Network communication method, device, computer device and computer program

Abstract

The present invention relates to the field of communications, and relates to a network communication method, apparatus, computer device, and storage medium. The method includes: sending an encrypted communication connection request to a first communication device, where the encrypted communication connection request is used to instruct the first communication device to return a first digital certificate (step (202)); receiving a second digital certificate from the first communication device, where the second digital certificate is the digital certificate actually received by a second communication device after the first communication device returns the first digital certificate in response to the encrypted communication connection request (step (204)); sending a first key negotiation request to the first communication device, and receiving a compressed digital certificate returned by the first communication device in response to the first key negotiation request, where the compressed digital certificate is obtained by compressing the first digital certificate (step (206)); performing integrity verification based on the second digital certificate and the compressed digital certificate (step (208)); generating an encrypted communication key when the integrity verification is successful and the authentication of the first communication device based on the second digital certificate is successful (step (210)); and performing encrypted communication with the first communication device based on the encrypted communication key (step (212)).

Description

[Technical Field]

[0001] This application claims priority from a Chinese patent application bearing application number 2023104244485, filed on April 18, 2023, and entitled "Network communication method, device, computer equipment, and storage medium," the entire contents of which are incorporated herein by reference.

[0002] The present invention relates to the field of communications technology, and more particularly to a network communications method, device, computer device and storage medium. [Background technology]

[0003] With the development of network communications, in order to improve the security of network communications, communication devices need to establish encrypted communication connections, and in the procedure for establishing the encrypted communication connections, the communication devices need to authenticate each other by transmitting digital certificates. With the development of quantum computers, in order to improve the security of network communications in the quantum computer era, the transmitted digital certificates in the procedure for establishing the encrypted communication connections need to support quantum-resistant algorithms.

[0004] In the prior art, when a packet of a digital certificate to be transmitted in the procedure for establishing an encrypted communication connection is large, the purpose of transmitting the digital certificate is usually achieved by dividing the packet of the digital certificate into multiple smaller packets and transmitting each of the divided smaller packets.

[0005] However, dividing a large digital certificate packet and sending the resulting smaller packets increases transmission time and increases the likelihood of connection establishment failure, reducing communication efficiency. Summary of the Invention

[0006] Therefore, in view of the above technical problems, there is a need to provide a network communication method, apparatus, computer device, computer-readable storage medium and computer program product.

[0007] In one aspect of the present invention, a network communication method executed by a second communication device includes the steps of: sending an encrypted communication connection request to a first communication device, the encrypted communication connection request being used to instruct the first communication device to return a first digital certificate; receiving a second digital certificate from the first communication device, the second digital certificate being a digital certificate actually received by the second communication device after the first communication device returns the first digital certificate in response to the encrypted communication connection request; and instructing the first communication device to perform a first key negotiation. a step of transmitting a first key negotiation request to the first communication device and receiving a compressed digital certificate returned by the first communication device in response to the first key negotiation request, wherein the compressed digital certificate is obtained by compressing the first digital certificate; a step of performing integrity verification based on the second digital certificate and the compressed digital certificate; if the integrity verification is successful and authentication of the first communication device based on the second digital certificate is successful, a step of generating an encrypted communication key; and a step of performing encrypted communication with the first communication device based on the encrypted communication key.

[0008] In another aspect of the present invention, a network communication device includes a connection request sending module that sends an encrypted communication connection request to a first communication device, the encrypted communication connection request being used to instruct the first communication device to return a first digital certificate; a certificate receiving module that receives a second digital certificate from the first communication device, the second digital certificate being a digital certificate actually received by the second communication device after the first communication device returns the first digital certificate in response to the encrypted communication connection request; and a certificate receiving module that sends a first key negotiation request to the first communication device and receives the first key. Provided is a device including: a negotiation request transmission module that receives a compressed digital certificate returned by the first communication device in response to a negotiation request, wherein the compressed digital certificate is obtained by compressing the first digital certificate; a verification module that performs integrity verification based on the second digital certificate and the compressed digital certificate; a first key generation module that generates an encrypted communication key if the integrity verification is successful and authentication of the first communication device based on the second digital certificate is successful; and a first encrypted communication module that performs encrypted communication with the first communication device based on the encrypted communication key.

[0009] Another aspect of the present invention provides a computing device including a memory having computer-readable instructions stored therein and one or more processors, the processors performing the steps in the network communication method described above when executing the computer-readable instructions.

[0010] Another aspect of the present invention provides one or more computer readable storage media having stored thereon computer readable instructions that, when executed by a processor, perform the steps in the network communication method described above.

[0011] In another aspect of the present invention, there is provided a computer program product comprising computer-readable instructions that, when executed by one or more processors, implement the steps in the network communication method described above.

[0012] Another aspect of the present invention provides a network communication method executed by a first communication device, the method including the steps of: receiving an encrypted communication connection request sent by a second communication device; and transmitting a first digital certificate to the second communication device in response to the encrypted communication connection request so that the second communication device actually receives a second digital certificate, the second digital certificate being used to authenticate the first communication device; receiving a first key negotiation request sent by the second communication device; and transmitting a compressed digital certificate to the second communication device in response to the first key negotiation request, the compressed digital certificate being obtained by compressing the first digital certificate and being used to perform integrity verification with the second digital certificate; and if the integrity verification and the authentication are successful, generating an encrypted communication key; and performing encrypted communication with the second communication device based on the encrypted communication key.

[0013] In another aspect of the present invention, a network communication device includes: a connection request receiving module that receives an encrypted communication connection request sent by a second communication device; a certificate transmission module that transmits a first digital certificate to the second communication device in response to the encrypted communication connection request so that the second communication device actually receives a second digital certificate, the second digital certificate being used to authenticate to the first communication device; and a negotiation request receiving module that receives a first key negotiation request sent by the second communication device. a negotiation request response module that transmits a compressed digital certificate to the second communication device in response to the first key negotiation request, the compressed digital certificate being obtained by compressing the first digital certificate and being used to verify its integrity with the second digital certificate; a second key generation module that generates an encrypted communication key if the integrity verification and the authentication are successful; and a second encrypted communication module that performs encrypted communication with the second communication device based on the encrypted communication key.

[0014] Another aspect of the present invention provides a computing device including a memory having computer-readable instructions stored therein and one or more processors, the processors performing the steps in the network communication method described above when executing the computer-readable instructions.

[0015] Another aspect of the present invention provides one or more computer readable storage media having stored thereon computer readable instructions that, when executed by a processor, perform the steps in the network communication method described above.

[0016] In another aspect of the present invention, there is provided a computer program product comprising computer-readable instructions that, when executed by one or more processors, implement the steps in the network communication method described above.

[0017] The details of one or more embodiments of the invention are set forth in the drawings and description which follow. Other features, objects, and advantages of the invention will become apparent from the description, drawings, and claims. [Brief explanation of the drawings]

[0018] In order to more clearly explain the technology according to the embodiments of the present invention, the following briefly introduces drawings necessary for describing the embodiments, and it should be noted that the following drawings are merely some aspects of the present invention, and those skilled in the art can obtain other drawings based on these drawings without creative work. [Figure 1] 1 is a schematic diagram of an application environment of a network communication method according to some embodiments; [Figure 2] 1 is a flowchart of a network communication method according to some embodiments. [Figure 3] 1 is a schematic diagram of the principle of generating a compressed digital certificate according to some embodiments; [Figure 4] 1 is a schematic diagram of the principle of certificate type determination according to some embodiments; [Figure 5] FIG. 1 is a sequence diagram of a TLS connection establishment procedure according to some embodiments. [Figure 6] FIG. 1 is a sequence diagram of an improved TLS connection establishment procedure according to some embodiments. [Figure 7] FIG. 1 is a sequence diagram of an improved TLS connection establishment procedure according to some embodiments. [Figure 8] FIG. 1 is a sequence diagram of an improved TLS connection establishment procedure according to some embodiments. [Figure 9] 1 is a flowchart of a network communication method according to some embodiments. [Figure 10] 1 is a flowchart of a network communication method according to some embodiments. [Figure 11] FIG. 1 is a block diagram of a network communication device configuration according to some embodiments. [Figure 12] FIG. 1 is a block diagram of a network communication device configuration according to some embodiments. [Figure 13] FIG. 1 is a schematic diagram of the internal configuration of a computer device according to some embodiments. [Figure 14] FIG. 1 is a schematic diagram of the internal configuration of a computer device according to some embodiments. DETAILED DESCRIPTION OF THE INVENTION

[0019] In order to make the objects, technical means and advantages of the present invention more clearly understood, the present invention will be described in more detail below with reference to the drawings and examples. Note that the specific examples described in this specification are merely for the purpose of illustrating the present invention and are not intended to limit the present invention.

[0020] A network communication method according to an embodiment of the present invention can be applied to an application environment shown in FIG. 1 . The application environment includes a first communication device 102 and a second communication device 104. Here, the first communication device 102 communicates with the second communication device 104 via a network. A first data storage system may store data that the first communication device 102 needs to process. The first data storage system may be integrated into the first communication device 102 or may be located in a cloud or other server. A second data storage system may store data that the second communication device 104 needs to process. The second data storage system may be integrated into the second communication device 104 or may be located in a cloud or other server.

