Browser-based user datagram protocol single packet authorization method and apparatus

Abstract

The application provides a browser-based user datagram protocol single packet authorization method and device, the method comprises the following steps: obtaining each browser data, SM2 private key and temporary token sent by a server, and generating a device unique identification code; constructing signature information and encrypted information, and generating an SM4 symmetric key of a current session by using a key derivation algorithm; encrypting the encrypted information by using an SM4-GCM authentication encryption mode to generate SM4 ciphertext and an authentication tag; signing the signature information by using the SM2 private key to obtain a signature value; splicing and packaging in a preset order to obtain a user datagram protocol authentication single packet, and sending the user datagram protocol authentication single packet to a preset authentication port of the server to enable the server to verify the user datagram protocol authentication single packet; if it is determined that the server verification is successful, a service port of the current session authorized and established by the server is accessed to perform service communication. The application can effectively solve the problems of key management difficulty, vulnerability to replay attacks and inability to be strongly bound with a browser in the existing single packet authorization technology.

Description

Technical Field

[0001] This application relates to the field of network security, and in particular to a browser-based User Datagram Protocol (UDP) packet authorization method and device. Background Technology

[0002] Port access control, as an enhanced network security solution, is widely used in various scenarios in the network security field. However, existing technologies have significant limitations: First, single-packet authorization environments are constrained. Existing SPA (Single Packet Authorization) technologies typically rely on dedicated clients or operating system kernels, making them difficult to adapt to browser sandbox environments. Furthermore, their pre-shared key-based mechanism cannot support stateless, multi-user web scenarios. Second, browser fingerprinting technology is currently mostly used for user tracking or risk control, without deep integration with cryptographic key systems. Simple hash value comparison is vulnerable to replay attacks, failing to achieve the high security requirement of authentication equals authorization. Third, UDP-based authentication schemes often struggle to balance efficiency and security. Multiple handshakes violate the lightweight nature of UDP, while simple port knocking is susceptible to IP spoofing attacks.

[0003] Therefore, there is an urgent need for a method that can fully utilize the characteristics of the browser environment to achieve high-strength single-packet authorization based on UDP without relying on pre-installed client software, in order to solve the problems of difficult key management, vulnerability to replay attacks, and inability to be strongly bound to the browser in traditional SPA technology. Summary of the Invention

[0004] In view of this, embodiments of this application provide a browser-based User Datagram Protocol (UDP) single packet authorization method and device to eliminate or improve one or more defects existing in the prior art.

[0005] The first aspect of this application provides a browser-based User Datagram Protocol (UDP) packet authorization method, executed by a client, the method comprising: Obtain data from each browser, SM2 private key, and temporary token sent by the server; generate a unique device identifier based on the data from each browser. Based on the device's unique identifier and the temporary token, signature information and encryption information are constructed, and a key derivation algorithm is used to generate the SM4 symmetric key for the current session. The encrypted information is encrypted using the SM4-GCM authentication encryption mode based on the SM4 symmetric key to generate SM4 ciphertext and authentication tag, and the signature information is signed using the SM2 private key to obtain a signature value; The signature value, the SM4 ciphertext, and the authentication tag are concatenated and encapsulated in a preset order to obtain a User Datagram Protocol (UDP) authentication packet. The UDP authentication packet is then sent to a preset authentication port on the server so that the server can verify the UDP authentication packet. If the server verification is successful, the service port of the current session authorized and established by the server is accessed for business communication.

[0006] In some embodiments of this application, the browser data includes: Screen resolution information, browser type information, version number information, operating system platform information, font list information, time zone information, rendering information, and hardware information of the browser client.

[0007] In some embodiments of this application, generating a device unique identifier based on the browser data includes: The feature vector is obtained by concatenating data from various browsers in a preset order. The feature vector is normalized and the hash value of the feature vector is calculated using the SM3 algorithm; The unique identifier of the device is obtained.

[0008] In some embodiments of this application, the method of using the SM2 private key to sign the signature information to obtain a signature value includes: The hash value of the signature information is calculated using the SM3 algorithm; wherein, the signature information includes the device unique identifier, the temporary token, the target resource identifier, and the timestamp; The hash value is signed using the SM2 private key to obtain a signature value.

[0009] In some embodiments of this application, the step of encrypting the encrypted information using the SM4-GCM authentication encryption mode based on the SM4 symmetric key to generate SM4 ciphertext and authentication tag includes: An encrypted random number for the authentication encryption mode is generated based on the device's unique identifier. The encrypted information is encrypted using the SM4-GCM authentication encryption mode based on the SM4 symmetric key to generate SM4 ciphertext and authentication tag; wherein, the encrypted information includes the device unique identifier, the temporary token, the hash value of the target resource identifier and the timestamp, and the hash value of the target resource identifier is calculated using the SM3 algorithm.

[0010] In some embodiments of this application, the User Datagram Protocol Authentication Single Packet includes: The system includes a version number field, a payload length field, the signature value, an encrypted random number, additional authentication data, the SM4 ciphertext, and the authentication tag; wherein the additional authentication data includes a target resource identifier and a timestamp.

[0011] In some embodiments of this application, it also includes: Obtain the SM2 public key corresponding to the SM2 private key, and send the SM2 public key to the server.

