TWI662817B - Connection method and connection system - Google Patents

Abstract

A connection method and a connection system. The connection system includes a server, a proxy host, and a client device. After the proxy host receives the connection request sent from the initialization program of the client device, the proxy host encrypts the connection program and the verification program to obtain encrypted data, and sends the encrypted data to the client device. The client device decrypts the encrypted data to obtain a connection program and a verification program. On the client device, the connection program connects with the proxy host, and the verification program sends a verification code to the proxy host. When the proxy host determines that the verification code is correct, the proxy host establishes a connection between the client device and the server.

Description

Connection method and connection system

The present invention relates to a connection mechanism, and more particularly, to a connection method and a connection system for verifying connection security.

The Internet of Things (IoT) originally meant that everything was connected to each other based on a certain method, and then it was derived as a network that allows all ordinary objects that can perform independent functions to achieve interconnection. Through the Internet of Things, you can use a central computer to centrally manage and control machines, devices, and personnel. You can also remotely control home devices and cars, search for locations, and prevent theft of items. Similar automated control systems. For example, objects are installed with sensors, smart chips, etc., so that items can actively send certain messages to the center console, and humans receive these messages through the center console to understand the perception behavior of the object itself: for example, through the center controller We can learn the information of the car engine identified by the sensors, and then arrange maintenance operations.

With the development and popularity of the Internet of Things, security issues have also increased. Regardless of the simple or complex IoT architecture, a system is still needed to process various requests and messages, and then transmit them to the center console. Because this system lacks uniformity, it is difficult for traditional defense methods to effectively protect the system. . According to this, how to identify the authenticity of the sensors installed outside is a subject of current security considerations.

The invention provides a connection method and a connection system, which can confirm whether a client device is a safe and trusted device.

The connection method of the present invention includes: sending a connection request to the proxy host through an initialization program of the client device; after the proxy host receives the connection request, encrypting the connection program and the verification program through the proxy host to obtain encrypted data , And send encrypted data to the client device; decrypt the encrypted data through the client device to obtain the connection program and verification program; connect to the proxy host through the connection program in the client device, and send verification through the verification program To the proxy host; and when the proxy host determines that the verification code is correct, establish a connection between the client device and the server through the proxy host.

In an embodiment of the present invention, after the proxy host receives the connection request, the method further includes: transmitting the encryption program to the client device by the proxy host; and executing the encryption program through the client device to obtain a public key and a private key; And sending the public key to the proxy host via the client device. The proxy host uses a public key to encrypt the connection program and the verification program to obtain encrypted data, and the client device uses a private key to decrypt the encrypted data.

In an embodiment of the present invention, after the proxy host receives the connection request, the method further includes: writing the encrypted code through the proxy host and compiling to obtain the compiled data, and transmitting the compiled data to the client device. ; And interpreting the compiled data through a client device to obtain an identification code and encryption program. After the encryption program is executed on the client device to obtain the public and private keys, the method further includes: sending the public key and the identification code to the proxy host through the client device; judging whether the identification code is received through the proxy host; If the proxy host determines that the identification code is not received within the set time, the proxy host interrupts communication with the client device; and when the proxy host determines that the identification code is received within the preset time, it uses the public key to connect through the proxy host. Threaded and authentication programs are encrypted to obtain encrypted data.

In an embodiment of the present invention, after the proxy host receives the connection request, the method further includes: setting a port by the proxy host to correspond to the client device; and writing the port number of the set port to the connection through the proxy host. Threaded; generate a verification code through the proxy host, write the verification code to the verification program and store the verification code in the storage device of the proxy host; and encrypt the connection program and verification program through the proxy host to obtain encrypted data.

In an embodiment of the present invention, the step of connecting the client device to the proxy host through a connection program in the client device and transmitting the verification code to the proxy host through the verification program includes: based on the port number, through the connection program and the port Establish a connection; and send a verification code to the port via a verification program.

In an embodiment of the present invention, the connection method further includes: monitoring the port through the proxy host to determine whether a verification code is received from the client device; when the port receives a verification code and determining that the verification code is correct , Connecting to the server through the proxy host, so that the client device establishes a connection with the server through the port provided by the proxy host; and when the port receives a verification code and determines that the verification code is incorrect, the connection is closed through the proxy host Port to disconnect the client device from the proxy host.