[0021] Specifically, when an unencrypted communication connection is established between the second communication device 104 and the first communication device 102, for example, when a TCP (Transmission Control Protocol) connection is established, the second communication device 104 may transmit an encrypted communication connection request to the first communication device 102 to perform encrypted communication with the first communication device 102, and the first communication device 102 may transmit a first digital certificate to the second communication device in response to the encrypted communication connection request. The encrypted communication connection request is used to instruct the first communication device 102 to return a first digital certificate for identifying the first communication device 102, and the first communication device 102 is the other device that communicates with the second communication device 104. After the first communication device 102 returns the first digital certificate to the second communication device, the second communication device 104 actually receives the second digital certificate. If the first digital certificate has not been tampered with during transmission, the second digital certificate and the first digital certificate are the same digital certificate. If the first digital certificate has been tampered with during transmission, the second digital certificate is different from the first digital certificate. The second communication device 104 transmits a first key negotiation request to the first communication device 102, and the first communication device 102 returns a compressed digital certificate to the second communication device 104 in response to the first key negotiation request. The compressed digital certificate is obtained by compressing the first digital certificate. After receiving the compressed digital certificate, the second communication device 104 performs integrity verification based on the second digital certificate and the compressed digital certificate. If the integrity verification is successful and authentication of the first communication device based on the second digital certificate is successful, the second communication device generates an encrypted communication key. After the encrypted communication key is generated, the second communication device 104 and the first communication device 102 perform encrypted communication based on the encrypted communication key. Furthermore, if the integrity verification is successful and authentication of the first communication device based on the second digital certificate is successful, the first communication device also generates the encrypted communication key, and the encrypted communication key generated by the first communication device and the encrypted communication key generated by the second communication device are identical.

[0022] Here, the first communication device 102 and the second communication device 104 may be, but are not limited to, various desktop computers, laptops, smartphones, tablet computers, Internet of Things devices, and portable wearable devices. The Internet of Things devices may be smart speakers, smart TVs, smart air conditioners, smart car devices, independent physical servers, server clusters or distributed systems consisting of multiple physical servers, or cloud servers providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, network security services such as cloud security and host security, CDNs, and big data and artificial intelligence platforms. The portable wearable devices may be, for example, smart watches, smart wristbands, or head-mounted devices. The first communication device 102 and the second communication device 104 may be directly or indirectly connected via wired or wireless communication, but the present invention is not limited thereto.

[0023] The network communication method according to the present invention may be applied to a blockchain system, which is formed by a plurality of nodes (any type of computing device in an access network, such as a server, a user terminal) and clients.

[0024] A peer-to-peer (P2P) network is formed between nodes, and the P2P protocol is an application layer protocol that runs on top of the Transmission Control Protocol (TCP). In a blockchain system, any device, such as a server or terminal, may participate as a node, and a node includes a hardware layer, an intermediate layer, an operating system layer, and an application layer. For example, the first communication device and the second communication device may be nodes in the blockchain system, and the network communication method according to the present invention can be applied to the blockchain system to improve communication efficiency between nodes in the blockchain system.

[0025] In some embodiments, a network communication method is provided, and the method is described as being applied to the second communication device 104 in Fig. 1 as an example. As shown in Fig. 2, the method includes the following steps:

[0026] Step 202: Send an encrypted communication connection request to the first communication device, where the encrypted communication connection request is used to instruct the first communication device to return the first digital certificate.

[0027] Here, the digital certificate is used to identify a communication device in Internet communication. The first digital certificate is used to indicate the identification information of the first communication device. The first communication device and the second communication device are communicating with each other. The first digital certificate may be a digital certificate that satisfies any standard, for example, a digital certificate that satisfies the X.509 standard, and a digital certificate that satisfies the X.509 standard may be referred to as an X.509 digital certificate or an x509 digital certificate. X.509 is a standard format for public key infrastructure (PKI). The first digital certificate may be an X.509 digital certificate that supports a quantum-safe algorithm. An X.509 digital certificate that supports a quantum-safe algorithm supports the quantum-safe algorithm by adding fields such as Alt-Signature-Algorithm (signature algorithm), Subject-Alt-Public-Key-Info (public key of the certificate body), and Alt-Signature-Value (signature of the certificate issuer) to the extension field (X509v3 extensions). For example, the data structure of an X.509 digital certificate that supports quantum-safe algorithms may be as follows:

[0028] X.509Certificate: / / X.509 Digital Certificate Data: / / Data field Version:3(0x2) / / Version number Serial Number:3027 / / Serial number Signature Algorithm:ecdsa-with-SHA256 / / Signature algorithm Issuer:C=CN,ST=BJ,O=XX,CN=CA_TEST / / Issuer Validity Not Before: Jan 9 17:33:02 2018 GMT / / GMT (Greenwich Mean Time), invalid until Jan 9 17:33:02 2018 GMT; Not After:Jan 22 17:33:02 2019 GMT / / Not valid after Jan 22 17:33:02 2019 GMT; Subject: C=CN,ST=BJ,O=XX,CN=ServerCRT_TEST / / Certificate owner name Subject Public Key Info: / / Certificate subject's public key algorithm, parameters and values; Public Key Algorithm:id-ecPublicKey Public-Key: (256 bit) [...omitted for brevity...] X509v3 extensions: / / Extension field X509v3 Basic Constraints: CA:FALSE Alt-Signature-Algorithm: / / Alternative signature algorithm sha512WithDillithiun2 Subject-Alt-Public-Key-Info: / / Certificate public key Public Key: 00:00:00:01:00:00:00:07:00:00:00:03:1c:ba [...omitted for brevity...] / / Omitted for brevity Alt-Signature-Value: / / Certificate issuer signature Signature: 23:82:1a:74:01:00:30:06:af:1d:d3 [...omitted for brevity...] / / Omitted for brevity X.509 digital certificates that support quantum-resistant algorithms contain the public key of the certificate itself and the signature of the certificate issuer, so the data volume of X.509 digital certificates that support quantum-resistant algorithms is large. Quantum-resistant algorithms are used to protect the safety of transmitted data on quantum computers.

[0029] The encrypted communication connection request is used to request the establishment of a communication link for encrypted communication, and encrypted communication means that data to be transmitted during communication is encrypted and then transmitted. In other words, encrypted communication means sending and receiving encrypted data during communication, encrypting and transmitting data to be transmitted during data transmission, and receiving and decrypting encrypted data.

[0030] Specifically, if the first communication device and the second communication device have established an unencrypted communication link, the encrypted communication connection request may be sent via the unencrypted communication link. The unencrypted communication link is used to transmit data in a clear text manner. The unencrypted communication link may be, for example, a communication link established via a TCP connection.

[0031] In some embodiments, if the data volume of the first digital certificate is greater than a data volume threshold, the encrypted communication connection request is used to instruct the first communication device to return a first digital certificate for identifying the first communication device. The first communication device is the other device that communicates with the second communication device. The data volume threshold may be set as needed, and may be determined, for example, according to the data volume of an MTU (Maximum Transmission Unit). For example, the data volume threshold may be the data volume of the MTU, or may be the product of the data volume of the MTU and a predetermined coefficient, and the predetermined coefficient may be a value between 0.5 and 1, such as 0.8 or 1.

[0032] In some embodiments, the second communication device transmits an encrypted communication connection request to the first communication device to establish encrypted communication with the first communication device, and the first communication device, in response to the encrypted communication connection request, obtains a first digital certificate and transmits the first digital certificate to the second communication device.

[0033] Step 204: Receive a second digital certificate from the first communication device, where the second digital certificate is the digital certificate actually received by the second communication device after the first communication device returns the first digital certificate in response to the encrypted communication connection request.

[0034] Specifically, a first communication device obtains a first digital certificate in response to a request for an encrypted communication connection and transmits the first digital certificate to a second communication device over an unencrypted communication link. Because an unencrypted communication link cannot guarantee the security of data transmission, the first digital certificate may be tampered with during transmission, and the second digital certificate received by the second communication device may not be the first digital certificate. If the second digital certificate has not been tampered with, the second digital certificate received by the second communication device is the first digital certificate.

[0035] Step 206: Send a first key negotiation request to the first communication device, and receive a compressed digital certificate returned by the first communication device in response to the first key negotiation request, where the compressed digital certificate is obtained by compressing the first digital certificate.

[0036] Here, the key negotiation request is used to trigger key negotiation between the first communication device and the second communication device, and the purpose of the key negotiation is to obtain a common key through negotiation. After obtaining the common key through negotiation, the first communication device and the second communication device encrypt the data to be transmitted using this common key before transmitting the data, and then transmit the encrypted result. Here, the common key is also referred to as an encrypted communication key.

[0037] The second communication device may send a first key negotiation request to the first communication device while the first communication device is transmitting the first digital certificate, or may send a first key negotiation request to the first communication device after receiving the complete second digital certificate.

