, represented by one or more processors (processor 502) and memory (memory 503). The bus architecture can also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. The transceiver 501 can be multiple elements, including transmitters and receivers, providing a unit for communicating with various other devices over transmission media, including wireless channels, wired channels, optical fibers, etc. The processor 502 is responsible for managing the bus architecture and general processing, and the memory 503 can store data used by the processor 502 during operation.

[0180] The processor 502 can be a central processing unit, an application-specific integrated circuit, a field-programmable gate array, or a complex programmable logic device. The processor can also adopt a multi-core architecture.

[0181] In some embodiments, establishing an SCTP connection with the client includes: Establish an SCTP connection with the client based on the second configuration information; The second configuration information includes the following: SCTP connection information corresponding to different application threads; the SCTP connection information is the correspondence between the client's SCTP location information and the server's SCTP location information; and / or The second indication information and the SCTP location information of the server are used to indicate that the local end is the server.

[0182] In some embodiments, if the second configuration information contains SCTP connection information corresponding to the application thread, establishing an SCTP connection with the client based on the second configuration information includes: Match the SCTP connection information corresponding to the application thread from the second configuration information; An SCTP connection is established with the client based on the SCTP connection information.

[0183] In some embodiments, if there is no SCTP connection information corresponding to the application thread in the second configuration information, establishing an SCTP connection with the client based on the second configuration information includes: The second SCTP socket is obtained based on the SCTP location information of the server, and the second TLS context is obtained based on the second indication information; An SCTP connection is established with the client based on the second SCTP socket and the second TLS context.

[0184] In some embodiments, establishing a TLS connection with the client based on the SCTP link includes: Based on the SCTP link and the first SCTP stream identifier ID, a TLS connection is established with the client, whereby the first SCTP stream ID indicates that the message type is a TLS handshake message.

[0185] In some embodiments, sending the second encrypted data to the client based on the SCTP link includes: Based on the SCTP link and the second SCTP stream ID, the second encrypted data is sent to the client. The second SCTP stream ID is used to indicate whether the message type is an access request message or an access response message.

[0186] In some embodiments, the method further includes: The secure connection information is saved to the server's database; the secure connection information includes one or more of the following: A TLS connection identifier, which is used to uniquely identify a TLS connection; The second SCTP stream ID is used to indicate whether the message type is an access request message or an access response message. Message ID; Thread ID; SCTP connection information, which is the correspondence between the client's SCTP location information and the server's SCTP location information; TLS parameters.

[0187] In some embodiments, the method further includes: Receive messages from the current application and send request messages; Determine whether the TLS session corresponding to the current application is normal; If the TLS session corresponding to the current application is normal, send encrypted application messages to the client; In the event of an anomaly in the TLS session corresponding to the current application, NG link recovery or reconstruction is performed based on the SCTP link status and / or TLS connection status.

[0188] In some embodiments, when the TLS session corresponding to the current application is normal, sending encrypted application messages to the client includes: If the server's database contains secure connection information corresponding to the application thread of the current application, an encrypted application message is sent to the client based on the SCTP stream ID in the secure connection information corresponding to the application thread of the current application; and / or If the secure connection information corresponding to the application thread of the current application does not exist in the database of the server, an encrypted application message is sent to the client based on the second SCTP stream ID, whereby the second SCTP stream ID is used to indicate whether the message type is an access request message or an access response message.

[0189] In some embodiments, before sending the encrypted application message to the client, the method further includes: Determine whether the length of the encrypted application message exceeds the length of the network's maximum transmission unit; If the length of the encrypted application message exceeds the length of the network's maximum transmission unit, the encrypted application message is fragmented.

[0190] In some embodiments, the method further includes: Receive encrypted application messages sent by the client; Determine whether the TLS session corresponding to the current application is normal; If the TLS session corresponding to the current application is normal, the encrypted application message is decrypted using the TLS parameters corresponding to the TLS session corresponding to the current application. In the event of an anomaly in the TLS session corresponding to the current application, NG link recovery or reconstruction is performed based on the SCTP link status and / or TLS connection status.

[0191] In some embodiments, the NG link recovery or reconstruction based on SCTP link state and / or TLS connection state includes: If the SCTP link status and the TLS connection status are normal, the TLS connection will be restored. If the SCTP link is in normal condition but the TLS connection is in abnormal condition, re-establish the TLS connection with the client on the SCTP link. In the event of an abnormal SCTP link status, re-establish the SCTP connection and TLS connection with the client.

[0192] In some embodiments, when the SCTP link status is normal and the TLS connection status is normal, restoring the TLS connection includes: Receive the client Hello message sent by the client, and determine whether the client Hello message carries a Session Ticket and / or Session ID; If the client Hello message carries a Session Ticket and / or Session ID, determine whether the carried Session Ticket or Session ID is valid. If the client's Hello message carries a Session Ticket and the Session Ticket is valid, the TLS connection is restored based on the Session Ticket. If the client's Hello message carries a Session Ticket and the Session Ticket is invalid, a new TLS connection will be established. If the client's Hello message only carries the Session ID and the Session ID is valid, the TLS connection is restored based on the Session ID; If the client's Hello message only carries the Session ID and the Session ID is invalid, the TLS connection will be re-established.

