Method and apparatus for establishing communication connection on the basis of open secure sockets layer protocol

Abstract

An embodiment of the present application comprises: transmitting a first communication handshake request to a server, the first communication handshake request carrying first negotiation object identification information; receiving a first response message returned by the server in response to the first communication handshake request, and analyzing the first response message, so as to obtain second negotiation object identification information; when the first negotiation object identification information is not matched with the second negotiation object identification information, transmitting a second communication handshake request to the server, the second communication handshake request carrying the second negotiation object identification information, and the second communication handshake request being used for triggering the server to establish a communication connection with a client on the basis of a negotiation object corresponding to the second negotiation object identification information; and receiving a handshake success notification message returned by the server.

Description

Method and device for establishing communication connection based on open secure sockets layer protocol

[0001] The present application claims priority to the Chinese patent application No. 202410426936.4, filed on April 9, 2024, and entitled "Method and device for establishing communication connection based on OPENSSL", the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0002] The present application relates to the field of communication technology, in particular to a method and device for establishing communication connection based on open secure sockets layer protocol. BACKGROUND

[0003] In the process of establishing a communication connection between a server and a client based on an open secure sockets layer (OPENSSL), it is usually necessary to involve the negotiation of various communication parameters such as the version of the transport layer security (TLS) protocol, and after the negotiation of the various communication parameters is agreed, the security and reliability of subsequent data transmission can be ensured.

[0004] In the traditional technology, the client needs to specify the version of each communication parameter every time it attempts to connect, and through multiple attempts to connect and traversing the switching of the version of each communication parameter, until the version requirement of the server for each communication parameter is met. The above-mentioned method leads to low efficiency in establishing a communication connection, and involves relatively frequent initialization and release actions of communication resources, thereby wasting communication resources. Therefore, how to efficiently establish a communication connection and reduce communication resource consumption is a problem that needs to be solved at present. SUMMARY

[0005] The present application provides a method and device for establishing a communication connection based on an open secure sockets layer protocol, which can efficiently establish a communication connection and reduce communication resource consumption.

[0006] In one aspect, the present application provides a method for establishing a communication connection based on an open secure sockets layer protocol, the method comprising:

[0007] sending a first communication handshake request to a server; the first communication handshake request carries first negotiation object identification information;

[0008] receiving a first response message returned by the server in response to the first communication handshake request, and performing analysis and processing on the first response message to obtain second negotiation object identification information;

[0009] when the first negotiation object identification information does not match the second negotiation object identification information, sending a second communication handshake request to the server; the second communication handshake request carries the second negotiation object identification information, and the second communication handshake request is used to trigger the server to establish a communication connection with the client based on a negotiation object corresponding to the second negotiation object identification information;

[0010] receiving a handshake success notification message returned by the server.

[0011] On the other hand, the application provides a device for establishing a communication connection based on an open secure socket layer protocol, which comprises:

[0012] a communication module, configured to send a first communication handshake request to a server; the first communication handshake request carries first negotiation object identification information;

[0013] a processing module, configured to receive a first response message returned by the server in response to the first communication handshake request, and to analyze and process the first response message to obtain second negotiation object identification information;

[0014] the communication module is further configured to, when the first negotiation object identification information does not match the second negotiation object identification information, send a second communication handshake request to the server; the second communication handshake request carries the second negotiation object identification information, and the second communication handshake request is used to trigger the server to establish a communication connection with the client based on a negotiation object corresponding to the second negotiation object identification information;

[0015] the communication module is further configured to receive a handshake success notification message returned by the server.

[0016] Correspondingly, the application provides a computer device, which comprises a processor, a storage device and a communication interface, wherein the processor, the communication interface and the storage device are connected to each other, the storage device stores a computer program, and the processor is configured to call the computer program to implement the method for establishing a communication connection based on an open secure socket layer protocol.

[0017] Correspondingly, the application provides a computer readable storage medium, which stores a computer program, the computer program comprises program instructions, and the program instructions are executed by a processor to implement the method for establishing a communication connection based on an open secure socket layer protocol.

[0018] Correspondingly, the application provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the method for establishing a communication connection based on an open secure socket layer protocol.

[0019] The details of one or more embodiments of the application are set forth in the accompanying drawings and the description below. Other features, objects, and advantages of the application will be apparent from the description and drawings, and from the claims. BRIEF DESCRIPTION OF DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiment description will be briefly introduced below. Those skilled in the art can also obtain other drawings based on these drawings without any creative labor. At the same time, in order to better describe and illustrate the various embodiments in the present application, one or more drawings can be referred to, and additional details or examples used to describe the drawings should not be considered as limiting the scope of the embodiments.

[0021] FIG. 1 is a schematic diagram of an architecture of a system for establishing a communication connection based on an open secure socket layer protocol according to an example embodiment of the present application;

[0022] FIG. 2 is a flowchart of a method for establishing a communication connection based on an open secure socket layer protocol according to an example embodiment of the present application;

[0023] FIG. 3 is a flowchart of another method for establishing a communication connection based on an open secure socket layer protocol according to an example embodiment of the present application;

[0024] FIG. 4A is a flowchart of a method for establishing a communication connection according to an example embodiment of the present application;

[0025] FIG. 4B is a flowchart of a method for obtaining target version information according to an example embodiment of the present application;

[0026] FIG. 4C is a flowchart of a method for reinitiating a handshake negotiation according to an example embodiment of the present application;

[0027] FIG. 5 is a schematic diagram of a structure of an apparatus for establishing a communication connection based on an open secure socket layer protocol according to an example embodiment of the present application;

[0028] FIG. 6 is a schematic diagram of a structure of a computer device according to an example embodiment of the present application. DETAILED DESCRIPTION

[0029] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without any creative labor fall within the scope of protection of the present application.