[0038] Specifically, the first communication device has a first public key and a first private key, the first public key can decrypt data encrypted with the first private key, and the first private key can also decrypt data encrypted with the first public key. The second communication device has a second public key and a second private key, the second public key can decrypt data encrypted with the second private key, and the second private key can also decrypt data encrypted with the second public key. During key negotiation between the first communication device and the second communication device, data sent by the first communication device to the second communication device may be encrypted with the second public key, and data sent by the second communication device to the first communication device may be encrypted with the first public key, for example, a first key negotiation request may be encrypted with the first public key.

[0039] In some embodiments, the compressed digital certificate may be pre-generated by the first communication device or may be generated by the first communication device in response to a first key negotiation request. Specifically, in response to the first key negotiation request, the first communication device obtains the first digital certificate, compresses at least some content in the first digital certificate, obtains a compressed digital certificate corresponding to the first digital certificate, and transmits the compressed digital certificate to the second communication device.

[0040] In some embodiments, the first communication device may compress all content included in the first digital certificate to obtain a compressed digital certificate. For example, the first communication device may perform a hash calculation on all content included in the first digital certificate and use the result of the hash calculation as the compressed digital certificate. Alternatively, the first communication device may compress the first content in the first digital certificate, for example, perform a hash calculation, and obtain a first compressed content corresponding to the first content. Then, the first communication device may replace the first content in the first digital certificate with the first compressed content corresponding to the first content to obtain a compressed digital certificate corresponding to the first digital certificate.

[0041] Step 208: Perform integrity verification based on the second digital certificate and the compressed digital certificate.

[0042] Specifically, the compressed digital certificate is obtained by compressing the first digital certificate according to a predetermined compression method. The predetermined compression method includes, but is not limited to, a predetermined compression encoding algorithm. The predetermined compression encoding algorithm includes, but is not limited to, a hash algorithm. The hash algorithm includes, but is not limited to, SHA256, Chinese encryption algorithm SM2, or Chinese encryption algorithm SM3. Because the compressed digital certificate is obtained by compressing the first digital certificate, the data volume of the compressed digital certificate is smaller than the data volume of the first digital certificate. Therefore, the compressed digital certificate can be considered a short certificate corresponding to the first digital certificate. For example, if the first digital certificate is an x509 digital certificate using a quantum-resistant algorithm and the predetermined compression method is SHA256, the calculation method for the short certificate corresponding to the first digital certificate is short certificate = SHA256 (x509 digital certificate using a quantum-resistant algorithm). Since the hash algorithm is collision-resistant, the quantum-safe algorithm x509 digital certificate corresponds one-to-one with the short certificate, and the short certificate obtained by the hash algorithm is only a unique tens of bytes in size, which reduces the amount of data transmitted during the network transmission process and improves communication efficiency. The first communication device has a short certificate calculation module, which compresses the input digital certificate according to a predetermined compression method to generate a corresponding short certificate. As shown in Figure 3, the quantum-safe algorithm x509 digital certificate is input to the short certificate calculation module, which outputs the short certificate.

[0043] In some embodiments, the second communication device may compress the second digital certificate according to the predetermined compression scheme and use the result of the compression as a comparison digital certificate. If the comparison digital certificate and the compressed digital certificate match, the second communication device determines that the second digital certificate and the first digital certificate match. If not, the second communication device determines that the second digital certificate and the first digital certificate do not match.

[0044] In some embodiments, a predetermined decompression method may correspond to the predetermined compression method, and when the second communication device obtains the compressed digital certificate by decompression, it may decompress the compressed digital certificate according to the predetermined decompression method to obtain the first digital certificate.The second communication device then compares the first digital certificate with the second digital certificate, and if the comparison results in a match, it determines that the second digital certificate and the first digital certificate match.If not, it determines that the second digital certificate and the first digital certificate do not match.

[0045] Step 210: If the integrity verification is successful and the authentication of the first communication device based on the second digital certificate is successful, generate an encrypted communication key.

[0046] Here, the encrypted communication key is a symmetric key, that is, data encrypted with the encrypted communication key can be decrypted with the encrypted communication key.

[0047] Specifically, if the integrity verification is successful, it indicates that the second digital certificate is the first digital certificate, i.e., that the first digital certificate was correctly transmitted to the second communication device. If the integrity verification is successful, the second communication device may authenticate the first communication device via the second digital certificate. This prevents invalid authentication from being performed when the second digital certificate and the first digital certificate do not match. If the authentication is successful, the second communication device generates an encrypted communication key and performs encrypted communication with the first communication device using the encrypted communication key.

[0048] In some embodiments, if the second digital certificate and the first digital certificate match, the first communication device and the second communication device each generate the same key, which is an encrypted communication key. If the second digital certificate and the first digital certificate do not match, the second communication device may send a notification of negotiation failure to the first communication device, and the second communication device may re-perform the step of sending an encrypted communication connection request to the first communication device.

[0049] In some embodiments, the second communication device generates a first random number and encrypts the first random number using a first public key of the first communication device to obtain a first encrypted random number. The first key negotiation request may include the first encrypted random number. In response to the first key negotiation request, the first communication device may generate a second random number and encrypt the second random number using a second public key of the second communication device to obtain the second encrypted random number, and transmit the second encrypted random number to the second communication device. The first communication device may decrypt the second encrypted random number using a first private key to obtain the second random number, and generate an encrypted communication key based on the first random number and the second random number. The second communication device may decrypt the first encrypted random number using a second private key to obtain the first random number, and generate an encrypted communication key based on the first random number and the second random number. The first communication device and the second communication device generate the same encrypted communication key. The method for generating the encrypted communication key based on the first random number and the second random number is not limited here, but for example, the first random number and the second random number may be used as the encrypted communication key, or a hash calculation may be performed on the first random number and the second random number, and the result of the hash calculation may be used as the encrypted communication key.

[0050] Step 212: Encrypted communication is performed with the first communication device based on the encrypted communication key.

[0051] Specifically, the encrypted communication key is a symmetric key, i.e., data encrypted using the encrypted communication key can be decrypted using the encrypted communication key. When the first communication device and the second communication device generate the encrypted communication key, data transmitted from the first communication device to the second communication device is encrypted using the encrypted communication key, and data transmitted from the second communication device to the first communication device is also encrypted using the encrypted communication key. After receiving data encrypted using the encrypted communication key transmitted from the second communication device, the first communication device decrypts the received data using the encrypted communication key. After receiving data encrypted using the encrypted communication key transmitted from the first communication device, the second communication device decrypts the received data using the encrypted communication key. In this way, the first communication device and the second communication device realize encrypted communication.

[0052] In the above network communication method, an encrypted communication connection request is sent to a first communication device, the encrypted communication connection request is used to instruct the first communication device to return a first digital certificate, a second digital certificate is received from the first communication device, the second digital certificate is a digital certificate actually received by the second communication device after the first communication device returns the first digital certificate in response to the encrypted communication connection request, a first key negotiation request is sent to the first communication device, a compressed digital certificate returned by the first communication device in response to the first key negotiation request is received, the compressed digital certificate is obtained by compressing the first digital certificate, integrity verification is performed based on the second digital certificate and the compressed digital certificate, and if the integrity verification is successful and authentication of the first communication device based on the second digital certificate is successful, an encrypted communication key is generated and encrypted communication is performed with the first communication device based on the encrypted communication key. Instead of transmitting the first digital certificate in the key negotiation procedure, the first digital certificate is transmitted before transmitting the first key negotiation request, i.e., before conducting the key negotiation, and a compressed digital certificate corresponding to the first digital certificate is transmitted after transmitting the first key negotiation request, i.e., in the key negotiation procedure. This reduces the amount of data transmitted in the key negotiation procedure, reduces the failure rate of key negotiation, and improves the success rate of key negotiation, thereby improving the efficiency of establishing encrypted communication connections and improving communication efficiency.

[0053] Furthermore, if the integrity verification is successful and authentication of the first communication device based on the second digital certificate is successful, an encrypted communication key is generated, which becomes the encrypted communication key generated in a safe case, thereby improving the security of encrypted communication.

[0054] In some embodiments, the first digital certificate returned by the first communication device is returned by the first communication device in response to a request for an encrypted communication connection if the data volume of the first digital certificate is greater than a data volume threshold. Specifically, the first communication device transmits the first digital certificate to the second communication device in response to a request for an encrypted communication connection if the data volume of the first digital certificate is greater than a data volume threshold.

[0055] In some embodiments, the data volume of a digital certificate of the first certificate type is greater than a data volume threshold, and the data volume of a digital certificate of the second certificate type is equal to or less than the data volume threshold. The data volume threshold may be set as needed, and may be determined, for example, according to the data volume of an MTU (Maximum Transmission Unit). For example, the data volume threshold may be the data volume of the MTU, or may be the product of the data volume of the MTU and a predetermined coefficient, and the predetermined coefficient may be a value between 0.5 and 1, such as 0.8 or 1.

[0056] In some embodiments, the first communication device determines the certificate type of the first digital certificate in response to the encrypted communication connection request, and if the certificate type of the first digital certificate is the first certificate type, transmits the first digital certificate to the second communication device, for example, transmits a first request response result for the encrypted communication connection request to the second communication device, the first request response result including the first digital certificate. Because the first request response result may be transmitted by the first communication device over an unencrypted communication link, the response result actually received by the second communication device may or may not match the first request response result. In response to the received response result, the second communication device transmits a first key negotiation request to the first communication device.