[0012] A second aspect of this application provides a browser-based User Datagram Protocol (UDP) single packet authorization method, executed by a server, the method comprising: Obtain the User Datagram Protocol Authentication Packet (UDP Authentication Packet) and SM2 public key sent by the client; verify the target port, payload length, and timestamp of the UDP Authentication Packet; the UDP Authentication Packet is generated by the client according to the browser-based UDP Authentication Packet authorization method described in the first aspect. The User Datagram Protocol (UDP) authentication packet is parsed to obtain a signature value, an encrypted random number, additional authentication data, SM4 ciphertext, and an authentication tag. The signature value is verified using the SM2 public key to obtain signature information. The target resource identifier, timestamp, and device unique identifier are extracted from the signature information. Based on the device unique identifier and a locally stored temporary token, a key derivation algorithm is used to generate an SM4 symmetric key for the current session. The SM4 ciphertext is decrypted using the SM4-GCM authentication encryption mode based on the encrypted random number and the SM4 symmetric key to obtain encrypted information and verify the authentication tag. The target resource identifier, timestamp, and device unique identifier in the encrypted information are checked to see if they are consistent with the target resource identifier, timestamp, and device unique identifier in the signature information. If the signature verification, decryption verification, and consistency verification all pass, the service port corresponding to the target resource identifier is determined according to the security policy, a port mapping with a preset open time is created, and session information is recorded. If a session timeout or anomaly is detected, the port is closed, the port mapping is deleted, and the session information is cleared. The session information includes a session identifier, the device's unique identifier, the client's IP address, the target resource identifier, the service port identifier, the start time, and a preset opening time.

[0013] A third aspect of this application provides a browser-based User Datagram Protocol (UDP) packet authorization system, set on the server side, including: A lightweight verification module is used to obtain the User Datagram Protocol Authentication Packet and SM2 public key sent by the client; and to verify the target port, payload length, and timestamp of the User Datagram Protocol Authentication Packet; the User Datagram Protocol Authentication Packet is generated by the client according to the browser-based User Datagram Protocol Authentication Packet authorization method described in the first aspect. The stealth authorization module is used to parse the User Datagram Protocol (UDP) authentication packet to obtain a signature value, an encrypted random number, additional authentication data, SM4 ciphertext, and an authentication tag. It verifies the signature value using the SM2 public key to obtain signature information; extracts the target resource identifier, timestamp, and device unique identifier from the signature information; generates an SM4 symmetric key for the current session based on the device unique identifier and a locally stored temporary token using a key derivation algorithm; decrypts the SM4 ciphertext using the SM4-GCM authentication encryption mode based on the encrypted random number and the SM4 symmetric key to obtain encrypted information and verify the authentication tag; verifies whether the target resource identifier, timestamp, and device unique identifier in the encrypted information are consistent with those in the signature information; if the signature verification, decryption verification, and consistency verification all pass, it determines the service port corresponding to the target resource identifier according to the security policy, creates a port mapping with a preset open time, and records session information. The dynamic session cleanup module is used to close the port, delete the port mapping, and clean up the session information if a session timeout or abnormality is detected. The session information includes a session identifier, the device's unique identifier, the client's IP address, the target resource identifier, the service port identifier, the start time, and a preset opening time.

[0014] A fourth aspect of this application provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the browser-based User Datagram Protocol (UDP) single packet authorization method.

[0015] A fifth aspect of this application provides a computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the browser-based User Datagram Protocol (UDP) single-packet authorization method described above.

[0016] The sixth aspect of this application provides a computer program product comprising a computer program that, when executed by a processor, implements the browser-based User Datagram Protocol (UDP) packet authorization method and device.

[0017] This application provides a browser-based User Datagram Protocol (UDP) single-packet authorization method. The method includes: acquiring browser data, an SM2 private key, and a temporary token sent by the server; generating a unique device identifier based on the browser data; constructing signature information and encryption information based on the unique device identifier and the temporary token, and generating an SM4 symmetric key for the current session using a key derivation algorithm; encrypting the encryption information using the SM4-GCM authentication encryption mode based on the SM4 symmetric key to generate SM4 ciphertext and an authentication tag; signing the signature information using the SM2 private key to obtain a signature value; concatenating and encapsulating the signature value, the SM4 ciphertext, and the authentication tag in a preset order to obtain a UDP authentication single packet; sending the UDP authentication single packet to a preset authentication port on the server to allow the server to verify the UDP authentication single packet; if the server verification is successful, accessing the service port of the current session authorized and established by the server to perform business communication. By designing a dynamic key derivation mechanism based on a unique device identifier and a temporary token, and employing national commercial cryptography (SM series) algorithms to enhance anti-replay and anti-forgery capabilities, this approach avoids the server-side long-term storage of a large number of session keys, reducing key management complexity and leakage risks. Furthermore, it adopts an integrated encryption and authentication payload protection mechanism using the SM4-GCM authentication encryption mode to achieve data confidentiality and integrity authentication, thereby improving overall security. The approach also designs an architecture mechanism that decouples server-side lightweight front-end verification from core verification, decoupling simple filtering from complex cryptographic operations. This allows most invalid or abnormal requests to be discarded directly at the edge, significantly reducing the load on the backend hidden authorization module, improving overall system throughput, and enhancing resistance to denial-of-service attacks. Simultaneously, this method significantly improves port protection security, device binding accuracy, and system scalability while maintaining lightweightness and flexibility, making it adaptable to various emerging network security scenarios such as edge computing and the Internet of Things.

[0018] Additional advantages, objectives, and features of this application will be set forth in part in the description which follows, and will in part become apparent to those skilled in the art upon review of the following description, or may be learned by practice of the application. The objectives and other advantages of this application can be realized and obtained by means of the structures specifically pointed out in the specification and drawings.