[0030] The embodiment of the present application provides a method for establishing a communication connection based on an open secure socket layer protocol. In order to more clearly describe the scheme of the present application, some communication knowledge related to the scheme will be introduced first.

[0031] (1) Open secure socket layer protocol: OPENSSL is an open source software library package, and an application program can use the package to perform secure communication while confirming the identity of a connectioner at the other end. The OPENSSL is widely applied to products in the Internet, and is used for providing support for secure communication protocols such as HTTPS. The embodiment of the present application is based on the functions and interfaces provided by the OPENSSL to realize the communication connection between a client and a server, and subsequent embodiments will not be described again.

[0032] (2) Transport layer security protocol: TLS is a protocol for providing secure communication on an insecure network. The TLS is a subsequent version of the secure socket protocol (Secure Socket Layer, SSL), and the TLS protocol provides data confidentiality, data integrity and authentication services for an application layer protocol based on TCP / IP.

[0033] (3) Encryption suite: The encryption suite is a concept in the TLS protocol, which specifies the encryption algorithm, key exchange protocol and authentication method used by the client and the server to establish a secure connection.

[0034] (4) Compression algorithm: The compression algorithm is an algorithm used to reduce the size of data to save storage space or transmission time. In the TLS protocol, the compression algorithm is part of the negotiation in the handshake phase, and is an algorithm used to compress data before encryption.

[0035] The present application will be described through the following embodiments.

[0036] Please refer to FIG. 1, which is an architecture schematic diagram of a system for establishing a communication connection based on an open secure socket layer protocol according to an exemplary embodiment of the present application. The system for establishing a communication connection based on an open secure socket layer protocol can specifically include a client 101 and a server 102. The client 101 and the server 102 are connected through a network, for example, connected through a local area network, a wide area network, a mobile Internet and the like.

[0037] The client 101 is also referred to as a terminal, a user equipment (UE), an access terminal, a user unit, a mobile device, a user terminal, a wireless communication device, a user agent or a user apparatus. The terminal device can be a smart home appliance, a handheld device (for example, a smart phone, a tablet computer) with a wireless communication function, a computing device (for example, a personal computer (PC)), a vehicle-mounted terminal, a smart voice interaction device, a wearable device or other smart devices, but is not limited thereto.

[0038] The server 102 can be a standalone physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and basic cloud computing services such as big data and artificial intelligence platforms.

[0039] In one possible implementation, the client 101 can send a first communication handshake request carrying first negotiation object identification information to the server 102, the server 102 returns a first response message to the client 101 in response to the first communication handshake request, the client 101 parses the first response message to obtain second negotiation object identification information, and when the first negotiation object identification information and the second negotiation object identification information do not match, the client 101 sends a second communication handshake request carrying the second negotiation object identification information to the server 102, the second communication handshake request is used to trigger the server 102 to establish a communication connection with the client 101 based on a negotiation object corresponding to the second negotiation object identification information, and finally, the client 101 receives a handshake success notification message returned by the server 102. The negotiation object described above can be a TLS communication protocol, and the negotiation object identification information can be a version information of the TLS communication protocol.

[0040] It can be understood that the architecture diagram of the system described in the embodiments of the present application is used to more clearly illustrate the technical solutions of the embodiments of the present application, and does not constitute a limitation on the technical solutions provided by the embodiments of the present application. It can be known by those skilled in the art that the number of clients and servers in FIG. 1 is illustrative. According to the needs of business implementation, any number of clients and servers can be configured. Moreover, as the system architecture evolves and new business scenarios appear, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems. In subsequent embodiments, the client will refer to the above-mentioned client 101, and the server will refer to the above-mentioned server 102, which will not be described in detail in subsequent embodiments.

[0041] The method embodiment of the embodiment of the application is introduced below.

[0042] Please refer to FIG. 2, which is a flowchart of a method for establishing a communication connection based on an open secure socket layer protocol according to an exemplary embodiment of the application. The method can be applied to the client in FIG. 1.

[0043] The method for establishing a communication connection based on an open secure socket layer protocol as shown in FIG. 2 can include multiple steps in steps S201-S204. It should be understood that the application is described in this order for the convenience of description, and is not intended to limit the execution in the above order. The embodiment of the application does not limit the order of execution, the time of execution, the number of execution, etc. of one or more steps. Steps S201-S204 are as follows:

[0044] S201, sending a first communication handshake request to a server; the first communication handshake request carries first negotiation object identification information.

[0045] In the embodiment of the application, the client sends the first communication handshake request to the server to start the first handshake phase (such as the handshake negotiation process) in the communication connection between the server and the client. In the first handshake phase, the client needs to negotiate with the server for the negotiation object, which is the communication parameter of the communication connection between the server and the client. After the server and the client negotiate the communication parameter and reach an agreement, the security and reliability of subsequent data transmission can be ensured. Therefore, the client adds the first negotiation object identification information of the negotiation object to the first communication handshake request, so that the client and the server can negotiate the communication parameter. The first negotiation object identification information is the identification information of the negotiation object expected to be used by the client, and the first negotiation object identification information is used to indicate a specific version or a specific type of negotiation object.

[0046] In one possible implementation, the client sending the first communication handshake request to the server can mean that, in the first handshake phase, the client sends a client hello message such as a ClientHello message to the server.