[0057] In some embodiments, the data volume of a digital certificate that does not support a quantum-resistant algorithm is less than or equal to a data volume threshold, and the data volume of a digital certificate that supports a quantum-resistant algorithm may be greater than or equal to the data volume threshold. In response to an encrypted communication connection request, if the first communication device determines that the first digital certificate belongs to digital certificates that do not support a quantum-resistant algorithm, it determines that the certificate type of the first digital certificate is the second certificate type. If the first communication device determines that the first digital certificate belongs to digital certificates that support a quantum-resistant algorithm, it calculates the data volume of the first digital certificate, and if the data volume of the first digital certificate is greater than the data volume threshold, it determines that the certificate type of the first digital certificate is the first certificate type. If the data volume of the first digital certificate is less than or equal to the data volume threshold, it determines that the certificate type of the first digital certificate is the second certificate type. Taking the first digital certificate as an example, an x509 digital certificate, FIG. 4 illustrates the principle of certificate type determination. 4, a non-quantum-resistant x509 digital certificate refers to an x509 digital certificate that does not support a quantum-resistant algorithm, and a quantum-resistant x509 digital certificate refers to an x509 digital certificate that supports a quantum-resistant algorithm. A "small certificate" indicates that the certificate type is the second certificate type, and a "large certificate" indicates that the certificate type is the first certificate type.

[0058] In this embodiment, since a relatively large amount of data increases the time required for data transmission, when the data amount of the first digital certificate is greater than the data amount threshold, the first communication device returns the first digital certificate, thereby reducing the delay in data transmission during the key negotiation procedure by transmitting the first digital certificate with a relatively large amount of data before the key negotiation, thereby reducing the chance of the key negotiation procedure being interrupted due to a long transmission delay, improving the probability of the key negotiation being successful, and improving communication efficiency.

[0059] In some embodiments, the network communication method further includes the steps of: receiving a response result returned by the first communication device that does not include the first digital certificate if the data volume of the first digital certificate is less than or equal to a data volume threshold; sending a second key negotiation request to the first communication device in response to the response result; receiving the first digital certificate returned by the first communication device in response to the second key negotiation request; authenticating the first communication device based on the received first digital certificate; and, if authentication is successful, generating an encrypted communication key; and performing encrypted communication with the first communication device based on the encrypted communication key.

[0060] Here, the response result that does not include the first digital certificate may be referred to as a second request response result. The second request response result does not include the first digital certificate. The data volume of the digital certificate of the second certificate type is equal to or less than the data volume threshold.

[0061] Specifically, in response to a request for an encrypted communication connection, the first communication device returns a response result that does not include the first digital certificate to the second communication device if the data volume of the first digital certificate is equal to or less than a data volume threshold. For example, in response to a request for an encrypted communication connection, the first communication device determines that the certificate type of the first digital certificate is the second certificate type, and transmits a second request response result for the encrypted communication connection to the second communication device. After receiving the second request response result, the second communication device transmits a second key negotiation request to the first communication device. In response to the second key negotiation request, the first communication device transmits the first digital certificate to the second communication device. The second communication device authenticates the first communication device using the first digital certificate, and if the authentication is successful, generates an encrypted communication key and performs encrypted communication with the second communication device based on the encrypted communication key.

[0062] In some embodiments, the second communication device has a third digital certificate, and the third digital certificate is used to identify the second communication device. During the key negotiation phase, the first communication device may authenticate the second communication device using the third digital certificate. Specifically, if the certificate type of the third digital certificate is the first certificate type, the second communication device may send the third digital certificate to the first communication device over an unencrypted communication link before the second communication device sends the first key negotiation request to the first communication device. After the second communication device sends the first key negotiation request to the first communication device, the second communication device may compress the third digital certificate and obtain a compressed certificate. The process of compression may refer to a process of compressing the first digital certificate, and the process of obtaining a compressed certificate may refer to a process of obtaining a compressed digital certificate. The second communication device transmits the compressed certificate to the first communication device, generates a third random number, encrypts the third random number using the first public key to obtain a third encrypted random number, and transmits the third encrypted random number to the first communication device. The first communication device performs integrity verification using the compressed certificate, and if the integrity verification is successful, authenticates the second communication device. Thus, the first communication device authenticates the second communication device, and the second communication device also authenticates the first communication device. If the authentication of both the first communication device and the second communication device is successful, the first communication device decrypts the third encrypted random number using the first private key to obtain the third random number, and generates an encrypted communication key based on the first random number, the second random number, and the third random number. The first communication device generates an encrypted communication key based on the first random number, the second random number, and the third random number.

[0063] In this embodiment, if the data volume of the first digital certificate is equal to or less than the data volume threshold, the first digital certificate is transmitted after the second key negotiation request triggers the key negotiation. Therefore, if the data volume is relatively small, there is no need to transmit the first digital certificate and then the compressed digital certificate. By transmitting the first digital certificate directly in the key negotiation phase, the transmission process is simplified, unnecessary data transmission is avoided, and communication efficiency is improved.

[0064] The network communication method according to the present invention may be used to improve the efficiency of establishing a TLS or SSL connection by improving the procedure for establishing a TLS or SSL connection. Here, TLS (Transport Layer Security) and SSL (Secure Socket Layer) are both cryptographic protocols for encrypting data and verifying connections when data travels over the Internet. TLS is an updated version of SSL, and TLS fixes some of the security vulnerabilities present in the SSL protocol. The TLS and SSL connections establish an encrypted communication link. If the first digital certificate is an X.509 digital certificate that supports a quantum-resistant algorithm, the improved TLS or SSL protocol may be referred to as a quantum-resistant TLS or SSL protocol.

[0065] Taking an example of improving the procedure for establishing a TLS connection using the network communication method of the present invention, FIG. 5 shows a sequence diagram of a TLS connection establishment procedure that is not improved using the network communication method of the present invention, and FIG. 6 shows a sequence diagram of the TLS connection establishment procedure that is improved using the network communication method of the present invention. In the procedure for establishing a TLS connection, the first communication device may be understood to be the client side, and the second communication device may be understood to be the server side. The TLS connection establishment procedure, i.e., the key negotiation procedure, may include, but is not limited to, a ClientHello (sending client-side encrypted information) phase, a ServerHello (sending server-side encrypted information) phase, a ClientKeyExchange (random number exchange) phase, or a Change Cipher Spec (encrypted communication notification) phase. In the ClientHello phase, the second communication device sends a key negotiation request to the first communication device, and in the ServerHello phase, the first communication device sends the first digital certificate of the first communication device to the second communication device. In the ClientKeyExchange phase, the second communication device generates a third random number, encrypts the third random number with the first public key, and transmits the encrypted third random number to the first communication device. The Change Cipher Spec phase is used to notify data transmission using the encrypted communication key.

[0066] As can be seen from Figure 6, the improved TLS connection establishment procedure includes a pre-processing phase and a TLS handshake phase, i.e., a key negotiation phase. In the pre-processing phase, the second communication device sends an encrypted communication connection request to the first communication device, and the first communication device determines whether to return the first digital certificate to the second communication device based on the size of the first digital certificate. The pre-processing phase is also referred to as the big data transmission phase.

[0067] 7 shows a sequence diagram of an improved TLS connection establishment procedure when the certificate type of the first digital certificate is the first certificate type. In the pre-processing phase, if the certificate type of the first digital certificate is the first certificate type, the first communication device returns the first digital certificate to the second communication device, and the first communication device transmits the compressed digital certificate to the second communication device in the ServerHello of the TLS handshake phase.

[0068] 8 shows a sequence diagram of an improved TLS connection establishment procedure when the certificate type of the first digital certificate is the second certificate type. If the certificate type of the first digital certificate is the second certificate type in the preprocessing phase, and the first communication device does not return the first digital certificate to the second communication device, the first communication device transmits the first digital certificate to the second communication device in the ServerHello of the TLS handshake phase. If the TLS handshake is successful, i.e., if the negotiation of the encryption communication key is successful, the first communication device and the second communication device perform encrypted communication.

[0069] In some embodiments, the first digital certificate includes a first content and content index information corresponding to the first content, and the compressed digital certificate is obtained by compressing the first content using a predetermined compression method. The step of performing integrity verification based on the second digital certificate and the compressed digital certificate includes the steps of: compressing the second content indicated by the content index information in the second digital certificate using a predetermined compression method to obtain the second compressed content; updating the second content in the second digital certificate with the second compressed content to obtain a comparison digital certificate; and performing integrity verification on the comparison digital certificate and the compressed digital certificate.

[0070] Here, the content index information is index information for searching for first content from the first digital certificate. If the content in the first digital certificate is in the form of a key-value pair, the content index information may include at least one key, and the first content includes values ​​that are content corresponding to each key included in the content index information in the first digital certificate. The data volume of the compressed digital certificate is equal to or less than a data volume threshold. The first content belongs to a portion of the content in the first data certificate. For example, if the first digital certificate is a digital certificate that supports a quantum-resistant algorithm, the first content may be a portion or all of the content in the first digital certificate that supports the quantum-resistant algorithm.