[0019] Those skilled in the art will understand that the purposes and advantages that can be achieved with this application are not limited to those specifically described above, and that the above and other purposes that this application can achieve will be more clearly understood from the following detailed description. Attached Figure Description

[0020] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, do not constitute a limitation thereof. The components in the drawings are not drawn to scale but are merely for illustrating the principles of this application. For ease of illustration and description of certain parts of this application, corresponding portions in the drawings may be enlarged, i.e., may appear larger relative to other components in an exemplary device actually manufactured according to this application. In the drawings: Figure 1 This is a flowchart illustrating a browser-based first user datagram protocol single packet authorization method according to an embodiment of this application.

[0021] Figure 2 This is a flowchart illustrating a browser-based second user datagram protocol single packet authorization method according to an embodiment of this application.

[0022] Figure 3 This is a schematic diagram of the architecture of the browser-based User Datagram Protocol (UDP) single packet authorization method in an application example of this application.

[0023] Figure 4 This is a flowchart illustrating the browser-based User Datagram Protocol (UDP) packet authorization method in an application example of this application. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and their descriptions are used to explain this application, but are not intended to limit it.

[0025] It should also be noted that, in order to avoid obscuring this application with unnecessary details, only the structures and / or processing steps closely related to the scheme according to this application are shown in the accompanying drawings, while other details that are not closely related to this application are omitted.

[0026] It should be emphasized that the term "including / comprises" as used herein refers to the presence of a feature, element, step, or component, but does not exclude the presence or addition of one or more other features, elements, steps, or components.

[0027] It should also be noted that, unless otherwise specified, the term "connection" in this article can refer not only to a direct connection, but also to an indirect connection involving an intermediary.

[0028] In the following description, embodiments of the present application will be illustrated with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar parts, or the same or similar steps.

[0029] Currently, existing port access control technologies mainly suffer from the following problems: Environmental limitations of traditional SPA technology: Existing Single Packet Authorization (SPA) technologies typically run at the operating system kernel level or in dedicated client tools, requiring the generation of specific HMAC packets. However, with the proliferation of web applications, users prefer to access them through browsers. Browser sandboxing mechanisms limit the ability to directly send raw UDP packets, and existing SPA technologies often rely on pre-shared keys (PSKs), making it difficult to implement large-scale key management in stateless, multi-user web scenarios.

[0030] Limitations of browser fingerprinting: In current technologies, browser fingerprinting (Canvas fingerprinting, hardware features, etc.) is only used for user tracking or risk control and is not deeply integrated with cryptographic key systems. Simply comparing fingerprint hash values ​​is vulnerable to replay attacks (attackers can intercept and reuse the fingerprint hash), and it cannot meet the high security requirement of "authentication equals authorization".

[0031] There is a contradiction between the efficiency and security of UDP authentication: UDP is connectionless and unreliable, and performing complex authentication (such as multiple handshakes) directly at the UDP layer violates the lightweight nature of UDP; while overly simple authentication (such as only verifying port knocking) is vulnerable to IP spoofing attacks.

[0032] Therefore, to address the problems of key management difficulties, susceptibility to replay attacks, and inability to strongly bind with browsers in existing single-packet authorization technologies, embodiments of this application provide a browser-based first User Datagram Protocol (UDP) single-packet authorization method, a browser-based second UDP single-packet authorization method, a browser-based UDP single-packet authorization system, an electronic device, a computer-readable storage medium, and a computer program product, respectively, to improve the anti-replay and anti-forgery capabilities of single-packet authorization methods, thereby enhancing the security of port protection, the accuracy of device binding, and the scalability of the system.

[0033] The following examples will provide a detailed description.

[0034] Based on this, embodiments of this application provide a browser-based first User Datagram Protocol (UDP) single packet authorization method executable by a client, see [link to relevant documentation]. Figure 1 The method specifically includes the following: Step 100: Obtain the data from each browser, the SM2 private key, and the temporary token sent by the server, and generate a unique device identifier based on the data from each browser.

[0035] Specifically, the SM2 private key and the temporary token sent by the server are obtained. The token's length ranges from 128 to 256 bits and can be generated using the system's pseudo-random number function. The unique device identifier, Device_ID, is obtained based on system and operating environment characteristics that can be collected by the browser. Detailed implementation methods will be described in subsequent embodiments.

[0036] Step 200: Construct signature information and encryption information based on the device's unique identifier and the temporary token, and generate the SM4 symmetric key for the current session using a key derivation algorithm.

[0037] Specifically, the authentication metadata signature information and encryption information are constructed. The key derivation algorithm uses the SM3 national cryptographic algorithm to obtain KEK (128 bits), which is used as the SM4 symmetric key for the current session.

[0038] Step 300: Based on the SM4 symmetric key, encrypt the encrypted information using the SM4-GCM authentication encryption mode to generate SM4 ciphertext and authentication tag, and use the SM2 private key to sign the signature information to obtain a signature value.

[0039] It should be noted that the SM4-GCM authentication encryption mode is used, with KEK (i.e., SM4 symmetric key) as the key to encrypt the information, and the client's SM2 private key is used for signing to obtain the signature value. The specific implementation methods of encryption and signing will be described in detail in subsequent embodiments.

[0040] Step 400: Based on the signature value, the SM4 ciphertext, and the authentication tag, they are concatenated and encapsulated in a preset order to obtain a User Datagram Protocol (UDP) authentication packet, and the UDP authentication packet is sent to a preset authentication port on the server so that the server can verify the UDP authentication packet.