[0047] S202, receiving a first response message returned by the server in response to the first communication handshake request, and performing parsing processing on the first response message to obtain second negotiation object identification information.

[0048] In the embodiment of the present application, after receiving the first communication handshake request, the server responds to the first communication handshake request and returns a first response message to the client. The client can obtain second negotiation object identification information by analyzing and processing the first response message. The second negotiation object identification information is added to the first response message by the server. The second negotiation object identification information is the identification information of the negotiation object expected to be used by the server, and is used to indicate a specific version or a specific type of negotiation object.

[0049] In a possible implementation, the first response message can refer to a server greeting message returned by the server to the client after receiving the ClientHello message sent by the client in the first handshake phase, such as a ServerHello message returned by the server to the client.

[0050] S203, when the first negotiation object identification information and the second negotiation object identification information do not match, sending a second communication handshake request to the server; the second communication handshake request carries the second negotiation object identification information.

[0051] In the embodiment of the present application, when the first negotiation object identification information and the second negotiation object identification information do not match (that is, the negotiation object expected to be used by the client and the negotiation object expected to be used by the server are different), the client can send a second communication handshake request carrying the second negotiation object identification information to the server. The second communication handshake request is used to trigger the server and the client to establish a communication connection based on the negotiation object corresponding to the second negotiation object identification information. This enables the client to realize adaptive switching of the negotiation object in the negotiation process of the negotiation object in the first handshake phase in which the server and the client establish a communication connection, thereby meeting the demand of the server for the negotiation object expected to be used, so as to facilitate the normal establishment of the communication connection between the client and the server.

[0052] In a possible implementation, the client sending the second communication handshake request to the server can refer to the client re-sending a client greeting message, such as a ClientHello message, to the server in the first handshake phase.

[0053] S204, receiving a handshake success notification message returned by the server.

[0054] In the embodiments of the present application, when the server and the client reach an agreement on the negotiation object, it indicates that the server and the client successfully perform the handshake, and then the client can receive the handshake success notification message returned by the server, and the handshake success notification message is used to indicate that the server and the client successfully perform the handshake. The above method enables the client to realize adaptive switching of the negotiation object in the process of negotiating with the server for the negotiation object, and then a set of agreed negotiation objects (such as communication parameters) can be negotiated (such as through consensus) to establish a secure and reliable communication connection.

[0055] It should be noted that the process of establishing a communication connection between the server and the client can at least include a first handshake stage and a subsequent handshake stage. After the server and the client successfully perform the handshake in the first handshake stage, the server and the client can continue to perform the subsequent handshake stage until the communication connection is successfully established. Based on this, the handshake success notification message received by the client in the embodiments of the present application can be sent by the server after the server and the client successfully perform the handshake in the first handshake stage, or can be sent by the server after the server and the client successfully perform the handshake in the subsequent handshake stage, which is not limited in the embodiments of the present application.

[0056] Based on the above embodiments, the beneficial effects of the present application are that: in the embodiments of the present application, the client sends a first communication handshake request carrying first negotiation object identification information to the server, the client obtains second negotiation object identification information by analyzing the first response message returned by the server, when the first negotiation object identification information and the second negotiation object identification information do not match, the client sends a second communication handshake request carrying the second negotiation object identification information to the server, so as to trigger the server and the client to establish a communication connection based on the negotiation object corresponding to the second negotiation object identification information, and then the client receives the handshake success notification message returned by the server. The above method enables the client to realize adaptive switching of the negotiation object (such as communication parameters) in the negotiation process for the negotiation object when the server and the client establish a communication connection, and then a set of agreed negotiation objects can be negotiated, which effectively reduces the number of attempts to connect, thereby efficiently establishing a communication connection and reducing communication resource consumption.

[0057] Please refer to FIG. 3, which is a flowchart of another method for establishing a communication connection based on an open secure sockets layer protocol provided by an exemplary embodiment of the present application, which can be applied to the client in FIG. 1.

[0058] The method for establishing a communication connection based on the open secure socket layer protocol as shown in FIG. 3 can include multiple steps among steps S301-S307. It should be understood that, for the convenience of description, the steps S301-S307 are described in this order, and it is not intended to limit the execution in the above order. The embodiments of the present application do not limit the order of execution, the time of execution, the number of execution, etc. of one or more steps. Steps S301-S307 are as follows:

[0059] S301, sending a first communication handshake request to the server; the first communication handshake request carries first negotiation object identification information.

[0060] In one possible implementation, the negotiation object can be one or more of the communication protocol, the encryption suite, the compression algorithm. Then, the client can add the identification information corresponding to one or more objects of the communication protocol, the encryption suite, the compression algorithm in the first communication handshake request. This enables the synchronization negotiation of multiple communication parameters in one negotiation process between the client and the server, ensuring the negotiation efficiency, and the synchronization negotiation of multiple communication parameters between the client and the server can ensure the compatibility and stability of the communication connection, reducing the possibility of various abnormalities in the communication process.

[0061] Among them, the communication protocol defines the rules and formats of data exchange between the client and the server. When establishing a communication connection, the client and the server need to negotiate and select the communication protocol to be used, so as to ensure that both parties can understand and follow the same communication rules, and thus smoothly carry out data exchange.

[0062] The encryption suite includes encryption algorithms, key exchange algorithms, and digital signature algorithms, etc., which are used to protect the security of data in the communication process. When establishing a communication connection, the client and the server need to negotiate and select a suitable encryption suite to ensure that data encryption and identity authentication can be effectively carried out in the communication process.