[0071] Specifically, the second communication device may compress the second content indicated by the content index information in the second digital certificate according to a predetermined compression method to obtain the second compressed content, replace the second content indicated by the content index information in the second digital certificate with the second compressed content, and determine the resulting second digital certificate as a comparison digital certificate. The second communication device may compare the comparison digital certificate with the compressed digital certificate, and if the comparison results in a match, determine that the second digital certificate and the first digital certificate match. The compressed digital certificate may be generated by the first communication device.

[0072] In some embodiments, in response to a first key negotiation request sent by the second communication device, the first communication device determines first content to be compressed from the first digital certificate, compresses the first content according to a predetermined compression scheme to obtain first compressed content, replaces the first content in the first digital certificate with the first compressed content, and the replaced first digital certificate is the compressed digital certificate.

[0073] In this embodiment, the first content in the first digital certificate is compressed to obtain a compressed digital certificate, so that specific data in the first digital certificate is compressed rather than all data being compressed, thereby achieving the purpose of compression and improving the efficiency of compression.

[0074] In some embodiments, the first content is content for supporting a quantum-resistant algorithm in a first digital certificate. The first digital certificate supports a quantum-resistant algorithm, and the content index information is index information of content supporting the quantum-resistant algorithm. The second communication device may compress the content supporting the quantum-resistant algorithm indicated by the content index information in the second digital certificate according to a predetermined compression method to obtain the second compressed content.

[0075] Here, the first digital certificate supports a quantum-resistant algorithm, the first digital certificate includes content that supports the quantum-resistant algorithm, and the content index information is index information of the content that supports the quantum-resistant algorithm in the first digital certificate.

[0076] Specifically, the content supporting a quantum-safe algorithm may include at least one of a public key of the first communication device or a signature of a certificate issuer that issues the first digital certificate. The first content may include at least one of a public key of the first communication device or a signature of a certificate issuer that issues the first digital certificate, and the content index information of the first content may include at least one of public key index information or signature index information. If the first content includes the public key of the first communication device and a signature of a certificate issuer that issues the first digital certificate, the second communication device may search the second digital certificate for at least one of the public key indicated by the public key index information and the signature indicated by the signature index information, and determine the searched content as the content indicated by the content index information.

[0077] In some embodiments, the content index information may be transmitted by the first communication device to the second communication device, for example, the first communication device may, in response to the encrypted communication connection request, transmit a first request response result for the encrypted communication connection request to the second communication device, the first request response result including the content index information and the first digital certificate.

[0078] In this embodiment, since the amount of data for content supporting quantum-resistant algorithms is typically large, by compressing the content supporting quantum-resistant algorithms, the amount of data can be effectively reduced and the compression effect can be improved.

[0079] In some embodiments, a network communication method is provided, and the method is described as being applied to the first communication device 102 in Fig. 1 as an example. As shown in Fig. 9, the method includes the following steps:

[0080] Step 902: Receive an encrypted communication connection request sent by a second communication device.

[0081] In order to establish encrypted communication with the first communication device, the second communication device transmits an encrypted communication connection request to the first communication device, and in response to the encrypted communication connection request, the first communication device obtains a first digital certificate and transmits the first digital certificate to the second communication device.

[0082] Step 904: In response to the encrypted communication connection request, transmit the first digital certificate to the second communication device so that the second communication device actually receives the second digital certificate, which is used to authenticate to the first communication device.

[0083] Specifically, in response to a request for an encrypted communication connection, the first communication device transmits a first digital certificate to the second communication device over an unencrypted communication link, and the second communication device actually receives the second digital certificate.

[0084] Step 906: Receive a first key negotiation request sent by a second communication device.

[0085] Step 908: In response to the first key negotiation request, send a compressed digital certificate to the second communication device, the compressed digital certificate being obtained by compressing the first digital certificate and being used to verify its integrity with the second digital certificate.

[0086] Specifically, when the second communication device receives the second digital certificate, it transmits a first key negotiation request to the first communication device. In response to the first key negotiation request, the second communication device compresses some or all of the contents of the first digital certificate, obtains a compressed digital certificate, and transmits the compressed digital certificate to the second communication device. The second communication device receives the compressed digital certificate returned by the first communication device, compresses the second digital certificate to obtain a comparison digital certificate, and performs consistency verification on the comparison digital certificate and the compressed digital certificate.

[0087] Step 910: If the integrity verification and authentication are successful, an encrypted communication key is generated.

[0088] Specifically, if the integrity verification is successful, the second communication device may authenticate the first terminal based on the second digital certificate. If the authentication is successful, the second communication device may send information indicating the success of the authentication to the first communication device and instruct the first communication device and the second communication device to perform encrypted communication. If the integrity verification is successful and the authentication is successful, the second communication device may generate an encrypted communication key and send a key generation request to the first communication device, and the first communication device may generate the encrypted communication key in response to the key generation request.

[0089] Step 912: Encrypted communication is performed with the second communication device based on the encrypted communication key.

[0090] Specifically, the encrypted communication key is a symmetric key, i.e., data encrypted using the encrypted communication key can be decrypted using the encrypted communication key. When the first communication device and the second communication device generate the encrypted communication key, data transmitted from the first communication device to the second communication device is encrypted using the encrypted communication key, and data transmitted from the second communication device to the first communication device is also encrypted using the encrypted communication key. After receiving data encrypted using the encrypted communication key transmitted from the second communication device, the first communication device decrypts the received data using the encrypted communication key. After receiving data encrypted using the encrypted communication key transmitted from the first communication device, the second communication device decrypts the received data using the encrypted communication key. In this way, the first communication device and the second communication device realize encrypted communication.

[0091] In the above network communication method, an encrypted communication connection request sent by a second communication device is received, and in response to the encrypted communication connection request, a first digital certificate is transmitted to the second communication device so that the second communication device actually receives the second digital certificate, the second digital certificate is used to authenticate the first communication device, a first key negotiation request sent by the second communication device is received, and in response to the first key negotiation request, a compressed digital certificate is transmitted to the second communication device, the compressed digital certificate is obtained by compressing the first digital certificate and is used to perform integrity verification with the second digital certificate, and if the integrity verification and authentication are successful, an encrypted communication key is generated, and encrypted communication with the second communication device is performed based on the encrypted communication key. Instead of transmitting the first digital certificate in the key negotiation procedure, the first digital certificate is transmitted before transmitting the first key negotiation request, i.e., before conducting the key negotiation, and a compressed digital certificate corresponding to the first digital certificate is transmitted after transmitting the first key negotiation request, i.e., in the key negotiation procedure. This reduces the amount of data transmitted in the key negotiation procedure, reduces the failure rate of key negotiation, and improves the success rate of key negotiation, thereby improving the efficiency of establishing encrypted communication connections and improving communication efficiency.

[0092] In some embodiments, transmitting the first digital certificate to the first communication device in response to the encrypted communication connection request includes transmitting the first digital certificate to the second communication device in response to the encrypted communication connection request if the data volume of the first digital certificate is greater than a data volume threshold.

[0093] Specifically, if the certificate type of the first digital certificate is the first certificate type, a first request response result for the encrypted communication connection request is sent to the second communication device, and the first request response result includes the first digital certificate. The data volume of the digital certificate of the first certificate type is greater than a data volume threshold. Here, the second digital certificate refers to the digital certificate included in the response result actually received by the second communication device after the first communication device returns the first request response result to the second communication device.

[0094] Specifically, in response to an encrypted communication connection request, if the data volume of the first digital certificate is greater than a data volume threshold, the first communication device transmits a first request response result to the encrypted communication connection request to the second communication device via an unencrypted communication link. Because the first request response result is transmitted by the first communication device via the unencrypted communication link, the response result actually received by the second communication device may or may not match the first request response result.

[0095] In this embodiment, since a relatively large amount of data increases the time required for data transmission, when the data amount of the first digital certificate is greater than the data amount threshold, the first communication device returns the first digital certificate, thereby reducing the delay in data transmission during the key negotiation procedure by transmitting the first digital certificate with a relatively large amount of data before the key negotiation, thereby reducing the chance of the key negotiation procedure being interrupted due to a long transmission delay, improving the probability of the key negotiation being successful, and improving communication efficiency.

[0096] In some embodiments, if the certificate type of the first digital certificate is the first certificate type, it is determined that the data amount of the first digital certificate is greater than a data amount threshold.

[0097] Specifically, if the certificate type of the first digital certificate is the first certificate type, the first communication device transmits a first request response result for the encrypted communication connection request to the second communication device over the unencrypted communication link, where the first request response result includes the first digital certificate.

[0098] In this embodiment, by determining whether the data volume of the first digital certificate is greater than the data volume threshold based on the certificate type, the efficiency of determining whether the data volume of the first digital certificate is greater than the data volume threshold can be improved.

[0099] In some embodiments, if the data volume of the first digital certificate is equal to or less than a data volume threshold, a response result that does not include the first digital certificate is returned to the second communication device in response to the encrypted communication connection request. A second key negotiation request sent by the second communication device is received, and the first digital certificate is sent to the second communication device in response to the second key negotiation request. The second key negotiation request is returned by the second communication device in response to the response result that does not include the first digital certificate. The first digital certificate is used by the second communication device to authenticate the first communication device. If the authentication is successful, an encrypted communication key is generated, and encrypted communication is performed with the second communication device based on the encrypted communication key.