[0193] In some embodiments, if the TLS session corresponding to the current application is abnormal, the method further includes: Detect SCTP link status and / or TLS connection status.

[0194] In some embodiments, detecting the SCTP link status includes: Determine whether the SCTP link has experienced a heartbeat timeout, or whether a disconnect abort message has been sent to the client, or whether an abort message has been received from the client; If a heartbeat timeout occurs on the SCTP link, or if an abort message has been sent to the client or received from the client, the state of the SCTP link is determined to be abnormal. If no heartbeat timeout occurs on the SCTP link, no abort message is sent to the client, and no abort message is received from the client, the SCTP link is considered to be in normal condition.

[0195] In some embodiments, detecting the TLS connection state includes: Determine whether TLS connection information exists, wherein the TLS connection information includes the server certificate of the server. If the TLS connection information is not present, the TLS connection status is determined to be abnormal. If the TLS connection information exists, the TLS connection status is determined to be normal.

[0196] Specifically, the server provided by the present invention can implement all the method steps implemented by the method embodiment with the execution subject as the server, and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiment and the beneficial effects will not be described in detail.

[0197] Figure 6 This is one of the structural schematic diagrams of the SCTP-based transport layer secure connection device provided by the present invention, such as... Figure 6 As shown, the present invention provides a transport layer secure connection device based on SCTP, which is applied to a client. The device includes a first connection module 601, a second connection module 602, a first sending module 603, and a first receiving module 604.

[0198] The first connection module 601 is used to establish a Flow Control Transmission Protocol (SCTP) connection with the server to obtain an SCTP link.

[0199] The second connection module 602 is used to establish a Transport Layer Security (TLS) connection with the server based on the SCTP link.

[0200] The first sending module 603 is used to encrypt the next-generation NG link establishment request message based on the TLS parameters negotiated and determined during the establishment of the TLS connection, to obtain first ciphertext data, and to send the first ciphertext data to the server based on the SCTP link.

[0201] The first receiving module 604 is used to receive the second encrypted data sent by the server, and decrypt the second encrypted data using the TLS parameters to obtain the NG link establishment response message.

[0202] In some embodiments, the first connection module includes: The first connection submodule is used to establish an SCTP connection with the server based on the first configuration information; The first configuration information includes the following: SCTP connection information corresponding to different application threads; the SCTP connection information is the correspondence between the client's SCTP location information and the server's SCTP location information; and / or The first indication information and the SCTP location information of the client, wherein the first indication information is used to indicate that the local end is a client.

[0203] In some embodiments, the first connection submodule includes: The first matching unit is used to match the SCTP connection information corresponding to the application thread from the first configuration information; The first connection unit is used to establish an SCTP connection with the server based on the SCTP connection information.

[0204] In some embodiments, the first connection submodule includes: The first acquisition unit is configured to acquire a first SCTP socket based on the client's SCTP location information and acquire a first TLS context based on the first indication information. The second connection unit is used to establish an SCTP connection with the server based on the first SCTP socket and the first TLS context.

[0205] In some embodiments, the second connection module includes: The second connection submodule is used to establish a TLS connection with the server based on the SCTP link and the first SCTP stream identifier ID, wherein the first SCTP stream ID is used to indicate that the message type is a TLS handshake message.

[0206] In some embodiments, the first transmitting module includes: The first sending submodule is used to send the first encrypted data to the server based on the SCTP link and the second SCTP stream ID, wherein the second SCTP stream ID is used to indicate whether the message type is an access request message or an access response message.

[0207] In some embodiments, it also includes: The first storage module is used to save secure connection information to the client's database; the secure connection information includes one or more of the following: A TLS connection identifier, which is used to uniquely identify a TLS connection; The second SCTP stream ID is used to indicate whether the message type is an access request message or an access response message. Message ID; Thread ID; SCTP connection information, which is the correspondence between the client's SCTP location information and the server's SCTP location information; TLS parameters.

[0208] In some embodiments, it also includes: The third receiving module is used to receive message sending request messages from the current application. The first judgment module is used to determine whether the TLS session corresponding to the current application is normal; The third sending module is used to send encrypted application messages to the server when the TLS session corresponding to the current application is normal. The first link recovery and reconstruction module is used to perform NG link recovery or reconstruction based on SCTP link status and / or TLS connection status in the event of an anomaly in the TLS session corresponding to the current application.