[0041] It is understood that the various pieces of information are concatenated and encapsulated in a preset order to obtain a User Datagram Protocol (UDP) authentication packet. This authentication packet is then sent to the server for verification. The specific implementation method of the verification will be described in detail in subsequent embodiments.

[0042] Step 500: If the server verification is successful, access the business port of the current session authorized and established by the server to conduct business communication.

[0043] It should also be noted that once the client confirms that the server has received and successfully verified the authentication packet, the client can then communicate with the server through the corresponding authorized port and for reverse business operations. During communication, the server dynamically verifies the environment; if an environment anomaly is detected, the session ends. The specific implementation details of the server will be provided in subsequent embodiments.

[0044] As described above, the browser-based First User Datagram Protocol (FAP) single-packet authorization method provided in this application employs a dynamic key derivation mechanism based on a unique device identifier and a temporary token. It utilizes national commercial cryptography (SM series) algorithms to enhance anti-replay and anti-forgery capabilities, while avoiding long-term storage of large amounts of session keys on the server side, thus reducing key management complexity and leakage risks. Furthermore, it adopts an integrated encryption and authentication payload protection mechanism using the SM4-GCM authentication encryption mode to achieve data confidentiality and integrity authentication, thereby improving overall security. The method also designs an architecture mechanism that decouples lightweight server-side pre-verification from core verification, decoupling simple filtering from complex cryptographic operations. This allows most invalid or abnormal requests to be discarded directly at the edge, significantly reducing the load on the backend hidden authorization module, improving overall system throughput, and enhancing resistance to denial-of-service attacks. Simultaneously, this method significantly improves port protection security, device binding accuracy, and system scalability while maintaining lightweight design and flexibility, making it adaptable to various emerging network security scenarios such as edge computing and the Internet of Things.

[0045] To further enhance the anti-replay and anti-spoofing capabilities of the single-packet authorization method, thereby improving port protection security, device binding accuracy, and system scalability, in a browser-based first user datagram protocol single-packet authorization method provided in this application embodiment, in step 100, each of the browser data specifically includes the following content: Screen resolution information, browser type information, version number information, operating system platform information, font list information, time zone information, rendering information, and hardware information of the browser client. Specifically, the browser uses JavaScript to collect 20-dimensional feature vectors, including screen resolution, Canvas rendering differences, WebGL (Web Graphics Library) information, and time zone. JavaScript is a client-side scripting language, and Canvas is one of the core technologies of HTML5, accommodating all UI elements to draw various graphics. The collected feature set includes the following: Display-related: Screen resolution (width × height), available resolution, color depth; Browser / Platform Related: Browser type, version number, operating system platform, user agent string, time zone offset, language settings; Rendering-related: Canvas fingerprint (obtaining pixel values ​​by drawing specific graphics on a Canvas element), WebGL fingerprint (using WebGL renderer information and behavioral characteristics), font list enumeration results; Hardware-related information includes: number of CPU cores (partial information obtainable through the browser's Application Programming Interface (API)), device memory size (e.g., navigator.deviceMemory), touch support, browser process memory usage, battery percentage, and charging status.

[0046] To further enhance the anti-replay and anti-spoofing capabilities of the single-packet authorization method, thereby improving port protection security, device binding accuracy, and system scalability, in a browser-based first user datagram protocol single-packet authorization method provided in this application embodiment, step 100, which generates a unique device identifier based on each browser data, specifically includes the following: Step 110: Concatenate the data from each browser in a preset order to obtain the feature vector.

[0047] Step 120: Normalize the feature vector and calculate the hash value of the feature vector using the SM3 algorithm.

[0048] Step 130: Obtain the unique identifier of the device.

[0049] Specifically, each of the above features is converted into a string or numerical representation, and then concatenated into a feature vector in a preset order. The feature vector F is normalized, for example, by uniformly using UTF-8 encoding and adding delimiters between fields. Its hash value is then calculated using the SM3 algorithm to obtain a 256-bit unique device identifier. .

[0050] To further enhance the replay and forgery resistance of single-packet authorization methods, thereby improving port protection security, device binding accuracy, and system scalability, in a browser-based First User Datagram Protocol (First User Datagram Protocol) single-packet authorization method provided in this application embodiment, step 300, which involves signing the signature information using the SM2 private key to obtain a signature value, specifically includes the following: Step 310: Calculate the hash value of the signature information using the SM3 algorithm; wherein the signature information includes the device unique identifier, the temporary token, the target resource identifier, and the timestamp.

[0051] Step 320: Sign the hash value using the SM2 private key to obtain a signature value.

[0052] Specifically, the signature information formula is as follows: .in, Represents a timestamp. Indicates the target resource identifier. This represents the device's unique identifier. This indicates a temporary token.

[0053] To further enhance the replay and forgery resistance of single-packet authorization methods, thereby improving port protection security, device binding accuracy, and system scalability, in a browser-based First User Datagram Protocol (First User Datagram Protocol) single-packet authorization method provided in this application embodiment, step 300, which involves encrypting the encrypted information using the SM4-GCM authentication encryption mode based on the SM4 symmetric key to generate SM4 ciphertext and authentication tag, specifically includes the following: Step 330: Generate an encrypted random number for the authentication encryption mode based on the device's unique identifier; Step 340: Based on the SM4 symmetric key, encrypt the encrypted information using the SM4-GCM authentication encryption mode to generate SM4 ciphertext and authentication tag; wherein, the encrypted information includes the device unique identifier, the temporary token, the hash value of the target resource identifier, and a timestamp, and the hash value of the target resource identifier is calculated using the SM3 algorithm.