[0100] Specifically, a response result that does not include the first digital certificate may be referred to as a second request response result. The second request response result is used to trigger the second communication device to send a second key negotiation request to the first communication device. In response to the second key negotiation request, the first communication device sends the first digital certificate to the second communication device. When the second communication device receives the first digital certificate, it authenticates the first communication device using the first digital certificate. If the authentication is successful, it generates an encrypted communication key and sends a key generation request to the first communication device. The first communication device generates the encrypted communication key in response to the key generation request, and the first communication device and the second communication device perform encrypted communication based on the encrypted communication key.

[0101] In this embodiment, if the data volume of the first digital certificate is equal to or less than the data volume threshold, the first digital certificate is sent after the second key negotiation request triggers the key negotiation. This ensures the security of data transmission by sending the first digital certificate directly in the key negotiation phase when the data volume is relatively small, reduces the risk of negotiation failure due to large data volumes, and improves communication efficiency.

[0102] In some embodiments, the method further includes determining, if the certificate type of the first digital certificate is the second certificate type, that the data amount of the first digital certificate is less than or equal to a data amount threshold.

[0103] In this embodiment, by determining whether the data volume of the first digital certificate is greater than the data volume threshold based on the certificate type, the efficiency of determining whether the data volume of the first digital certificate is greater than the data volume threshold can be improved.

[0104] In some embodiments, transmitting the compressed digital certificate to the second communication device in response to the first key negotiation request includes determining first content from the first digital certificate in response to the first key negotiation request; compressing the first content using a predetermined compression scheme to obtain the first compressed content; updating the first content with the first compressed content in the first digital certificate to obtain the compressed digital certificate; and transmitting the compressed digital certificate to the second communication device.

[0105] Here, the first content may be the content of any part of the first digital certificate. The data volume of the compressed digital certificate is equal to or less than a data volume threshold.

[0106] Specifically, in response to a first key negotiation request, the first communication device determines a first content to be compressed from a first digital certificate, compresses the first content according to a predetermined compression method to obtain a first compressed content, then updates the first content in the first digital certificate to the first compressed content, obtains a compressed digital certificate, and transmits the compressed digital certificate to the second communication device.

[0107] In this embodiment, the first content in the first digital certificate is compressed to obtain a compressed digital certificate, thereby compressing data and improving the efficiency of the compression.

[0108] In some embodiments, the first digital certificate supports a quantum-resistant algorithm, and determining the first content from the first digital certificate includes obtaining content for supporting a quantum-resistant algorithm from the first digital certificate to obtain the first content.

[0109] Here, the first digital certificate supports a quantum-resistant algorithm, the first digital certificate includes content that supports the quantum-resistant algorithm, and the content index information is index information of the content that supports the quantum-resistant algorithm in the first digital certificate.

[0110] Specifically, the content supporting a quantum-safe algorithm may include at least one of a public key of the first communication device or a signature of a certificate issuer that issues the first digital certificate. The first content may include at least one of a public key of the first communication device or a signature of a certificate issuer that issues the second digital certificate. The content index information of the first content may include at least one of public key index information or signature index information.

[0111] In some embodiments, the first communication device obtains content supporting a quantum-resistant algorithm from a first digital certificate in response to a first key negotiation request sent by the second communication device, and obtains the first content.

[0112] In this embodiment, since the amount of data for content supporting quantum-resistant algorithms is typically large, by compressing the content supporting quantum-resistant algorithms, the amount of data can be effectively reduced and the compression effect can be improved.

[0113] In some embodiments, a network communication method is provided, and the method is described as being applied to a first communication device and a second communication device in Fig. 1. As shown in Fig. 10, the method includes the following steps:

[0114] Step 1002: The second communication device sends an encrypted communication connection request to the first communication device.

[0115] Step 1004: The first communication device determines the certificate type of the first digital certificate in response to the encrypted communication connection request.

[0116] Step 1006: If the certificate type of the first digital certificate is the first certificate type, the first communication device sends a first request response result to the second communication device, where the first request response result includes the first digital certificate, and the data amount of the digital certificate of the first certificate type is greater than a data amount threshold.

[0117] Step 1008: The second communication device actually receives the second digital certificate, where the second digital certificate is the digital certificate included in the actually received response result.

[0118] Step 1010: The second communication device sends a first key negotiation request to the first communication device.

[0119] Here, the first key negotiation request includes a first random number.

[0120] Step 1012: The first communication device sends the compressed digital certificate to the second communication device in response to the first key negotiation request.

[0121] Here, the compressed digital certificate is obtained by compressing the first digital certificate.

[0122] Step 1014: The second communication device compresses the second digital certificate to obtain a comparison digital certificate, and performs consistency verification between the comparison digital certificate and the compressed digital certificate.

[0123] Step 1016: In integrity verification, authenticate the first communication device based on the second digital certificate.

[0124] Step 1018: If the certificate type of the first digital certificate is the second certificate type, the first communication device transmits a second request response result for the encrypted communication connection request to the second communication device, where the second request response result does not include the first digital certificate, and the data volume of the digital certificate of the second certificate type is less than or equal to the data volume threshold.

[0125] Here, the second key negotiation request includes the first random number.

[0126] Step 1020: The second communication device sends a second key negotiation request to the first communication device in response to the received second request response result.

[0127] Step 1022: The first communication device sends the first digital certificate to the second communication device in response to the second key negotiation request sent by the second communication device.

[0128] Step 1024: The second communication device authenticates the first communication device based on the first digital certificate.

[0129] Step 1026: If the authentication is successful, the first communication device and the second communication device generate an encrypted communication key.

[0130] Step 1028: The first communication device and the second communication device perform encrypted communication based on the encrypted communication key.

[0131] In this embodiment, if the certificate type of the first digital certificate is the first certificate type, the complete digital certificate is transmitted before key negotiation, and a compressed digital certificate is transmitted in the key negotiation procedure, thereby reducing the amount of data transmitted in the key negotiation procedure when the data certificate is relatively large; if the certificate type of the first digital certificate is the second certificate type, the complete digital certificate is transmitted in the key negotiation procedure, i.e., if the digital certificate is relatively small, the complete digital certificate is transmitted in the key negotiation procedure, thereby reducing the failure rate of key negotiation and improving the success rate of key negotiation, thereby improving the efficiency of establishing encrypted communication connections and improving communication efficiency.

[0132] Although the steps in the flowcharts according to the above embodiments are displayed sequentially according to the direction of the arrows, these steps are not necessarily executed sequentially according to the direction of the arrows. Unless explicitly stated otherwise in this specification, the execution of these steps is not limited to a strict order and may be executed in other orders. Furthermore, at least some of the steps in the flowcharts according to the above embodiments may include multiple steps or multiple stages, and these steps or stages may not necessarily be executed at the same time but may be executed at different times. The execution order of these steps or stages is not necessarily sequential, and they may be executed alternately or alternately with other steps or at least some of the steps or stages in other steps.

[0133] Based on the same inventive idea, an embodiment of the present invention further provides a network communication device for implementing the above network communication method. The problem-solving embodiments provided by the device are similar to those described in the above method. Therefore, specific limitations in the embodiments of one or more network communication devices provided below may refer to the limitations of the network communication method in the above description.

[0134] 11 , a network communication device is provided, which includes a connection request sending module 1102, a certificate receiving module 1104, a negotiation request sending module 1106, a verification module 1108, a first key generation module 1110, and a first encrypted communication module 1112.

[0135] The connection request sending module 1102 sends an encrypted communication connection request to the first communication device, which is used to instruct the first communication device to return the first digital certificate.

[0136] The certificate receiving module 1104 receives a second digital certificate from the first communication device, the second digital certificate being the digital certificate actually received by the second communication device after the first communication device returns the first digital certificate in response to the encrypted communication connection request.

[0137] The negotiation request transmission module 1106 transmits a first key negotiation request to the first communication device and receives a compressed digital certificate returned by the first communication device in response to the first key negotiation request, the compressed digital certificate being obtained by compressing the first digital certificate.

[0138] The verification module 1108 performs integrity verification based on the second digital certificate and the condensed digital certificate.

[0139] The first key generation module 1110 generates an encrypted communication key if the integrity verification is successful and the authentication of the first communication device based on the second digital certificate is successful.

[0140] The first encrypted communication module 1112 performs encrypted communication with the first communication device based on the encrypted communication key.

[0141] In some embodiments, the first digital certificate returned by the first communications device is returned by the first communications device in response to a request for an encrypted communications connection if the data volume of the first digital certificate is greater than a data volume threshold.

[0142] In some embodiments, if the data volume of the first digital certificate is less than or equal to a data volume threshold, the device receives a response result returned by the first communication device that does not include the first digital certificate, and in response to the response result, sends a second key negotiation request to the first communication device, receives the first digital certificate returned by the first communication device in response to the second key negotiation request, authenticates the first communication device based on the received first digital certificate, and if the authentication is successful, generates an encrypted communication key and performs encrypted communication with the first communication device based on the encrypted communication key.