[0209] In some embodiments, the third sending module includes: The second sending submodule is configured to, if the client's database contains secure connection information corresponding to the application thread of the current application, send an encrypted application message to the server based on the SCTP stream ID in the secure connection information corresponding to the application thread of the current application; and / or The third sending submodule is used to send an encrypted application message to the server based on a second SCTP stream ID when the secure connection information corresponding to the application thread of the current application does not exist in the database of the client. The second SCTP stream ID is used to indicate whether the message type is an access request message or an access response message.

[0210] In some embodiments, it also includes: The second judgment module is used to determine whether the length of the encrypted application message exceeds the length of the network maximum transmission unit. The first message fragmentation module is used to fragment the encrypted application message when the length of the encrypted application message exceeds the length of the network's maximum transmission unit.

[0211] In some embodiments, it also includes: The fourth receiving module is used to receive encrypted data sent by the server; The third judgment module is used to determine whether the TLS session corresponding to the current application is normal; The second decryption module is used to decrypt the encrypted data using the TLS parameters corresponding to the TLS session of the current application, provided that the TLS session corresponding to the current application is normal. The second link recovery and reconstruction module is used to perform NG link recovery or reconstruction based on SCTP link status and / or TLS connection status in the event of an anomaly in the TLS session corresponding to the current application.

[0212] In some embodiments, the first link recovery and reconstruction module or the second link recovery and reconstruction module includes: The third connection submodule is used to restore the TLS connection when the SCTP link status is normal and the TLS connection status is normal. The fourth connection submodule is used to re-establish a TLS connection with the server on the SCTP link when the SCTP link is in normal condition but the TLS connection is in abnormal condition. The fifth connection submodule is used to re-establish the SCTP connection and TLS connection with the server in the event of an abnormal SCTP link status.

[0213] In some embodiments, the third connection submodule includes: A sending unit is used to send a client Hello message to the server. The client Hello message carries a Session Ticket and / or a Session ID, which is used to restore the TLS connection.

[0214] In some embodiments, it also includes: The first detection module is used to detect the SCTP link status and / or TLS connection status.

[0215] In some embodiments, the first detection module includes: The first judgment submodule is used to determine whether the SCTP link has experienced a heartbeat timeout, or whether a disconnect abort message has been sent to the server, or whether an abort message has been received from the server. The first determination submodule is used to determine that the SCTP link is in an abnormal state when a heartbeat timeout occurs on the SCTP link, or when an abort message has been sent to the server or received from the server. The second determination submodule is used to determine that the SCTP link is in normal status when no heartbeat timeout occurs on the SCTP link, no abort message is sent to the server, and no abort message is received from the server.

[0216] In some embodiments, the first detection module includes: The second judgment submodule is used to determine whether TLS connection information exists, wherein the TLS connection information includes the server certificate of the server. The third determining submodule is used to determine that the TLS connection status is abnormal if the TLS connection information is not available. The fourth determination submodule is used to determine that the TLS connection status is normal when the TLS connection information exists.

[0217] Specifically, the SCTP-based transport layer secure connection device provided by the present invention can implement all the method steps implemented in the above-mentioned SCTP-based transport layer secure connection method embodiment with the client as the execution subject, and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiment and the beneficial effects will not be described in detail.

[0218] Figure 7 This is the second schematic diagram of the SCTP-based transport layer secure connection device provided by the present invention, as shown below. Figure 7 As shown, the present invention provides a transport layer secure connection device based on SCTP, which is applied to the server side. The device includes a third connection module 701, a fourth connection module 702, a second receiving module 703, a first decryption module 704, a first encryption module 705, and a second sending module 1306.

[0219] The third connection module 701 is used to establish an SCTP connection with the client to obtain an SCTP link; The fourth connection module 702 is used to establish a TLS connection with the client based on the SCTP link; The second receiving module 703 is used to receive the first encrypted data sent by the client through the SCTP link; The first decryption module 704 is used to decrypt the first ciphertext data based on the TLS parameters negotiated and determined during the establishment of the TLS connection, and obtain the NG link establishment request message; The first encryption module 705 is used to generate an NG link establishment response message based on the NG link establishment request message, and encrypt the NG link establishment response message based on the TLS parameters to obtain the second ciphertext data; The second sending module 706 is used to send the second encrypted data to the client based on the SCTP link.

[0220] In some embodiments, the third connection module includes: The sixth connection submodule is used to establish an SCTP connection with the client based on the second configuration information; The second configuration information includes the following: SCTP connection information corresponding to different application threads; the SCTP connection information is the correspondence between the client's SCTP location information and the server's SCTP location information; and / or The second indication information and the SCTP location information of the server are used to indicate that the local end is the server.

[0221] In some embodiments, the sixth connection submodule includes: The second matching unit is used to match the SCTP connection information corresponding to the application thread from the second configuration information; The first acquisition unit is used to establish an SCTP connection with the client based on the SCTP connection information.

[0222] In some embodiments, the sixth connection submodule includes: The second acquisition unit is used to acquire a second SCTP socket based on the SCTP location information of the server, and to acquire a second TLS context based on the second indication information; The third connection unit is used to establish an SCTP connection with the client based on the second SCTP socket and the second TLS context.