[0063] The compression algorithm is used to reduce the amount of data in the data transmission process and improve the communication efficiency. When establishing a communication connection, the client and the server can negotiate whether to enable data compression and select a suitable compression algorithm to reduce the cost and time of data transmission.

[0064] In one possible implementation, the communication protocol can refer to the transport layer security protocol, such as the TLS protocol, which has multiple versions, such as TLS1.0, TLS1.1, TLS1.2, TLS1.3, etc. For the convenience of description, the negotiation object as the communication protocol will be described in the subsequent embodiments.

[0065] S302, receiving a first response message returned by the server in response to the first communication handshake request, and performing parsing processing on the first response message to obtain second negotiation object identification information.

[0066] S303, determining whether the first negotiation object identification information and the second negotiation object identification information match.

[0067] The specific implementation of steps S302-S303 can refer to the description of the related steps in the foregoing embodiments, and will not be described here.

[0068] When the first negotiation object identification information and the second negotiation object identification information do not match, for example, the TLS protocol version carried in the first communication handshake request is different from the TLS protocol version carried in the first response message, the client can perform the following steps S304-S306:

[0069] S304, sending a second communication handshake request to the server; the second communication handshake request carries the second negotiation object identification information.

[0070] The second communication handshake request is used to trigger the server to establish a communication connection with the client based on the negotiation object corresponding to the second negotiation object identification information. The specific implementation of step S304 can refer to the description of the related steps in the foregoing embodiments, and will not be described here.

[0071] S305, releasing the communication resource related to the first communication handshake request.

[0072] In the embodiments of the present application, the client sending the second communication handshake request to the server can mean that the client initiates a new handshake negotiation process to the server. Therefore, the client can release the communication resource related to the first communication handshake request, so as to avoid waste of communication resources and ensure effective use of system resources.

[0073] In one possible implementation, the communication resource related to the first communication handshake request can include one or more of the following: network connection resource (network connection established by the client and the server, including socket connection, etc.), memory resource (memory space allocated by the client for processing the first communication handshake request, including memory for temporarily storing communication parameters and handshake state), CPU resource (CPU computing resource allocated by the client when processing the communication handshake request).

[0074] S306, receiving a handshake success notification message returned by the server.

[0075] In the embodiment of the present application, the client receives the handshake success notification message sent by the server, which indicates that the communication handshake process between the client and the server has been successfully completed, at this time, the client can start secure communication with the server, and the security and reliability of data transmission can be ensured.

[0076] In one possible implementation, since the server can change the negotiation object expected to be used due to business changes, the negotiation object identification information carried in the second response message returned by the server will also change in the case of change of the negotiation object. Therefore, in order to further determine whether the negotiation object expected to be used by the server changes at the current time, the client can further interact with the server as follows:

[0077] (1) receiving the second response message returned by the server in response to the second communication handshake request, and performing parsing processing on the second response message to obtain third negotiation object identification information.

[0078] (2) when the second negotiation object identification information matches the third negotiation object identification information, determining that the negotiation of the current handshake phase of the communication connection with the server is passed.

[0079] In the above steps (1)-(2), the client obtains the third negotiation object identification information by parsing the second response message returned by the server, and the client can confirm whether the negotiation object expected to be used by the server changes by comparing the second negotiation object identification information and the third negotiation object identification information.

[0080] When the second negotiation object identification information matches the third negotiation object identification information (such as the second negotiation object identification information is the same as the third negotiation object identification information), it indicates that the negotiation of the current handshake phase of the communication connection between the client and the server is passed. The above method ensures the consistency of the negotiation parameters between the client and the server, avoids the communication connection exception caused by frequent changes of the server parameters, and further ensures the security and reliability of the communication connection.

[0081] It should be noted that when the second negotiation object identification information does not match the third negotiation object identification information, it indicates that the negotiation object expected to be used by the server changes, then the client will send a new communication handshake request to the server, and the client will also perform release processing of the communication resources related to the second communication handshake request, which will not be described here.

[0082] (3) performing negotiation of the subsequent handshake phase of the current handshake phase with the server; wherein the handshake success notification message is returned by the server to the client when it is determined that the negotiation of the subsequent handshake phase is passed.

[0083] In the embodiment of the present application, after the negotiation in the current handshake phase is passed, the client continues to negotiate with the server in the subsequent handshake phase (i.e., further negotiates other communication parameters), and when the negotiation in the current handshake phase and the subsequent handshake phase are both passed, it indicates that the handshake between the client and the server is successful, and the client can receive the handshake success notification message sent by the server, thereby indicating that the communication connection is successfully established.

[0084] In one possible implementation, the negotiation in the subsequent handshake phase can include negotiation for one or more of the following other communication parameters, which can include but are not limited to:

[0085] Generation and update of session key: After the communication connection is established, the client and the server can negotiate to generate a session key and update it regularly to improve the security of the communication.

[0086] Certificate verification and identity authentication: After the communication connection is established, the client and the server can further verify the identity of the other party and perform additional identity authentication operations to ensure the legitimacy of the identity of the communication parties.

[0087] Optimization and adjustment of communication parameters: After the communication connection is established, the client and the server can adjust the communication parameters according to the actual situation to optimize the communication efficiency and performance.

[0088] When the first negotiation object identification information matches the second negotiation object identification information, such as the TLS protocol version carried in the first communication handshake request being the same as the TLS protocol version carried in the first response message, the client can perform the following step S307:

[0089] S307, receiving the handshake success notification message returned by the server.