[0143] In some embodiments, the first digital certificate includes first content and content index information corresponding to the first content. The compressed digital certificate is obtained by compressing the first content using a predetermined compression method. The verification module 1108 compresses the second content indicated by the content index information in the second digital certificate using the predetermined compression method to obtain the second compressed content, updates the second content in the second digital certificate with the second compressed content, obtains a comparison digital certificate, and performs integrity verification on the comparison digital certificate and the compressed digital certificate.

[0144] In some embodiments, the first digital certificate supports a quantum-resistant algorithm, and the first content is content for supporting the quantum-resistant algorithm in the first digital certificate.

[0145] 12 , the network communication device includes a connection request receiving module 1202, a certificate transmission module 1204, a negotiation request receiving module 1206, a negotiation request response module 1208, a second key generation module 1210, and a second encrypted communication module 1212.

[0146] The connection request receiving module 1202 receives an encrypted communication connection request sent by the second communication device.

[0147] The certificate transmission module 1204 transmits the first digital certificate to the second communication device in response to the encrypted communication connection request, so that the second communication device actually receives the second digital certificate, which is used to authenticate to the first communication device.

[0148] The negotiation request receiving module 1206 receives a first key negotiation request sent by a second communication device.

[0149] In response to the first key negotiation request, the negotiation request response module 1208 transmits a compressed digital certificate to the second communication device, the compressed digital certificate being obtained by compressing the first digital certificate and being used for verifying consistency with the second digital certificate.

[0150] If the integrity verification and authentication are successful, the second key generation module 1210 generates an encrypted communication key.

[0151] The second encrypted communication module 1212 performs encrypted communication with the second communication device based on the encrypted communication key.

[0152] In some embodiments, the certificate transmission module 1204 transmits the first digital certificate to the second communication device in response to the encrypted communication connection request if the data volume of the first digital certificate is greater than a data volume threshold.

[0153] In some embodiments, the device determines that the data amount of the first digital certificate is greater than a data amount threshold if the certificate type of the first digital certificate is the first certificate type.

[0154] In some embodiments, if the data volume of the first digital certificate is equal to or less than a data volume threshold, the device returns a response result that does not include the first digital certificate to the second communication device in response to the encrypted communication connection request. The device receives a second key negotiation request sent by the second communication device, and transmits the first digital certificate to the second communication device in response to the second key negotiation request. The second key negotiation request is returned by the second communication device in response to the response result that does not include the first digital certificate, and the first digital certificate is used by the second communication device to authenticate the first communication device. If the authentication is successful, the device generates an encrypted communication key and performs encrypted communication with the second communication device based on the encrypted communication key.

[0155] In some embodiments, the device determines that the data amount of the first digital certificate is less than or equal to the data amount threshold if the certificate type of the first digital certificate is the second certificate type.

[0156] In some embodiments, in response to the first key negotiation request, the negotiation request response module 1208 determines first content from the first digital certificate, compresses the first content using a predetermined compression scheme to obtain first compressed content, updates the first content with the first compressed content in the first digital certificate to obtain the compressed digital certificate, and transmits the compressed digital certificate to the second communication device.

[0157] In some embodiments, the first digital certificate supports a quantum-resistant algorithm. The negotiation request response module 1208 obtains content for supporting the quantum-resistant algorithm from the first digital certificate to obtain the first content.

[0158] All or part of the modules in the network communication device may be realized by software, hardware, or a combination thereof. Each module may be built into a processor in a computer device as hardware, or may be independent, or may be stored in a memory in a computer device as software so that the processor can easily invoke the operation corresponding to each module.

[0159] In some embodiments, a computer device is provided, which may be a server and may have an internal structure as shown in FIG. 13. The computer device includes a processor, a storage device, an input / output interface (abbreviated as Input / Output, I / O), and a communication interface. The processor, memory, and I / O interface are connected via a system bus, and the communication interface is connected to the system bus via the I / O interface. The processor of the computer device is used to provide calculation and control capabilities. The memory of the computer device includes a non-volatile storage medium and memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The memory provides an environment for the execution of the operating system and the computer program on the non-volatile storage medium. The database of the computer device is used to store data related to a network communication method. The I / O interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is for communicating with an external terminal via a network connection. The computer program, when executed by the processor, implements the network communication method.

[0160] In some embodiments, a computer device is provided, which may be a terminal and may have an internal structure as shown in FIG. 14 . The computer device includes a processor, a memory, an input / output interface, a communication interface, a display, and an input device. Here, the processor, the memory, and the input / output interface are connected via a system bus, and the communication interface, the display, and the input device are connected to the system bus via the input / output interface. Here, the processor of the computer device is used to provide calculation and control capabilities. The memory of the computer device includes a non-volatile storage medium, the memory. The non-volatile storage medium stores an operating system and a computer program. The memory provides an environment for the execution of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal via a wired or wireless connection, and the wireless communication may be realized by Wi-Fi, a mobile cellular network, NFC (near field communication), or other technologies. When executed by the processor, the computer program realizes a network communication method. The display unit of the computer device is used to form a visually visible screen and may be a display screen, a projection device, or a virtual reality image forming device, and the display screen may be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device may be a touch layer covering the display screen, keys, a trackball, or a trackpad installed on the case of the computer device, or an external keyboard, trackpad, or mouse.

[0161] Those skilled in the art will understand that the structures shown in Figures 13 and 14 are merely block diagrams of partial structures related to the solution of the present invention, and do not constitute limitations on the computer device to which the solution of the present invention is applied; a specific computer device may include more or fewer components than those shown, may combine certain components, or may have a different component arrangement.

[0162] In some embodiments, a computing device is provided that includes a memory having computer-readable instructions stored thereon and one or more processors that, when executing the computer-readable instructions, perform the steps of the network communication method described above.

[0163] Some embodiments provide one or more computer readable storage media having computer readable instructions stored thereon that, when executed by a processor, perform the steps of the network communication method described above.

[0164] In some embodiments, a computer program product is provided that includes computer-readable instructions that, when executed by one or more processors, implement the steps of the network communication method described above.

[0165] In addition, the user information (including, but not limited to, user device information, user personal information, etc.) and data (including, but not limited to, data for analysis, stored data, displayed data, etc.) related to the present invention are all information and data fully authorized by the user or the parties, and the collection, use and processing of related data must comply with the relevant laws and regulations and standards of the country or region.

[0166] Those skilled in the art will understand that implementing all or part of the process of the method of the above embodiments can be achieved by instructing associated hardware with a computer program that may be stored in a non-volatile computer-readable storage medium, which, when executed, can include processes such as those of the above embodiment of the method. Any reference to a memory, database, or other medium used in each embodiment of the present invention can include at least one of a non-volatile memory and a volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of example and not limitation, RAM may take various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). Databases associated with embodiments of the present invention may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. Processors associated with embodiments of the present invention may be, but are not limited to, general-purpose processors, central processors, graphics processors, digital signal processors, programmable logic circuits, data processing logic circuits based on quantum computing, and the like.

[0167] The technical features of the above embodiments can be combined in any way. For the sake of brevity, all possible combinations of the technical features in the above embodiments have not been described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope described in this specification.

[0168] The above examples only show some examples of the present invention, and the descriptions are more specific and detailed, but therefore should not be construed as limiting the patent scope of the present invention. It should be noted that a person skilled in the art can make some modifications and improvements within the scope of the present invention without departing from the concept of the present invention. Therefore, the protection scope of the present invention should be subject to the scope of the appended claims.

Claims

1. A network communication method executed by a second communication device, comprising: sending an encrypted communication connection request to a first communication device, the encrypted communication connection request being used to instruct the first communication device to return a first digital certificate; receiving a second digital certificate from the first communication device, the second digital certificate being the digital certificate actually received by the second communication device after the first communication device returned the first digital certificate in response to the encrypted communication connection request; sending a first key negotiation request to the first communication device and receiving a compressed digital certificate returned by the first communication device in response to the first key negotiation request, the compressed digital certificate being obtained by compressing the first digital certificate; performing integrity verification based on the second digital certificate and the compressed digital certificate; generating an encrypted communication key if the integrity verification is successful and the authentication of the first communication device based on the second digital certificate is successful; performing encrypted communication with the first communication device based on the encrypted communication key; The method, wherein the first digital certificate returned by the first communication device is returned by the first communication device in response to the encrypted communication connection request when the data volume of the first digital certificate is greater than a data volume threshold.

2. A network communication method executed by a second communication device, comprising: sending an encrypted communication connection request to a first communication device, the encrypted communication connection request being used to instruct the first communication device to return a first digital certificate; receiving a second digital certificate from the first communication device, the second digital certificate being the digital certificate actually received by the second communication device after the first communication device returned the first digital certificate in response to the encrypted communication connection request; sending a first key negotiation request to the first communication device and receiving a compressed digital certificate returned by the first communication device in response to the first key negotiation request, the compressed digital certificate being obtained by compressing the first digital certificate; performing integrity verification based on the second digital certificate and the compressed digital certificate; generating an encrypted communication key if the integrity verification is successful and the authentication of the first communication device based on the second digital certificate is successful; performing encrypted communication with the first communication device based on the encrypted communication key; receiving a response result returned by the first communication device that does not include the first digital certificate if the data amount of the first digital certificate is equal to or less than a data amount threshold; transmitting a second key negotiation request to the first communication device in response to the response result; receiving the first digital certificate returned by the first communication device in response to the second key negotiation request; authenticating the first communication device based on the received first digital certificate; generating an encrypted communication key if the authentication is successful; conducting encrypted communication with the first communication device based on the encrypted communication key.