[0223] In some embodiments, the fourth connection module includes: The seventh connection submodule is used to establish a TLS connection with the client based on the SCTP link and the first SCTP stream identifier ID, wherein the first SCTP stream ID is used to indicate that the message type is a TLS handshake message.

[0224] In some embodiments, the second transmitting module includes: The fourth sending submodule is used to send the second encrypted data to the client based on the SCTP link and the second SCTP stream ID, wherein the second SCTP stream ID is used to indicate whether the message type is an access request message or an access response message.

[0225] In some embodiments, it also includes: The second storage module is used to save the secure connection information to the server's database; the secure connection information includes one or more of the following: A TLS connection identifier, which is used to uniquely identify a TLS connection; The second SCTP stream ID is used to indicate whether the message type is an access request message or an access response message. Message ID; Thread ID; SCTP connection information, which is the correspondence between the client's SCTP location information and the server's SCTP location information; TLS parameters.

[0226] In some embodiments, it also includes: The fifth receiving module is used to receive message sending request messages from the current application; The fourth judgment module is used to determine whether the TLS session corresponding to the current application is normal; The fourth sending module is used to send encrypted application messages to the client when the TLS session corresponding to the current application is normal. The third link recovery and reconstruction module is used to perform NG link recovery or reconstruction based on SCTP link status and / or TLS connection status in the event of an anomaly in the TLS session corresponding to the current application.

[0227] In some embodiments, the fourth transmitting module includes: The fifth sending submodule is configured to, when the secure connection information corresponding to the application thread of the current application exists in the database on the server side, send an encrypted application message to the client based on the SCTP stream ID in the secure connection information corresponding to the application thread of the current application; and / or The sixth sending submodule is used to send an encrypted application message to the client based on a second SCTP stream ID when the secure connection information corresponding to the application thread of the current application does not exist in the database of the server. The second SCTP stream ID is used to indicate whether the message type is an access request message or an access response message.

[0228] In some embodiments, it also includes: The fifth judgment module is used to determine whether the length of the encrypted application message exceeds the length of the network's maximum transmission unit. The second message fragmentation module is used to fragment the encrypted application message when the length of the encrypted application message exceeds the length of the network's maximum transmission unit.

[0229] In some embodiments, it also includes: The sixth receiving module is used to receive encrypted application messages sent by the client; The sixth judgment module is used to determine whether the TLS session corresponding to the current application is normal; The third decryption module is used to decrypt the encrypted application message using the TLS parameters corresponding to the TLS session corresponding to the current application, provided that the TLS session corresponding to the current application is normal. The fourth link recovery and reconstruction module is used to perform NG link recovery or reconstruction based on SCTP link status and / or TLS connection status in the event of an anomaly in the TLS session corresponding to the current application.

[0230] In some embodiments, the third link recovery and reconstruction module or the fourth link recovery and reconstruction module includes: The eighth connection submodule is used to restore the TLS connection when the SCTP link status is normal and the TLS connection status is normal. The ninth connection submodule is used to re-establish a TLS connection with the client on the SCTP link when the SCTP link is in normal condition but the TLS connection is in abnormal condition. The tenth connection submodule is used to re-establish the SCTP connection and TLS connection with the client in the event of an abnormal SCTP link status.

[0231] In some embodiments, the eighth connection submodule includes: The first judgment unit is used to receive the client Hello message sent by the client and determine whether the client Hello message carries a Session Ticket and / or Session ID. The second judgment unit is used to determine whether the Session Ticket or Session ID carried in the client Hello message is valid. The fourth connection unit is used to restore the TLS connection based on the Session Ticket if the Session Ticket is carried in the client's Hello message and the Session Ticket is valid. The fifth connection unit is used to re-establish a TLS connection when the client's Hello message carries a Session Ticket and the Session Ticket is invalid; The sixth connection unit is used to restore the TLS connection based on the Session ID if the client's Hello message only carries the Session ID and the Session ID is valid; The seventh connection unit is used to re-establish a TLS connection when the client's Hello message only carries a Session ID and the Session ID is invalid.

[0232] In some embodiments, it also includes: The second detection module is used to detect the SCTP link status and / or TLS connection status.

[0233] In some embodiments, the second detection module includes: The third judgment submodule is used to determine whether the SCTP link has experienced a heartbeat timeout, or whether a disconnect abort message has been sent to the client, or whether an abort message has been received from the client. The fifth determination submodule is used to determine that the SCTP link is in an abnormal state when a heartbeat timeout occurs on the SCTP link, or when an abort message has been sent to the client or received from the client. The sixth determination submodule is used to determine that the SCTP link is in normal status when no heartbeat timeout occurs on the SCTP link, no abort message is sent to the client, and no abort message is received from the client.