[0090] In the embodiment of the present application, the client receives the handshake success notification message sent by the server, which indicates that the communication handshake process between the client and the server has been successfully completed, at this time, the client can start secure communication with the server and can ensure the security and reliability of data transmission.

[0091] In one possible implementation, the client can store the negotiation objects expected to be used by each server in real time, so as to facilitate reconnection according to the stored negotiation objects expected to be used by each server when the communication connection is abnormal. Based on this, the client can also interact with the server as follows:

[0092] (1) updating the second negotiation object identification information to the negotiation object database corresponding to the server.

[0093] In a possible implementation, the client can locally store a negotiation object database corresponding to each server. The embodiments of the present application are described by taking a client and a server as an example. The client can set a negotiation object database for each server, or the client can set the same negotiation object database for multiple servers.

[0094] The negotiation object database stores the related information of the negotiation object expected to be used at the latest time corresponding to the server. The related information can be the identification information (such as version identification information) of the negotiation object, the indication information (such as the name and type of the negotiation object), and the like.

[0095] (2) When detecting that the communication connection with the server is disconnected, obtaining second negotiation object identification information from the negotiation object database, and generating a third communication handshake request according to the second negotiation object identification information.

[0096] In a possible implementation, the disconnection of the communication connection can be caused by the following reasons: network failure (network interruption, router failure, server or client network interface failure, and the like), server or client failure (server or client software crash, hardware failure, and the like), communication timeout (communication timeout caused by excessive communication delay or network congestion), authentication failure (identity verification failure of the communication parties, causing the communication connection to be interrupted), security policy limitation (security policy change or violation behavior detection, causing the communication connection to be interrupted), and the like.

[0097] (3) The third communication handshake request is used to trigger the server to establish a communication connection with the client based on the negotiation object corresponding to the second negotiation object identification information.

[0098] In the embodiments of the present application, when the client detects that the communication connection with the server is disconnected, the client can quickly obtain the previously saved negotiation object identification information from the negotiation object database, and reattempt to establish a communication connection with the server, thereby reducing the time for recovering the communication connection and improving the reliability of the communication connection.

[0099] In a possible implementation, the client can further interact with the server as follows: when the first response message is parsed and processed, and the second negotiation object identification information is not obtained, the first communication handshake request is re-sent to the server.

[0100] In the above step, when the client cannot parse the second negotiation object identification information from the first response message (such as the ServerHello message), the client sends the first communication handshake request to the server again, which enables the client to perform a new communication handshake process with the server, so as to parse new negotiation object identification information in the new communication handshake process, thereby re-determining the negotiation object expected to be used by the server. The above method can ensure that the finally determined negotiation object is real and valid, thereby improving the success rate of communication connection.

[0101] In one possible implementation, if the client fails to parse the second negotiation object identification information from the first response message, it can be caused by one or more of the following reasons: server configuration exception, communication error or data loss (error or data packet loss occurs in the communication process, which causes the client to fail to correctly receive the second negotiation object identification information sent by the server), protocol parsing error (protocol parsing error of the client or the server causes the second negotiation object identification information to be unable to be correctly parsed), and the like.

[0102] In one possible implementation, the client can further interact with the server as follows: after parsing the first response message to obtain the second negotiation object identification information, the client performs validity verification on the second negotiation object identification information; and when the validity verification on the second negotiation object identification information fails, the client sends the first communication handshake request to the server again.

[0103] In the above step, when the client parses the second negotiation object identification information from the first response message (such as the ServerHello message), and the validity verification on the second negotiation object identification information fails, it indicates that the second negotiation object identification information is invalid or incorrect. Therefore, the client can send the first communication handshake request to the server again, which enables the client to perform a new communication handshake process with the server, so as to parse new negotiation object identification information in the new communication handshake process, thereby re-determining the negotiation object expected to be used by the server. The above method can ensure that the finally determined negotiation object is real and valid, thereby improving the success rate of communication connection.

[0104] In a possible implementation, the validity verification refers to checking and confirming the content of the second negotiation object identification information to ensure its legitimacy, authenticity and trustworthiness. The validity verification can include verification in one or more of the following dimensions: content integrity verification (verifying whether the received second negotiation object identification information is tampered with and whether data loss occurs in the transmission process), legitimacy verification (confirming whether the second negotiation object identification information conforms to the expected format, structure and specification), identity verification (verifying the authenticity and legitimacy of the identity information corresponding to the second negotiation object identification information, such as the signature of the second negotiation object identification information), and the like.

[0105] The method for establishing a communication connection based on the open SSL protocol provided by the embodiments of the present application will be described below by taking the negotiation object as the TLS protocol as an example:

[0106] In the embodiments of the present application, the client can use an existing version number A (such as TLS 1.2) of the TLS protocol to initialize a communication handshake request and send the communication handshake request to the server to initiate a first round of handshake negotiation. The client obtains the version number B (such as TLS 1.3) of the target TLS protocol of the server by analyzing the message information (such as a first response message) returned by the server in the first handshake phase of the first round of handshake negotiation. Then, the client exits the process of the current round of handshake negotiation in the second handshake phase of the first round of handshake negotiation, modifies the version number A in the handshake handle of the client to the version number B of the server, and initiates a second round of handshake negotiation to the server again based on the modified handshake handle. Based on the above process, the client and the server perform handshake successfully. The above method enables the external Socket socket to adaptively switch the TLS protocol version without awareness. After the client is connected to the server, the subsequent transmission of encrypted data can be normally performed.