3. the first digital certificate includes first content and content index information corresponding to the first content; the compressed digital certificate is obtained by compressing the first content using a predetermined compression method, The step of performing integrity verification based on the second digital certificate and the compressed digital certificate includes: compressing the second content indicated by the content index information in the second digital certificate using the predetermined compression method to obtain a second compressed content; updating the second content with the second compressed content in the second digital certificate to obtain a comparison digital certificate; performing an integrity check on the comparison digital certificate and the compressed digital certificate.

4. the first digital certificate supports a quantum-resistant algorithm; The method of claim 3 , wherein the first content is content for supporting a quantum-resistant algorithm in the first digital certificate.

5. A network communication method executed by a first communication device, comprising: receiving an encrypted communication connection request sent by a second communication device; transmitting a first digital certificate to the second communication device in response to the encrypted communication connection request such that the second communication device actually receives a second digital certificate, the second digital certificate being used to authenticate to the first communication device; receiving a first key negotiation request sent by the second communication device; transmitting a compressed digital certificate to the second communication device in response to the first key negotiation request, the compressed digital certificate being obtained by compressing the first digital certificate and being used for verifying consistency with the second digital certificate; generating an encrypted communication key if the integrity verification is successful and the authentication is successful; performing encrypted communication with the second communication device based on the encrypted communication key; The step of transmitting a first digital certificate to the first communication device in response to the encrypted communication connection request includes: If the data volume of the first digital certificate is greater than a data volume threshold, transmitting the first digital certificate to the second communication device in response to the encrypted communication connection request.

6. 6. The method of claim 5, further comprising: if the certificate type of the first digital certificate is the first certificate type, determining that the data volume of the first digital certificate is greater than a data volume threshold.

7. A network communication method executed by a first communication device, comprising: receiving an encrypted communication connection request sent by a second communication device; transmitting a first digital certificate to the second communication device in response to the encrypted communication connection request such that the second communication device actually receives a second digital certificate, the second digital certificate being used to authenticate to the first communication device; receiving a first key negotiation request sent by the second communication device; transmitting a compressed digital certificate to the second communication device in response to the first key negotiation request, the compressed digital certificate being obtained by compressing the first digital certificate and being used for verifying consistency with the second digital certificate; generating an encrypted communication key if the integrity verification is successful and the authentication is successful; performing encrypted communication with the second communication device based on the encrypted communication key; If the data amount of the first digital certificate is equal to or less than a data amount threshold, returning a response result that does not include the first digital certificate to the second communication device in response to the encrypted communication connection request; receiving a second key negotiation request sent by the second communication device, and sending the first digital certificate to the second communication device in response to the second key negotiation request, the second key negotiation request being returned by the second communication device in response to a response result that does not include the first digital certificate, and the first digital certificate being used by the second communication device to authenticate the first communication device; If the authentication is successful, generating an encrypted communication key and performing encrypted communication with the second communication device based on the encrypted communication key.

8. 8. The method of claim 7, further comprising: if the certificate type of the first digital certificate is the second certificate type, determining that the data amount of the first digital certificate is less than or equal to a data amount threshold.

9. The step of transmitting a compressed digital certificate to the second communication device in response to the first key negotiation request includes: determining first content from the first digital certificate in response to the first key negotiation request; compressing the first content using a predetermined compression scheme to obtain a first compressed content; updating the first content with the first compressed content in the first digital certificate to obtain the compressed digital certificate; and transmitting the compressed digital certificate to the second communication device.

10. the first digital certificate supports a quantum-resistant algorithm; The step of determining first content from the first digital certificate includes:

10. The method of claim 9, comprising obtaining content for supporting a quantum-safe algorithm from the first digital certificate to obtain first content.

11. A network communication device configured in a second communication device, a connection request sending module that sends an encrypted communication connection request to a first communication device, the encrypted communication connection request being used to instruct the first communication device to return a first digital certificate; a certificate receiving module that receives a second digital certificate from the first communication device, the second digital certificate being a digital certificate that the second communication device actually received after the first communication device returned the first digital certificate in response to the encrypted communication connection request; a negotiation request transmission module that transmits a first key negotiation request to the first communication device and receives a compressed digital certificate returned by the first communication device in response to the first key negotiation request, the compressed digital certificate being obtained by compressing the first digital certificate; and a verification module that performs integrity verification based on the second digital certificate and the compressed digital certificate; a first key generation module that generates an encrypted communication key if the integrity verification is successful and the authentication of the first communication device based on the second digital certificate is successful; a first encrypted communication module that performs encrypted communication with the first communication device based on the encrypted communication key; The first digital certificate returned by the first communication device is returned by the first communication device in response to the encrypted communication connection request when the data volume of the first digital certificate is greater than a data volume threshold.

12. A network communication device configured in a second communication device, a connection request sending module that sends an encrypted communication connection request to a first communication device, the encrypted communication connection request being used to instruct the first communication device to return a first digital certificate; a certificate receiving module that receives a second digital certificate from the first communication device, the second digital certificate being a digital certificate that the second communication device actually received after the first communication device returned the first digital certificate in response to the encrypted communication connection request; a negotiation request transmission module that transmits a first key negotiation request to the first communication device and receives a compressed digital certificate returned by the first communication device in response to the first key negotiation request, the compressed digital certificate being obtained by compressing the first digital certificate; and a verification module that performs integrity verification based on the second digital certificate and the compressed digital certificate; a first key generation module that generates an encrypted communication key if the integrity verification is successful and the authentication of the first communication device based on the second digital certificate is successful; a first encrypted communication module that performs encrypted communication with the first communication device based on the encrypted communication key; If the data amount of the first digital certificate is equal to or less than a data amount threshold, receiving a response result returned by the first communication device that does not include the first digital certificate; In response to the response result, transmitting a second key negotiation request to the first communication device; receiving the first digital certificate returned by the first communication device in response to the second key negotiation request; authenticating the first communication device based on the received first digital certificate; If authentication is successful, an encryption key is generated. A device that performs encrypted communication with the first communication device based on the encrypted communication key.

13. A network communication device configured in a first communication device, a connection request receiving module that receives an encrypted communication connection request transmitted by a second communication device; a certificate transmission module that transmits a first digital certificate to the second communication device in response to the encrypted communication connection request so that the second communication device actually receives a second digital certificate, the second digital certificate being used to authenticate the first communication device; and a negotiation request receiving module that receives a first key negotiation request sent by the second communication device; a negotiation request response module that responds to the first key negotiation request by transmitting a compressed digital certificate to the second communication device, the compressed digital certificate being obtained by compressing the first digital certificate and being used for verifying consistency with the second digital certificate; and a second key generation module that generates an encrypted communication key if the integrity verification is successful and the authentication is successful; a second encrypted communication module that performs encrypted communication with the second communication device based on the encrypted communication key, The certificate transmission module: If the data amount of the first digital certificate is greater than a data amount threshold, the device transmits the first digital certificate to the second communication device in response to the encrypted communication connection request.

14. A network communication device configured in a first communication device, comprising: a connection request receiving module that receives an encrypted communication connection request transmitted by a second communication device; a certificate transmission module that transmits a first digital certificate to the second communication device in response to the encrypted communication connection request so that the second communication device actually receives a second digital certificate, the second digital certificate being used to authenticate the first communication device; and a negotiation request receiving module that receives a first key negotiation request sent by the second communication device; a negotiation request response module that responds to the first key negotiation request by transmitting a compressed digital certificate to the second communication device, the compressed digital certificate being obtained by compressing the first digital certificate and being used for verifying consistency with the second digital certificate; and a second key generation module that generates an encrypted communication key if the integrity verification is successful and the authentication is successful; a second encrypted communication module that performs encrypted communication with the second communication device based on the encrypted communication key, If the data amount of the first digital certificate is equal to or less than a data amount threshold, in response to the encrypted communication connection request, return a response result that does not include the first digital certificate to the second communication device; receiving a second key negotiation request sent by the second communication device; and transmitting the first digital certificate to the second communication device in response to the second key negotiation request, the second key negotiation request being returned by the second communication device in response to a response result that does not include the first digital certificate, and the first digital certificate being used by the second communication device to authenticate the first communication device; If the authentication is successful, the device generates an encrypted communication key and performs encrypted communication with the second communication device based on the encrypted communication key.

15. 11. A computing device comprising a memory having computer-readable instructions stored thereon and one or more processors, the processors, when executing the computer-readable instructions, performing the steps of the method of any of claims 1 to 10.

16. A computer program comprising computer readable instructions which, when executed by one or more processors, implement the steps of the method of any of claims 1 to 10.

Images