[0234] In some embodiments, the second detection module includes: The fourth judgment submodule is used to determine whether TLS connection information exists, wherein the TLS connection information includes the server certificate of the server. The seventh determination submodule is used to determine that the TLS connection status is abnormal when the TLS connection information is not available. The eighth determination submodule is used to determine that the TLS connection status is normal when the TLS connection information exists.

[0235] Specifically, the SCTP-based transport layer secure connection device provided by the present invention can implement all the method steps implemented in the above-mentioned SCTP-based transport layer secure connection method embodiment with the server as the execution subject, and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiment and the beneficial effects will not be described in detail.

[0236] It should be noted that the division of units / modules in the above embodiments of the present invention is illustrative and only represents one logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated units described above can be implemented in hardware or as software functional units.

[0237] In some embodiments, a processor-readable storage medium is also provided, which stores a computer program for causing a computer to execute the SCTP-based transport layer secure connection method provided in the above-described method embodiments.

[0238] Specifically, the processor-readable storage medium provided by the present invention can implement all the method steps implemented in the above method embodiments and achieve the same technical effect. Here, the parts that are the same as those in the method embodiments and the beneficial effects will not be described in detail.

[0239] In some embodiments, a non-transitory readable storage medium is also provided, which stores a computer program for causing a computer to execute the SCTP-based transport layer secure connection method provided in the above method embodiments.

[0240] Specifically, the non-transitory readable storage medium provided by the present invention can implement all the method steps implemented in the above method embodiments and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiments and the beneficial effects will not be described in detail.

[0241] In some embodiments, a computer-readable storage medium is also provided, the computer-readable storage medium storing a computer program for causing a computer to execute the SCTP-based transport layer secure connection method provided in the above method embodiments.

[0242] Specifically, the computer-readable storage medium provided by the present invention can implement all the method steps implemented in the above method embodiments and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiments and the beneficial effects will not be described in detail.

[0243] It should be noted that the computer-readable storage medium can be any available medium or data storage device that the processor can access, including but not limited to magnetic storage (e.g., floppy disk, hard disk, magnetic tape, magneto-optical disk (MO)), optical storage (e.g., CD, DVD, BD, HVD), and semiconductor storage (e.g., ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)).

[0244] In some embodiments, a computer program product is also provided, the computer program product including a computer program that can be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer is able to execute the SCTP-based transport layer secure connection method provided in the above method embodiments.

[0245] Specifically, the computer program product provided in this application embodiment can implement all the method steps implemented in the above method embodiments and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiments and the beneficial effects will not be described in detail.

[0246] It should also be noted that the terms "first," "second," etc., used in this invention are used to distinguish similar objects, not to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that embodiments of the invention can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of the same class, without limiting the number of objects; for example, the first object can be one or more.

[0247] In this invention, the term "and / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0248] In this invention, the term "multiple" refers to two or more, and other quantifiers are similar.

[0249] In this invention, "determining B based on A" means that factor A must be considered when determining B. It is not limited to "B can be determined based solely on A," but should also include: "determining B based on A and C," "determining B based on A, C, and E," "determining C based on A, and further determining B based on C," etc. Additionally, it can include using A as a condition for determining B, for example, "when A satisfies the first condition, B is determined using the first method"; or "when A satisfies the second condition, B is determined," etc.; or "when A satisfies the third condition, B is determined based on the first parameter," etc. Of course, it can also be a condition where A is a factor in determining B, for example, "when A satisfies the first condition, C is determined using the first method, and B is further determined based on C," etc.

[0250] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0251] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-executable instructions. These computer-executable instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0252] These processor-executable instructions may also be stored in a processor-readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the processor-readable memory produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0253] These processors can execute instructions that can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable device for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0254] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A transport layer secure connection method based on SCTP, characterized in that, Applied to a client, the method includes: Establish a Flow Control Transport Protocol (SCTP) connection with the server to obtain an SCTP link; Based on the SCTP link, a transport layer secure TLS connection is established with the server; The next-generation NG link establishment request message is encrypted based on the TLS parameters negotiated and determined during the establishment of the TLS connection to obtain the first ciphertext data, and the first ciphertext data is sent to the server based on the SCTP link; The system receives the second encrypted data sent by the server and decrypts the second encrypted data using the TLS parameters to obtain the NG link establishment response message.

2. The SCTP-based transport layer secure connection method according to claim 1, characterized in that, Establishing an SCTP connection with the server includes: Establish an SCTP connection with the server based on the first configuration information; The first configuration information includes the following: SCTP connection information corresponding to different application threads, wherein the SCTP connection information is the correspondence between the client's SCTP location information and the server's SCTP location information; and / or The first indication information and the SCTP location information of the client, wherein the first indication information is used to indicate that the local end is a client.