[0054] Specifically, the formula for encrypting information is: .in, Represents a timestamp. The hash value representing the target resource identifier and , This represents the device's unique identifier. This indicates a temporary token.

[0055] To further enhance the anti-replay and anti-spoofing capabilities of the single-packet authorization method, thereby improving port protection security, device binding accuracy, and system scalability, in a browser-based first User Datagram Protocol (UDP) single-packet authorization method provided in this application embodiment, step 100 of the UDP authentication single packet specifically includes the following content: The system includes a version number field, a payload length field, the signature value, an encrypted random number, additional authentication data, the SM4 ciphertext, and the authentication tag; wherein the additional authentication data includes a target resource identifier and a timestamp.

[0056] Specifically, the UDP payload includes the following fields in order: Version and Length fields (optional, for future expansion, e.g., byte version number ver, byte payload length len_payload), SM2 Signature field (length: output according to the SM2 standard; function: to ensure the integrity and non-repudiation of the signature information), SM4-GCM Encrypted Random Number field Nonce (length: 96 bits, i.e., 12 bytes), SM4-GCM Additional Authentication Data (AAD) (content: includes the hash value of the target resource URI, timestamp, etc.; length: variable length, the AAD length can be indicated by a field at the beginning of the packet), SM4-GCM Ciphertext field (content: the output after encrypting M_enc; length: variable length), and SM4-GCM Tag field (length: usually 128 bits, i.e., 16 bytes). See Table 1 below.

[0057] Table 1 UDP Packet Structure To further enhance the anti-replay and anti-spoofing capabilities of the single-packet authorization method, thereby improving port protection security, device binding accuracy, and system scalability, the browser-based first user datagram protocol single-packet authorization method provided in this application embodiment includes the following content before step 100: Step 010: Obtain the SM2 public key corresponding to the SM2 private key, and send the SM2 public key to the server.

[0058] Specifically, before performing single-packet authentication, the client and server share a signature key for offline configuration.

[0059] Based on the above embodiments and / or application examples of the browser-based first User Datagram Protocol (UDP) single packet authorization method, this application also provides an embodiment of a browser-based second UDP single packet authorization method executable by a server, see [link to embodiment]. Figure 2 The browser-based second user datagram protocol single packet authorization method specifically includes the following: Step 001: Obtain the User Datagram Protocol Authentication Packet and SM2 public key sent by the client; verify the target port, payload length, and timestamp of the User Datagram Protocol Authentication Packet; the User Datagram Protocol Authentication Packet is generated by the client according to the browser-based first User Datagram Protocol Packet authorization method.

[0060] Specifically, this step involves pre-filtering by the server-side lightweight verification module. It checks whether the destination port is an authentication port, whether the payload length is within a preset range, and extracts the timestamp from the signature value or additional authentication data, checking if it is within a time window. If any condition is not met, the packet is discarded; if all conditions are met, it is forwarded to the invisible authorization authentication module.

[0061] Step 002: Parse the User Datagram Protocol (UDP) authentication packet to obtain the signature value, encrypted random number, additional authentication data, SM4 ciphertext, and authentication tag. Verify the signature value using the SM2 public key to obtain signature information. Extract the target resource identifier, timestamp, and device unique identifier from the signature information. Based on the device unique identifier and a locally stored temporary token, generate the SM4 symmetric key for the current session using a key derivation algorithm. Decrypt the SM4 ciphertext using the SM4-GCM authentication encryption mode based on the encrypted random number and the SM4 symmetric key to obtain encrypted information and verify the authentication tag. Verify whether the target resource identifier, timestamp, and device unique identifier in the encrypted information are consistent with those in the signature information. If the signature verification, decryption verification, and consistency verification all pass, determine the service port corresponding to the target resource identifier according to the security policy, create a port mapping with a preset open time, and record the session information.

[0062] It should also be noted that this step performs core verification for the server-side stealth authorization module: signature verification, decryption tag verification, and consistency verification. If any verification fails, the single packet is discarded. Security policies may include identity and terminal trust policies, UDP single packet authorization (SPA) security policies, key derivation and password management policies, access control and authorization policies, and auditing and monitoring policies. Identity and endpoint trust policies form the first line of defense, aiming to ensure who is accessing the service and whether the access environment is secure. This includes multi-factor authentication mechanisms (factors are optional) and fingerprint trust assessment (20 dimensions to choose from). UDP Single Packet Authorization (SPA) security policies are the core, designed to ensure the security of the access process itself and resist various network attacks. This includes packet structure (packet structure depth), integrity protection (signature algorithm selection), and service stealth (port and URL). Key derivation and cryptographic management policies are the cornerstone of security, aiming to provide secure key protection for SPA authentication and session encryption. This includes a hierarchical key system (algorithm selection) and secure derivation and use (derivation algorithm selection). Access control and authorization policies are the core of decision-making, aiming to determine which resources can be accessed based on security levels. This includes access control and the principle of least privilege. Auditing and monitoring policies are implemented throughout the entire process, aiming to achieve full traceability and anomaly detection. This includes full-process auditing and real-time monitoring and alerting.

[0063] Step 003: If a session timeout or anomaly is detected, the port is closed, the port mapping is deleted, and the session information is cleared; wherein, the session information includes the session identifier, the device unique identifier, the client's IP, the target resource identifier, the service port identifier, the start time, and the preset opening time.