[0107] As shown in FIG. 4A, which is a flowchart of establishing a communication connection provided by an example embodiment of the present application, the main process can be as follows: the client enters the socket creation process (such as the Socket Create process), then the client attempts to connect to the server (such as the Connect process), then the client performs SSL initialization (such as the SSL Init Process process), then the client obtains the server response message (such as the Get Server Hello process), the client obtains the server TLS protocol version by analyzing the response message, and determines whether the server TLS protocol version is the same as the client TLS protocol version (such as the step “determine whether the protocol versions are the same” in FIG. 4A). If they are the same, the client and the server complete the establishment of the communication connection. Based on this, the server and the client can perform data transmission; if they are not the same, the client reenters the process of attempting to connect to the server.

[0108] The client creates a socket in the application layer and synchronously completes the initialization process of the SSL. The initialization process of the SSL can be implemented through a SecureSocket function interface. In the initialization process, the client first performs necessary check operations to ensure the normal operation of the SSL / TLS, then the client selects (or reselects) a TLS protocol version and formulates a protocol processing method corresponding to different versions, the client then calls an SSL_Ctx_New function to create a new context and load certificate and private key information, and the like, and can complete the SSL initialization. The specific steps can be as follows:

[0109] 1. The client establishes a new SSL context through an SSL_Ctx_New handle after creating a socket and loads security information related to SSL / TLS communication, such as a local certificate, a private key information file, a CA certificate, and the like. Meanwhile, the OPENSSL checks the loaded certificate to ensure that the loaded certificate file matches the private key, so as to ensure the security of the communication.

[0110] 2. After the client successfully creates an SSL connection through an SSL_New function, the client binds the SSL connection with a corresponding socket and retains an extension setting item, such as a server name indication (SNI), for subsequent use.

[0111] 3. In the OPENSSL negotiation process, the target TLS version of the server obtained by the state machine in the handshake stage is saved in a global cache, and the target TLS version is transmitted as a parameter in the second re-binding of the socket.

[0112] As shown in FIG. 4B, which is a flowchart of obtaining target version information according to an example embodiment of the present application. The operation of the client to obtain the target version information of the server occurs in the state of waiting for a server response message in the first handshake stage (such as the SSL3_ST_CR_SRVR_HELLO_B state). Specifically, the client sends a communication handshake request (such as selecting version A) carrying version A to the server, and receives a response message of the server. The client obtains target version information (such as version B) by parsing the response message. When the client determines that the versions are inconsistent, the client can reselect a version (such as version B) and send a corresponding communication handshake request to the server, and then enters the state of waiting for a server response message. Meanwhile, the client exits the current handshake negotiation process.

[0113] As shown in FIG. 4C, FIG. 4C is a flowchart of reinitiating the handshake negotiation according to an example embodiment of the present application. The SSL handshake process can be completed by the cooperation of the SSL_Accept and SSL_Connect functions, the SSL_Accept function is used for the server to receive the SSL connection request from the client, and the SSL_Connect function is used for the client to initiate the SSL connection request to the server. The client can initiate the handshake negotiation process by the socket method (UtaSockInetConnectSecSock method) of connecting the target server. When the client's SSL_Connect function judges that the versions of the TLS protocols are inconsistent, the client needs to exit the handshake negotiation process and release the communication resources to ensure that the new handshake negotiation process can be normally performed. Then, the client needs to reinitiate the handshake negotiation process to the server.

[0114] The effect of the present scheme is tested by taking the embedded communication module environment as an example. By connecting the test servers of the TLS1.2 and TLS1.0 versions without specifying the server TLS version, it is found that the client can successfully connect the test servers of the TLS1.2 / TLS1.0 versions and normally perform the data encryption transmission service, thereby proving the effectiveness and feasibility of the present scheme.

[0115] In the above various embodiments, the method for establishing the communication connection based on the open SSL protocol can provide a more secure, efficient and simple connection mode for various scenarios involving the client encryption connection. When the client does not know the server TLS protocol version (encryption suite, compression algorithm, and the like), the handshake connection can be independently and adaptively encrypted according to the TLS protocol version, the connection operation is simplified, and the operation is more efficient in some client and server connection scenarios. Meanwhile, more operability is added on the basis of the TLS security session model. The present scheme can save network resources and improve the operation efficiency. For example, in the network scene requiring network and basic hardware control concurrency, the present scheme will be very suitable. Moreover, the present scheme has small code redundancy, can increase the code readability, and reduce the bug risk.

[0116] The above method for establishing the communication connection based on the open SSL protocol can be regarded as a TLS version adaptive method based on the open SSL protocol. When the client initiates the communication connection to the server, the target TLS version number of the server can be effectively obtained according to the response message of the server, the TLS version number on the client side is corrected according to the target TLS version number, the communication connection is reinitiated by the client to the server, and then the effective encryption connection is realized, the symmetric encryption operation in the complex scene is efficiently performed, and the operation convenience is ensured.

[0117] Please refer to Figure 5, which is a structural schematic diagram of an apparatus for establishing a communication connection based on an open secure socket layer protocol according to an embodiment of the present application. The apparatus for establishing a communication connection based on an open secure socket layer protocol can specifically include:

[0118] The communication module 501 is configured to send a first communication handshake request to a server, wherein the first communication handshake request carries first negotiation object identification information.

[0119] The processing module 502 is configured to receive a first response message returned by the server in response to the first communication handshake request, and to parse the first response message to obtain second negotiation object identification information.