3. The SCTP-based transport layer secure connection method according to claim 2, characterized in that, If the first configuration information contains SCTP connection information corresponding to the application thread, establishing an SCTP connection with the server based on the first configuration information includes: Match the SCTP connection information corresponding to the application thread from the first configuration information; An SCTP connection is established with the server based on the SCTP connection information.

4. The SCTP-based transport layer secure connection method according to claim 2, characterized in that, If no SCTP connection information corresponding to the application thread exists in the first configuration information, establishing an SCTP connection with the server based on the first configuration information includes: The first SCTP socket is obtained based on the client's SCTP location information, and the first TLS context is obtained based on the first indication information; An SCTP connection is established with the server based on the first SCTP socket and the first TLS context.

5. The SCTP-based transport layer secure connection method according to claim 1, characterized in that, The step of establishing a Transport Layer Security (TLS) connection with the server based on the SCTP link includes: Based on the SCTP link and the first SCTP stream identifier ID, a TLS connection is established with the server, whereby the first SCTP stream ID is used to indicate that the message type is a TLS handshake message.

6. The SCTP-based transport layer secure connection method according to claim 1, characterized in that, Sending the first encrypted data to the server based on the SCTP link includes: Based on the SCTP link and the second SCTP stream ID, the first encrypted data is sent to the server. The second SCTP stream ID is used to indicate whether the message type is an access request message or an access response message.

7. The SCTP-based transport layer secure connection method according to claim 1, characterized in that, The method further includes: The secure connection information is saved to the client's database; the secure connection information includes one or more of the following: A TLS connection identifier, which is used to uniquely identify a TLS connection; The second SCTP stream ID is used to indicate whether the message type is an access request message or an access response message. Message ID; Thread ID; SCTP connection information, which is the correspondence between the client's SCTP location information and the server's SCTP location information; TLS parameters.

8. The SCTP-based transport layer secure connection method according to claim 1, characterized in that, The method further includes: Receive messages from the current application and send request messages; Determine whether the TLS session corresponding to the current application is normal; If the TLS session corresponding to the current application is normal, send encrypted application messages to the server; In the event of an anomaly in the TLS session corresponding to the current application, NG link recovery or reconstruction is performed based on the SCTP link status and / or TLS connection status.

9. The SCTP-based transport layer secure connection method according to claim 8, characterized in that, If the TLS session corresponding to the current application is normal, sending the encrypted application message to the server includes: If the client's database contains secure connection information corresponding to the application thread of the current application, an encrypted application message is sent to the server based on the SCTP stream ID in the secure connection information corresponding to the application thread of the current application; and / or If the secure connection information corresponding to the application thread of the current application does not exist in the database of the client, an encrypted application message is sent to the server based on the second SCTP stream ID, which is used to indicate whether the message type is an access request message or an access response message.

10. The SCTP-based transport layer secure connection method according to claim 8, characterized in that, Before sending the encrypted application message to the server, the method further includes: Determine whether the length of the encrypted application message exceeds the length of the network's maximum transmission unit; If the length of the encrypted application message exceeds the length of the network's maximum transmission unit, the encrypted application message is fragmented.

11. The SCTP-based transport layer secure connection method according to claim 8, characterized in that, The method further includes: Receive encrypted data sent by the server; Determine whether the TLS session corresponding to the current application is normal; If the TLS session corresponding to the current application is normal, the encrypted data is decrypted using the TLS parameters corresponding to the TLS session corresponding to the current application. In the event of an anomaly in the TLS session corresponding to the current application, NG link recovery or reconstruction is performed based on the SCTP link status and / or TLS connection status.

12. The SCTP-based transport layer secure connection method according to claim 8 or 11, characterized in that, The NG link recovery or reconstruction based on SCTP link state and / or TLS connection state includes: If the SCTP link status and the TLS connection status are normal, the TLS connection will be restored. If the SCTP link is in normal condition but the TLS connection is in abnormal condition, re-establish the TLS connection with the server on the SCTP link. In the event of an abnormal SCTP link status, re-establish the SCTP connection and TLS connection with the server.

13. The SCTP-based transport layer secure connection method according to claim 12, characterized in that, When the SCTP link status and the TLS connection status are normal, restoring the TLS connection includes: Send a client Hello message to the server. The client Hello message carries a Session Ticket and / or a Session ID. The Session Ticket or the Session ID is used to restore the TLS connection.

14. The SCTP-based transport layer secure connection method according to claim 8 or 11, characterized in that, In the event of an anomaly in the TLS session corresponding to the current application, the method further includes: Detect SCTP link status and / or TLS connection status.

15. The SCTP-based transport layer secure connection method according to claim 14, characterized in that, The detection of SCTP link status includes: Determine whether the SCTP link has experienced a heartbeat timeout, or whether a disconnect abort message has been sent to the server, or whether an abort message has been received from the server; If a heartbeat timeout occurs on the SCTP link, or if an abort message has been sent to the server or received from the server, the state of the SCTP link is determined to be abnormal. If no heartbeat timeout occurs on the SCTP link, and no abort message is sent to or received from the server, the SCTP link is considered to be in normal condition.