[0064] Specifically, this step involves the server-side dynamic session cleanup module. First, it determines the business port to enable port mapping, allowing clients to access the service during open hours. For each session, if the current session time exceeds the open hours or abnormal behavior is detected in the browser, the corresponding port mapping is deleted, session records are cleaned up, and audit logs are recorded.

[0065] As can be seen from the above description, the browser-based user datagram protocol single packet authorization system provided in this application embodiment can decouple simple filtering from complex cryptographic operations, causing most invalid or abnormal requests to be directly discarded at the edge, significantly reducing the load on the backend hidden authorization module, improving the overall system throughput and enhancing the ability to resist denial-of-service attacks; at the same time, it can also significantly improve the security of port protection, device binding accuracy and system scalability while maintaining lightweightness and flexibility, and can adapt to various emerging network security scenarios such as edge computing and the Internet of Things.

[0066] To further illustrate the embodiments of the above-described browser-based first User Datagram Protocol (UDP) single-packet authorization method and browser-based second UDP single-packet authorization method, this application also provides a specific application example of a browser-based UDP single-packet authorization method with dual-end interaction. Specifically, it includes the following: Application examples in this application include a secure browser on the client side, a lightweight verification module on the server side, an invisible authorization module, and a dynamic session cleanup module. The system architecture is as follows: Figure 3 As shown, the functions of each module are as follows: The client-side secure browser's core function is to generate legitimate UDP authentication packets. The key lies in the dynamic device identifier generation and differentiated encryption combination. The browser generates a unique device identifier by collecting hardware and system environment characteristics, avoiding the security risks of fixed identifiers. The dynamic encryption algorithm enhances encryption flexibility and security.

[0067] Lightweight server-side verification module: It plays the role of pre-filtering, only performs basic verification, and does not participate in the core encryption and decryption process, thus reducing server-side resource consumption.

[0068] Server-side stealth authorization module: Achieving the core objective of zero exposure, it closes all business ports by default, only temporarily opening the target port after successful authentication. It verifies signatures using the SM2 root public key and derives keys using the device's unique identifier, avoiding key storage risks. Simultaneously, it binds authentication to resources, improving authorization accuracy.

[0069] Server-side dynamic session cleanup module: Ensures that ports can be closed at any time. By monitoring session status and time windows in real time, it dynamically manages temporary authorizations according to security policies, reducing the risk of port exposure.

[0070] The specific certification process is as follows: Figure 4 As shown.

[0071] Compared with existing technologies, the application examples of this application have at least the following significant technical advantages: 1) Significantly reduces the exposed port surface, achieving default invisible port protection. Existing technical problems: Traditional Transmission Control Protocol (TCP) port protection usually keeps service ports open for a long time, making them vulnerable to port scanning and probing; even with mechanisms such as port knocking, there are often detectable handshake behaviors and fixed port opening policies.

[0072] Advantages of this application example: The server closes all business ports by default, and only temporarily opens the target port after receiving and passing the high-strength UDP single packet authentication, and automatically closes it after the session ends or times out, achieving zero exposure under normal circumstances and opening it as needed when required, effectively resisting port scanning and sniffing.

[0073] 2) Deep integration of device fingerprint and key system to achieve strong binding authentication of device as key. Existing technical problems: Current device authentication mostly uses fixed identifiers or simple website caching (cookies), which are easily replayed, forged or stolen; authentication and encryption key management are independent of each other, and the device identifier does not actually participate in the key generation process.

[0074] Advantages of this application example: By collecting multi-dimensional hardware and operating environment characteristics through a browser, a unique device identifier is generated using SM3 hashing, and this identifier, along with a temporary token, is used to dynamically derive an SM4 session key via HKDF. Even if an attacker intercepts UDP packets, they cannot deduce the correct key because they cannot reconstruct the true device characteristics, significantly improving anti-replay and anti-forgery capabilities.

[0075] 3) Decoupling edge-based lightweight verification from backend core verification enhances the overall system's resistance to denial-of-service attacks. Existing technical issues: Existing solutions often centrally execute all verification logic, including complex cryptographic operations, on the authentication server side, which can easily become a performance bottleneck and a focal point for denial-of-service attacks.

[0076] Advantages of this application example: By setting up a lightweight verification module on the edge gateway, basic verification of UDP packets such as destination port, payload length, and time window is performed first, quickly discarding a large number of invalid or timed-out packets. Only a small number of valid packets that pass the filter are passed to the backend stealth authorization module for complex operations such as SM2 signature verification and SM4 decryption. The decoupled front-end and back-end architecture significantly reduces the back-end load and improves the overall system throughput and anti-attack capabilities.

[0077] 4) High-strength authentication is achieved based on the browser environment, requiring no dedicated client software, and offering flexible deployment and wide compatibility. Existing technical problems: Existing high-strength authentication solutions usually rely on dedicated clients or agent software, which are costly to deploy and difficult to install on restricted terminals; while web-based solutions often lack sufficient security strength.

[0078] Advantages of this application example: Device fingerprint collection, SM2 signing, SM4-GCM encryption, and UDP single-packet transmission can be achieved using a portable browser, without the need for a dedicated client. This solution is widely adaptable to devices with modern browser environments, such as PCs, mobile terminals, and IoT (Internet of Things) gateways, and is particularly suitable for multi-terminal and multi-scenario security protection needs in edge computing, cloud-edge collaboration, and IoT.