In an embodiment of the present invention, after decrypting the encrypted data through the client device to obtain the connection program and the verification program, the method further includes: in the client device, transmitting a verification code through the verification program at a first fixed time. The port to the proxy host; in the proxy host, every second fixed time monitors whether the port receives a verification code; if no second port receives a verification code, the port is closed; if Listening to the port receiving a verification code every second fixed time to determine whether the verification code is correct; if the verification code is correct, continuously monitoring whether the port receives a verification code every second fixed time; and if the verification code is incorrect, The port is closed.

In an embodiment of the present invention, the encrypted data further includes an automatic restart program. The connection method further includes: after the client device decrypts the encrypted data to obtain an automatic restart program, the automatic restart program determines whether the verification program works normally; and when it is determined that the verification program does not work normally, the automatic restart program restarts Start the initialization program to re-send the connection request through the initialization program to interrupt the connection with the proxy host.

The connection system of the present invention includes: a server; a proxy host connected with the server, wherein the proxy host stores a connection program and a verification program; and a client device, which is installed with an initialization program, and communicates with the proxy host through the initialization program. The master program communicates. Here, the client device sends a connection request to the proxy host through the initialization program; after the proxy host receives the connection request, it encrypts the connection program and the verification program to obtain encrypted data, and sends the encrypted data to the client device; After the client device decrypts the encrypted data to obtain the connection program and verification program, it connects to the proxy host through the connection program, and sends the verification code to the proxy host through the verification program. When the proxy host determines that the verification code is correct, Establish a connection between the client device and the server through a proxy host.

Based on the above, a proxy host is set up between the server and the client device, and the proxy host will connect with the client device and the server separately, and assist the transfer of data between the client device and the server through the proxy host. Accordingly, the identity of the client device is verified through the proxy host to ensure that the client device is a secure and trusted device.

In order to make the above features and advantages of the present invention more comprehensible, embodiments are hereinafter described in detail with reference to the accompanying drawings.

The invention is divided into two main phases, namely the deployment phase and the authentication phase. In the deployment phase, the client device initially only has an initialization program, and the related program is obtained from the proxy host and executed by the initialization program. The second phase is the authentication phase. In this phase, it is determined whether the client device is a secure and trusted device. When the proxy host detects an abnormality, it will actively remove the connection with the client device. In order to make the content of the present invention more clear, the following specific embodiments are given as examples in which the present invention can be implemented.

FIG. 1 is a block diagram of a connection system according to an embodiment of the present invention. Referring to FIG. 1, the connection system 100 includes a server 110, a proxy host 120, and a plurality of client devices 130 (including client devices 130-1 and 130-2). In this embodiment, the client device 130 must pass the inspection of the proxy host 120 to establish a connection with the server 110. Specifically, the proxy host 120 will separately connect with the client device 130 and the server 110. When the proxy host 120 receives the data transmitted by the client device 130, it must direct this data to the server 110, and vice versa .

The proxy host 120 is, for example, a hardware device with a computing function, and includes a controller and a storage device. The controller executes code fragments in the storage device to achieve a specific function. In addition, the proxy host 120 may also be software installed on the server 110 and executed by a processor of the server 110. The proxy host 120 is mainly responsible for communication with the client device 130. The proxy host 120 has the programs required by the client device 130 during the deployment phase, and plays the role of verification during the authentication phase.

The client device 130 is, for example, a sensor provided on various items, and includes a controller and a storage device. The controller executes code fragments in the storage device to achieve a specific function.

For example, in the case of an Internet of Things (IoT) system, the server 110 is the center console of the IoT system, the client device 130 is a sensor under the IoT system, and the sensors are installed in each of the IoT systems. object.

The controllers of the client device 130 and the proxy host 120 are, for example, a central processing unit (CPU), an image processing unit (Graphic Processing Unit, GPU), a physical processing unit (Physics Processing Unit, PPU), Programmable Microprocessor, Embedded Control Chip, Digital Signal Processor (DSP), Application Specific Integrated Circuits (ASIC) or other similar devices.

The storage device of both the client device 130 and the proxy host 120 may be any type of fixed component or movable component. The storage 120 is, for example, Random Access Memory (RAM), read-only memory ( Read-Only Memory (ROM), Flash memory, Secure Digital Memory Card (SD), hard disk, or other similar devices or a combination of these devices.

FIG. 2 is a block diagram of an internal configuration of a proxy host and a client device of a connection system according to an embodiment of the present invention. In this embodiment, the storage device of the agent host 120 includes a main control program 221, an encryption program 223, a verification program 225, a connection program 227, and an automatic restart program 229. In the initial stage, the storage device of the client device 130 does not include the encryption program 223 ', the verification program 225', the connection program 227 ', and the automatic restart program 229', and only includes the initialization program 211.