16. The SCTP-based transport layer secure connection method according to claim 14, characterized in that, Detecting the TLS connection state includes: Determine whether TLS connection information exists, wherein the TLS connection information includes the server certificate of the server. If the TLS connection information is not present, the TLS connection status is determined to be abnormal. If the TLS connection information exists, the TLS connection status is determined to be normal.

17. A transport layer secure connection method based on SCTP, characterized in that, Applied to the server side, the method includes: Establish an SCTP connection with the client to obtain the SCTP link; Based on the SCTP link, a TLS connection is established with the client; Receive the first encrypted data sent by the client through the SCTP link; Based on the TLS parameters negotiated and determined during the establishment of the TLS connection, the first ciphertext data is decrypted to obtain the NG link establishment request message; An NG link establishment response message is generated based on the NG link establishment request message, and the NG link establishment response message is encrypted based on the TLS parameters to obtain the second ciphertext data; The second encrypted data is sent to the client via the SCTP link.

18. The SCTP-based transport layer secure connection method according to claim 17, characterized in that, Establishing an SCTP connection with the client includes: Establish an SCTP connection with the client based on the second configuration information; The second configuration information includes the following: SCTP connection information corresponding to different application threads; the SCTP connection information is the correspondence between the client's SCTP location information and the server's SCTP location information; and / or The second indication information and the SCTP location information of the server are used to indicate that the local end is the server.

19. The SCTP-based transport layer secure connection method according to claim 18, characterized in that, If the second configuration information contains SCTP connection information corresponding to the application thread, establishing an SCTP connection with the client based on the second configuration information includes: Match the SCTP connection information corresponding to the application thread from the second configuration information; An SCTP connection is established with the client based on the SCTP connection information.

20. The SCTP-based transport layer secure connection method according to claim 18, characterized in that, If no SCTP connection information corresponding to the application thread exists in the second configuration information, establishing an SCTP connection with the client based on the second configuration information includes: The second SCTP socket is obtained based on the SCTP location information of the server, and the second TLS context is obtained based on the second indication information; An SCTP connection is established with the client based on the second SCTP socket and the second TLS context.

21. The SCTP-based transport layer secure connection method according to claim 17, characterized in that, The step of establishing a TLS connection with the client based on the SCTP link includes: Based on the SCTP link and the first SCTP stream identifier ID, a TLS connection is established with the client, whereby the first SCTP stream ID indicates that the message type is a TLS handshake message.

22. The SCTP-based transport layer secure connection method according to claim 17, characterized in that, Sending the second encrypted data to the client based on the SCTP link includes: Based on the SCTP link and the second SCTP stream ID, the second encrypted data is sent to the client. The second SCTP stream ID is used to indicate whether the message type is an access request message or an access response message.

23. The SCTP-based transport layer secure connection method according to claim 17, characterized in that, The method further includes: The secure connection information is saved to the server's database; the secure connection information includes one or more of the following: A TLS connection identifier, which is used to uniquely identify a TLS connection; The second SCTP stream ID is used to indicate whether the message type is an access request message or an access response message. Message ID; Thread ID; SCTP connection information, which is the correspondence between the client's SCTP location information and the server's SCTP location information; TLS parameters.

24. The SCTP-based transport layer secure connection method according to claim 17, characterized in that, The method further includes: Receive messages from the current application and send request messages; Determine whether the TLS session corresponding to the current application is normal; If the TLS session corresponding to the current application is normal, send encrypted application messages to the client; In the event of an anomaly in the TLS session corresponding to the current application, NG link recovery or reconstruction is performed based on the SCTP link status and / or TLS connection status.

25. The SCTP-based transport layer secure connection method according to claim 24, characterized in that, If the TLS session corresponding to the current application is normal, sending the encrypted application message to the client includes: If the server's database contains secure connection information corresponding to the application thread of the current application, an encrypted application message is sent to the client based on the SCTP stream ID in the secure connection information corresponding to the application thread of the current application; and / or If the secure connection information corresponding to the application thread of the current application does not exist in the database of the server, an encrypted application message is sent to the client based on the second SCTP stream ID, whereby the second SCTP stream ID is used to indicate whether the message type is an access request message or an access response message.

26. The SCTP-based transport layer secure connection method according to claim 24, characterized in that, Before sending the encrypted application message to the client, the method further includes: Determine whether the length of the encrypted application message exceeds the length of the network's maximum transmission unit; If the length of the encrypted application message exceeds the length of the network's maximum transmission unit, the encrypted application message is fragmented.

27. The SCTP-based transport layer secure connection method according to claim 24, characterized in that, The method further includes: Receive encrypted application messages sent by the client; Determine whether the TLS session corresponding to the current application is normal; If the TLS session corresponding to the current application is normal, the encrypted application message is decrypted using the TLS parameters corresponding to the TLS session corresponding to the current application. In the event of an anomaly in the TLS session corresponding to the current application, NG link recovery or reconstruction is performed based on the SCTP link status and / or TLS connection status.