[0120] The communication module 501 is further configured to send a second communication handshake request to the server when the first negotiation object identification information and the second negotiation object identification information do not match, wherein the second communication handshake request carries the second negotiation object identification information, and the second communication handshake request is used to trigger the server to establish a communication connection with a client based on a negotiation object corresponding to the second negotiation object identification information.

[0121] The communication module 501 is further configured to receive a handshake success notification message returned by the server.

[0122] In one possible implementation, the communication module 501 is further configured to:

[0123] When the first negotiation object identification information and the second negotiation object identification information match, the communication module 501 is configured to receive a handshake success notification message returned by the server.

[0124] In one possible implementation, the processing module 502 is further configured to:

[0125] When the first negotiation object identification information and the second negotiation object identification information do not match, the processing module 502 is configured to release communication resources related to the first communication handshake request.

[0126] In one possible implementation, the negotiation object is one or more of a communication protocol, an encryption suite, and a compression algorithm.

[0127] In one possible implementation, the processing module 502 is further configured to:

[0128] The processing module 502 is configured to receive a second response message returned by the server in response to the second communication handshake request, and to parse the second response message to obtain third negotiation object identification information.

[0129] determining that the negotiation of the current handshake phase of the communication connection with the server is successful;

[0130] negotiating a subsequent handshake phase of the current handshake phase with the server; wherein the handshake success notification message is returned by the server to the client when it is determined that the negotiation of the subsequent handshake phase is successful.

[0131] In one possible implementation, the processing module 502 is further configured to:

[0132] updating the second negotiation object identification information into the negotiation object database corresponding to the server;

[0133] when detecting that the communication connection with the server is disconnected, obtaining the second negotiation object identification information from the negotiation object database, and generating a third communication handshake request according to the second negotiation object identification information;

[0134] sending the third communication handshake request to the server; the third communication handshake request is used to trigger the server to establish a communication connection with the client based on the negotiation object corresponding to the second negotiation object identification information.

[0135] In one possible implementation, the processing module 502 is further configured to:

[0136] when the first response message is parsed and the second negotiation object identification information is not obtained, re-sending the first communication handshake request to the server.

[0137] In one possible implementation, the processing module 502 is further configured to:

[0138] after the first response message is parsed and the second negotiation object identification information is obtained, performing validity verification on the second negotiation object identification information;

[0139] when the validity verification on the second negotiation object identification information fails, re-sending the first communication handshake request to the server.

[0140] It should be noted that the functions of each functional module of the device for establishing a communication connection based on an open secure sockets layer protocol according to the embodiments of the present application can be implemented according to the methods in the above method embodiments, and the specific implementation process can refer to the related description of the above method embodiments, which will not be described here.

[0141] Referring to FIG. 6, FIG. 6 is a structural schematic diagram of a computer device provided in an embodiment of the present application. The computer device in the embodiment shown in FIG. 6 can include a processor 601, a storage device 602, and a communication interface 603. The processor 601, the storage device 602, and the communication interface 603 can exchange data.

[0142] The storage device 602 can include a volatile memory, for example, a random-access memory (RAM). The storage device 602 can also include a non-volatile memory, for example, a flash memory, a solid-state drive (SSD), or the like. The storage device 602 can also include a combination of the above-mentioned memories.

[0143] The processor 601 can be a central processing unit (CPU). In an embodiment, the processor 601 can also be a graphics processing unit (GPU). The processor 601 can also be a combination of a CPU and a GPU. In a possible implementation, the storage device 602 is configured to store a computer program, and the processor 601 is configured to invoke the computer program to execute the steps in the methods provided in the embodiments of the present application.

[0144] In specific implementations, the processor 601, the storage device 602, and the communication interface 603 described in the embodiments of the present application can perform the implementation manners described in the related embodiments of the method for establishing a communication connection based on an open secure sockets layer protocol provided in the foregoing embodiments of the present application (for example, the embodiments of the method provided in FIG. 2 or FIG. 3), and can also perform the implementation manners described in the related embodiments of the apparatus for establishing a communication connection based on an open secure sockets layer protocol provided in the embodiments of the present application (for example, the embodiments of the apparatus provided in FIG. 5). Details are not described herein again.

[0145] In several embodiments of the present application, it should be understood that the disclosed methods, devices, and systems can be implemented in other ways. The device embodiments described above are illustrative, and the division of the units is a logical function division. In actual implementation, another division manner can be used, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units or components shown or discussed can be indirect coupling or communication connection through some interfaces, devices, or units, and can be electrical, mechanical, or other forms.

[0146] In addition, it should be noted that the embodiments of the present application also provide a computer readable storage medium, and the computer readable storage medium stores a computer program executed by the device for establishing a communication connection based on the open secure socket layer protocol mentioned above, and the computer program includes program instructions, and when the processor executes the program instructions, the method in the foregoing embodiments can be executed, and thus, details will not be described herein. In addition, the beneficial effects of using the same method will not be described herein. For technical details not disclosed in the embodiments of the computer readable storage medium involved in the present application, please refer to the description of the method embodiments of the present application. As an example, the program instructions can be deployed on one computer device, or executed on multiple computer devices located in one place, or executed on multiple computer devices distributed in multiple places and interconnected through a communication network. The multiple computer devices distributed in multiple places and interconnected through a communication network can constitute a blockchain system.

[0147] According to an aspect of the present application, a computer program product is provided, which includes a computer program stored in a computer readable storage medium. A processor of a computer device reads the computer program from the computer readable storage medium, and the processor executes the computer program, so that the computer device can execute the method in the foregoing embodiments, and thus, details will not be described herein.