[0079] 5) It comprehensively considers multiple objectives such as high security, high efficiency, low exposure surface, and easy operation and maintenance, significantly improving port protection capabilities in general network scenarios. Existing technical problems: Existing solutions can usually only achieve advantages in a few of the objectives, and it is difficult to simultaneously take into account stealth, security, efficiency and operation and maintenance costs.

[0080] Advantages of this application example: By combining browser fingerprinting, HKDF key derivation, SM2 / SM4 integrated encryption system, UDP single packet, edge pre-verification, dynamic port mapping and automatic session cleanup, the overall design achieves network stealth, efficient authentication, accurate authorization and automated operation and maintenance in the same architecture. It has strong versatility and portability and can be widely used in various network security scenarios for business service protection.

[0081] This application also provides a browser-based user datagram protocol single packet authorization system, set on the server side, which specifically includes the following: A lightweight verification module is used to obtain the User Datagram Protocol Authentication Packet and SM2 public key sent by the client; verify the target port, payload length and timestamp of the User Datagram Protocol Authentication Packet; the User Datagram Protocol Authentication Packet is generated by the client using the browser-based User Datagram Protocol Authentication Packet authorization method according to any one of claims 1 to 7. The stealth authorization module is used to parse the User Datagram Protocol (UDP) authentication packet to obtain a signature value, an encrypted random number, additional authentication data, SM4 ciphertext, and an authentication tag. It verifies the signature value using the SM2 public key to obtain signature information; extracts the target resource identifier, timestamp, and device unique identifier from the signature information; generates an SM4 symmetric key for the current session based on the device unique identifier and a locally stored temporary token using a key derivation algorithm; decrypts the SM4 ciphertext using the SM4-GCM authentication encryption mode based on the encrypted random number and the SM4 symmetric key to obtain encrypted information and verify the authentication tag; verifies whether the target resource identifier, timestamp, and device unique identifier in the encrypted information are consistent with those in the signature information; if the signature verification, decryption verification, and consistency verification all pass, it determines the service port corresponding to the target resource identifier according to the security policy, creates a port mapping with a preset open time, and records session information. The dynamic session cleanup module is used to close the port, delete the port mapping, and clean up the session information if a session timeout or abnormality is detected. The session information includes a session identifier, the device's unique identifier, the client's IP address, the target resource identifier, the service port identifier, the start time, and a preset opening time.

[0082] It is understood that the embodiments of the browser-based User Datagram Protocol (UDP) single packet authorization system provided in this application can correspond one-to-one with the processing flow of the browser-based second UDP single packet authorization method in the above embodiments. Its functions will not be repeated here, but can be referred to the detailed description of the browser-based second UDP single packet authorization method embodiments described above.

[0083] As can be seen from the above description, the browser-based user datagram protocol single packet authorization system provided in this application embodiment can decouple simple filtering from complex cryptographic operations, causing most invalid or abnormal requests to be directly discarded at the edge, significantly reducing the load on the backend hidden authorization module, improving the overall system throughput and enhancing the ability to resist denial-of-service attacks; at the same time, it can also significantly improve the security of port protection, device binding accuracy and system scalability while maintaining lightweightness and flexibility, and can adapt to various emerging network security scenarios such as edge computing and the Internet of Things.

[0084] This application also provides an electronic device, which can be a client or a server. The electronic device may include a processor, a memory, a receiver, and a transmitter. The processor is used to execute the browser-based first User Datagram Protocol (UDP) single-packet authorization method and / or the browser-based second UDP single-packet authorization method mentioned in the above embodiments. The processor and memory can be connected via a bus or other means, taking a bus connection as an example. The receiver can be connected to the processor and memory via wired or wireless means.

[0085] The processor can be a central processing unit (CPU). The processor can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations of the above types of chips.

[0086] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the program instructions / modules corresponding to the browser-based first User Datagram Protocol (UDP) single-packet authorization method and / or the browser-based second UDP single-packet authorization method in the embodiments of this application. The processor executes various functional applications and data processing by running the non-transitory software programs, instructions, and modules stored in the memory, thereby implementing the browser-based first UDP single-packet authorization method and / or the browser-based second UDP single-packet authorization method in the above method embodiments.

[0087] The memory may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created by the processor, etc. Furthermore, the memory may include high-speed random access memory and non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory may optionally include memory remotely located relative to the processor, which can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0088] The one or more modules are stored in the memory, and when executed by the processor, they execute the browser-based first User Datagram Protocol (UDP) single packet authorization method and / or the browser-based second UDP single packet authorization method in the implementation embodiment.

[0089] In some embodiments of this application, the user equipment may include a processor, a memory, and a transceiver unit. The transceiver unit may include a receiver and a transmitter. The processor, memory, receiver, and transmitter may be connected via a bus system. The memory is used to store computer instructions, and the processor is used to execute the computer instructions stored in the memory to control the transceiver unit to send and receive signals.

[0090] As one implementation method, the functions of the receiver and transmitter in this application can be implemented by transceiver circuits or dedicated transceiver chips, and the processor can be implemented by dedicated processing chips, processing circuits or general-purpose chips.

[0091] As another implementation approach, the server provided in this application embodiment can be implemented using a general-purpose computer. That is, the program code implementing the processor, receiver, and transmitter functions is stored in memory, and the general-purpose processor implements the processor, receiver, and transmitter functions by executing the code in memory.

[0092] This application also provides a computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the steps of the aforementioned browser-based first User Datagram Protocol (UDP) single-packet authorization method and / or browser-based second UDP single-packet authorization method. The computer-readable storage medium may be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, floppy disks, hard disks, removable storage disks, CD-ROMs, or any other form of storage medium known in the art.