28. The SCTP-based transport layer secure connection method according to claim 24 or 27, characterized in that, The NG link recovery or reconstruction based on SCTP link state and / or TLS connection state includes: If the SCTP link status and the TLS connection status are normal, the TLS connection will be restored. If the SCTP link is in normal condition but the TLS connection is in abnormal condition, re-establish the TLS connection with the client on the SCTP link. In the event of an abnormal SCTP link status, re-establish the SCTP connection and TLS connection with the client.

29. The SCTP-based transport layer secure connection method according to claim 28, characterized in that, When the SCTP link status and the TLS connection status are normal, restoring the TLS connection includes: Receive the client Hello message sent by the client, and determine whether the client Hello message carries a Session Ticket and / or Session ID; If the client Hello message carries a Session Ticket and / or Session ID, determine whether the carried Session Ticket or Session ID is valid. If the client's Hello message carries a Session Ticket and the Session Ticket is valid, the TLS connection is restored based on the Session Ticket. If the client's Hello message carries a Session Ticket and the Session Ticket is invalid, a new TLS connection will be established. If the client's Hello message only carries the Session ID and the Session ID is valid, the TLS connection is restored based on the Session ID; If the client's Hello message only carries the Session ID and the Session ID is invalid, the TLS connection will be re-established.

30. The SCTP-based transport layer secure connection method according to claim 24 or 27, characterized in that, In the event of an anomaly in the TLS session corresponding to the current application, the method further includes: Detect SCTP link status and / or TLS connection status.

31. The SCTP-based transport layer secure connection method according to claim 30, characterized in that, The detection of SCTP link status includes: Determine whether the SCTP link has experienced a heartbeat timeout, or whether a disconnect abort message has been sent to the client, or whether an abort message has been received from the client; If a heartbeat timeout occurs on the SCTP link, or if an abort message has been sent to the client or received from the client, the state of the SCTP link is determined to be abnormal. If no heartbeat timeout occurs on the SCTP link, no abort message is sent to the client, and no abort message is received from the client, the SCTP link is considered to be in normal condition.

32. The SCTP-based transport layer secure connection method according to claim 30, characterized in that, Detecting the TLS connection state includes: Determine whether TLS connection information exists, wherein the TLS connection information includes the server certificate of the server. If the TLS connection information is not present, the TLS connection status is determined to be abnormal. If the TLS connection information exists, the TLS connection status is determined to be normal.

33. A client device, characterized in that, Includes memory, transceiver, and processor; Memory, used to store computer programs; Transceiver, used to send and receive data under the control of the processor; A processor for reading a computer program from the memory, wherein the processor executes the computer program to implement the SCTP-based transport layer secure connection method as described in any one of claims 1 to 16.

34. A server-side device, characterized in that, Includes memory, transceiver, and processor; Memory, used to store computer programs; Transceiver, used to send and receive data under the control of the processor; A processor for reading a computer program from the memory, wherein the processor executes the computer program to implement the SCTP-based transport layer secure connection method as described in any one of claims 17 to 32.

35. A transport layer secure connection device based on SCTP, characterized in that, Applied to the client side, including: The first connection module is used to establish a Flow Control Transport Protocol (SCTP) connection with the server to obtain an SCTP link. The second connection module is used to establish a transport layer secure TLS connection with the server based on the SCTP link; The first sending module is used to encrypt the next-generation NG link establishment request message based on the TLS parameters negotiated and determined during the establishment of the TLS connection, obtain the first ciphertext data, and send the first ciphertext data to the server based on the SCTP link; The first receiving module is used to receive the second encrypted data sent by the server, and decrypt the second encrypted data using the TLS parameters to obtain the NG link establishment response message.

36. A transport layer secure connection device based on SCTP, characterized in that, Applied to the server side, including: The third connection module is used to establish an SCTP connection with the client and obtain the SCTP link; The fourth connection module is used to establish a TLS connection with the client based on the SCTP link; The second receiving module is used to receive the first encrypted data sent by the client through the SCTP link; The first decryption module is used to decrypt the first ciphertext data based on the TLS parameters negotiated and determined during the establishment of the TLS connection, and obtain the NG link establishment request message; The first encryption module is used to generate an NG link establishment response message based on the NG link establishment request message, and encrypt the NG link establishment response message based on the TLS parameters to obtain the second ciphertext data; The second sending module is used to send the second encrypted data to the client based on the SCTP link.

37. A processor-readable storage medium, characterized in that, The processor-readable storage medium stores a computer program that, when executed by the processor, implements the SCTP-based transport layer secure connection method as described in any one of claims 1 to 16 or the SCTP-based transport layer secure connection method as described in any one of claims 17 to 32.

Images