[0148] It can be understood by those skilled in the art that all or part of the processes in the above-mentioned embodiments can be completed by a computer program instructing related hardware. The above-mentioned program can be stored in a computer readable storage medium, and when the program is executed, the processes of the above-mentioned embodiments can be included. The storage medium can be a magnetic disc, an optical disc, a read-only memory (ROM) or a random access memory (RAM) and the like.

[0149] It should be understood that although each step in FIG. 2, FIG. 3, FIG. 4A, FIG. 4B and FIG. 4C is displayed in sequence according to the direction of the arrow, these steps are not necessarily executed in the order indicated by the arrow. In addition, at least part of the steps in the figure can include multiple sub-steps or multiple stages, and these sub-steps or stages can be executed at the same time, or at different times, and the execution order can be sequential, or alternately or alternately with at least part of other steps or sub-steps or stages of other steps.

[0150] It can be understood that in the specific embodiments of the present application, the data related to the communication handshake request, response message and the like are involved, and when the above embodiments of the present application are applied to specific products or technologies, the collection, use and processing of the related data need to comply with the relevant regulations and standards of the relevant regions.

[0151] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined target, and can be implemented entirely or partially by using software, hardware (such as a processing circuit or a memory) or a combination thereof. Similarly, one processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be a part of an integral module or unit that includes the functions of the module or unit.

[0152] It should be noted that the "first", "second", and the like described in the embodiments of the present application are only for the purpose of description, and cannot be understood as indicating or implying the relative importance of the technical features or implicitly indicating the number of the technical features indicated. Therefore, the technical features limited by "first", "second" can explicitly or implicitly include at least one of the features.

[0153] The above only discloses some embodiments of the present application, and of course cannot limit the scope of the rights of the present application, and those of ordinary skill in the art can understand that all or part of the processes of the above embodiments are implemented, and equivalent changes made according to the claims of the present application still belong to the scope covered by the present application.

Claims

1. A method for establishing a communication connection based on an open secure socket layer protocol, characterized in that: The method comprises: Sending a first communication handshake request to the server; the first communication handshake request carries first negotiation object identification information; receiving a first response message returned by the server in response to the first communication handshake request, and parsing the first response message to obtain second negotiation object identification information; When the first negotiation object identification information does not match the second negotiation object identification information, sending a second communication handshake request to the server; the second communication handshake request carries the second negotiation object identification information, and the second communication handshake request is used to trigger the server and the client to establish a communication connection based on the negotiation object corresponding to the second negotiation object identification information; Receive a handshake success notification message returned by the server.

2. The method according to claim 1, wherein The method further comprises: When the first negotiation object identification information matches the second negotiation object identification information, a handshake success notification message returned by the server is received.

3. The method according to claim 1, wherein The method further comprises: When the first negotiation object identification information does not match the second negotiation object identification information, the communication resources related to the first communication handshake request are released.

4. The method according to any one of claims 1 to 3, wherein The method further comprises: receiving a second response message returned by the server in response to the second communication handshake request, and parsing the second response message to obtain third negotiation object identification information; When the second negotiation object identification information matches the third negotiation object identification information, determining that the negotiation of the current handshake phase of the communication connection with the server is passed; Negotiate with the server a subsequent handshake phase of the current handshake phase; wherein the handshake success notification message is returned by the server to the client when determining that the negotiation of the subsequent handshake phase is passed.

5. The method according to any one of claims 1 to 3, wherein The method further comprises: Updating the identification information of the second negotiation object into the negotiation object database corresponding to the server; When it is detected that the communication connection with the server is disconnected, acquiring the second negotiation object identification information from the negotiation object database, and generating a third communication handshake request according to the second negotiation object identification information; The third communication handshake request is sent to the server; the third communication handshake request is used to trigger the server and the client to establish a communication connection based on the negotiation object corresponding to the second negotiation object identification information.

6. The method according to any one of claims 1 to 3, wherein The method further comprises: When the first response message is parsed and the second negotiation object identification information is not obtained, the first communication handshake request is resent to the server.

7. The method according to any one of claims 1 to 3, wherein The method further comprises: After parsing the first response message to obtain the second negotiation object identification information, verifying the validity of the second negotiation object identification information; When the validity verification of the second negotiation object identification information fails, the first communication handshake request is resent to the server.

8. A device for establishing a communication connection based on an open secure socket layer protocol, characterized in that: The device comprises: A communication module, configured to send a first communication handshake request to a server; the first communication handshake request carries first negotiation object identification information; a processing module, configured to receive a first response message returned by the server in response to the first communication handshake request, and parse the first response message to obtain second negotiation object identification information; The communication module is further configured to send a second communication handshake request to the server when the first negotiation object identification information does not match the second negotiation object identification information; the second communication handshake request carries the second negotiation object identification information, and the second communication handshake request is used to trigger the server and the client to establish a communication connection based on the negotiation object corresponding to the second negotiation object identification information; The communication module is further configured to receive a handshake success notification message returned by the server.

9. A computer device, characterized in that: include: A processor, a storage device, and a communication interface, wherein the processor, the communication interface, and the storage device are interconnected, wherein the storage device stores a computer program, and the processor is used to call the computer program to implement the method for establishing a communication connection based on the open secure socket layer protocol as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which includes program instructions. When the program instructions are executed by a processor, they are used to implement the method for establishing a communication connection based on the open secure socket layer protocol according to any one of claims 1 to 7.

Images