[0093] This application also provides a computer program product, specifically comprising a computer program that, when executed by a processor, implements the steps of the browser-based first User Datagram Protocol (UDP) single packet authorization method and / or the browser-based second UDP single packet authorization method mentioned in the foregoing embodiments.

[0094] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. The programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave.

[0095] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0096] In this application, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0097] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to the embodiments of this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A browser-based User Datagram Protocol (UDP) packet authorization method, characterized in that, The method, executed by the client, includes: Obtain data from each browser, SM2 private key, and temporary token sent by the server; generate a unique device identifier based on the data from each browser. Based on the device's unique identifier and the temporary token, signature information and encryption information are constructed, and a key derivation algorithm is used to generate the SM4 symmetric key for the current session; The encrypted information is encrypted using the SM4-GCM authentication encryption mode based on the SM4 symmetric key to generate SM4 ciphertext and authentication tag, and the signature information is signed using the SM2 private key to obtain a signature value; The signature value, the SM4 ciphertext, and the authentication tag are concatenated and encapsulated in a preset order to obtain a User Datagram Protocol (UDP) authentication packet. The UDP authentication packet is then sent to a preset authentication port on the server so that the server can verify the UDP authentication packet. If the server verification is successful, the service port of the current session authorized and established by the server is accessed for business communication.

2. The browser-based user datagram protocol single packet authorization method according to claim 1, characterized in that, The browser data mentioned above includes: Screen resolution information, browser type information, version number information, operating system platform information, font list information, time zone information, rendering information, and hardware information of the browser client.

3. The browser-based user datagram protocol single packet authorization method according to claim 1, characterized in that, The step of generating a unique device identifier based on the data from each browser includes: The feature vector is obtained by concatenating data from various browsers in a preset order. The feature vector is normalized and the hash value of the feature vector is calculated using the SM3 algorithm; The unique identifier of the device is obtained.

4. The browser-based user datagram protocol single packet authorization method according to claim 1, characterized in that, The step of using the SM2 private key to sign the signature information to obtain a signature value includes: The hash value of the signature information is calculated using the SM3 algorithm; wherein, the signature information includes the device unique identifier, the temporary token, the target resource identifier, and the timestamp; The hash value is signed using the SM2 private key to obtain a signature value.

5. The browser-based user datagram protocol single packet authorization method according to claim 1, characterized in that, The process of encrypting the encrypted information using the SM4-GCM authentication encryption mode based on the SM4 symmetric key to generate SM4 ciphertext and authentication tag includes: An encrypted random number for the authentication encryption mode is generated based on the device's unique identifier. The encrypted information is encrypted using the SM4-GCM authentication encryption mode based on the SM4 symmetric key to generate SM4 ciphertext and authentication tag; wherein, the encrypted information includes the device unique identifier, the temporary token, the hash value of the target resource identifier and the timestamp, and the hash value of the target resource identifier is calculated using the SM3 algorithm.

6. The browser-based user datagram protocol single packet authorization method according to claim 1, characterized in that, The User Datagram Protocol Authentication packet includes: The system includes a version number field, a payload length field, the signature value, an encrypted random number, additional authentication data, the SM4 ciphertext, and the authentication tag; wherein the additional authentication data includes a target resource identifier and a timestamp.

7. The browser-based user datagram protocol single packet authorization method according to claim 1, characterized in that, Also includes: Obtain the SM2 public key corresponding to the SM2 private key, and send the SM2 public key to the server.

8. A browser-based User Datagram Protocol (UDP) packet authorization method, characterized in that, Executed by the server, the method includes: Obtain the User Datagram Protocol Authentication Packet and SM2 public key sent by the client; verify the target port, payload length, and timestamp of the User Datagram Protocol Authentication Packet; the User Datagram Protocol Authentication Packet is generated by the client using the browser-based User Datagram Protocol Authentication Packet authorization method according to any one of claims 1 to 7. The User Datagram Protocol (UDP) authentication packet is parsed to obtain a signature value, an encrypted random number, additional authentication data, SM4 ciphertext, and an authentication tag. The signature value is verified using the SM2 public key to obtain signature information. The target resource identifier, timestamp, and device unique identifier are extracted from the signature information. Based on the device unique identifier and a locally stored temporary token, a key derivation algorithm is used to generate an SM4 symmetric key for the current session. The SM4 ciphertext is decrypted using the SM4-GCM authentication encryption mode based on the encrypted random number and the SM4 symmetric key to obtain encrypted information and verify the authentication tag. The target resource identifier, timestamp, and device unique identifier in the encrypted information are checked to see if they are consistent with the target resource identifier, timestamp, and device unique identifier in the signature information. If the signature verification, decryption verification, and consistency verification all pass, the service port corresponding to the target resource identifier is determined according to the security policy, a port mapping with a preset open time is created, and session information is recorded. If a session timeout or anomaly is detected, the port is closed, the port mapping is deleted, and the session information is cleared. The session information includes a session identifier, the device's unique identifier, the client's IP address, the target resource identifier, the service port identifier, the start time, and a preset opening time.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the browser-based User Datagram Protocol (UDP) single-packet authorization method as described in any one of claims 1 to 7, and / or implements the browser-based UDP single-packet authorization method as described in claim 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the browser-based User Datagram Protocol (UDP) single-packet authorization method as described in any one of claims 1 to 7, and / or implements the browser-based UDP single-packet authorization method as described in claim 8.

Images