The processor of the proxy host 120 only executes the main control program 221 to implement the connection method described later. The processor of the proxy host 120 does not execute the encryption program 223, the verification program 225, the connection program 227, and the automatic restart program 229. Instead, these programs are encrypted and sent to the client device 130 to provide the client device 130 for use. .

Before the client device 130 has sent the connection request to the proxy host 120, only the initialization program 211 exists, and the encryption program 223 ', the verification program 225', the connection program 227 ', and the automatic restart program 229' are provided by the proxy. The host 120 transmits it, which will be described in detail later. For example, in the case of an IoT system, an initialization program 211 is installed in the client device 130 at the stage of deploying the client device 130. Only a device with a valid initialization program 211 can successfully establish a connection with the proxy host 120. And communicate with the server 110 through the proxy host 120. Below is an example to explain in detail the steps of the connection method in this case.

FIG. 3 is a flowchart of a connection method according to an embodiment of the present invention. Please refer to FIGS. 1 to 3 at the same time. In step S305, the initialization program 211 of the client device 130 sends a connection request to the proxy host 120. That is, the processor of the client device 130 sends a connection request to the main control program 221 through the initialization program 211. Here, the client device 130 further includes a connection device, and transmits information to the proxy host through the connection device. The connected devices are, for example, a network card, a WiFi module, a Bluetooth module, an infrared module, a Subscriber Identity Module (SIM) card, and the like.

After the proxy host 120 receives the connection request, in step S310, the proxy host 120 encrypts the connection program 227 and the verification program 225 through the main control program 221 to obtain encrypted data, and sends the encrypted data to the client device 130. Next, in step S315, the client device 130 decrypts the encrypted data to obtain a connection program 227 'and a verification program 225'. Here, the proxy host 120 and the client device 130 may use an asymmetric encryption algorithm to perform encryption and decryption.

The asymmetric encryption algorithm requires two keys, a public key and a private key, one of which is used for encryption and the other is used for decryption. The ciphertext obtained by using one of the keys to encrypt the plaintext can only be decrypted with the corresponding other key to obtain the original plaintext. For example, the proxy host 120 uses the public key to encrypt the connection program 227 and the verification program 225 to obtain encrypted data, and the client device 130 uses the private key to decrypt the encrypted data to obtain the connection program 227 'and the verification program 225. '. The verification program 225 'is used to provide a verification code. The connection program 227 'is used to establish a connection with the agent host 120.

After the client device 130 obtains the connection program 227 'and the verification program 225', in step S320, the client device 130 connects to the proxy host 120 through the connection program 227 'and the verification program 225' Send the verification code to the proxy host 120. In step S325, when the proxy host 120 determines that the received verification code is correct, a connection between the client device 130 and the server 110 is established through the proxy host 120.

Based on the above embodiment, another embodiment with higher security is further described below. FIG. 4 is a flowchart of another connection method according to an embodiment of the present invention. Please refer to FIGS. 1, 2 and 4 at the same time. In step S405, the client device 130 sends a connection request to the proxy host 120 through the initialization program 211. After receiving the connection request, the proxy host 120 sends the encryption program 223 to the client device 130 in step S410. Here, the encryption program 223 (223 ') is responsible for providing a public key and a private key. The proxy host 120 transmits the encryption program 223 to the client device 130. After receiving the encryption program 223 (that is, the encryption program 223 '), the client device 130 executes the encryption program 223' through the initialization program 211 in step S415, thereby obtaining a public key and a private key. After that, in step S420, the client device 130 transmits the public key to the proxy host 120 through the encryption program 223 '.

In addition, before the proxy host 120 sends the encryption program 223 to the client device 130 (step S410), the encryption program can be further strengthened to prevent man-in-the-middle attacks. Specifically, the proxy host 120 writes an identification code (such as a garbled generated by random numbers) to the encryption program 223 and compiles to obtain the compiled data, and transmits the compiled data to the client device 130. When the client device 130 receives the compiled data, it first interprets the compiled data, and then obtains an identification code and an encryption program 223 '. After that, the encryption program 223 'is executed through the initialization program 211 (step S415). In step S420, the client device 130 transmits the public key and the identification code to the proxy host 120 at the same time. Here, an authentication key exchange (authenticated key exchange) mechanism can be further used to combine the public key and the identification code.

The proxy host 120 determines whether the communication with the client device 130 is to be interrupted by using the received identification code. That is, when the proxy host 120 determines that the identification code is not received within a preset time, the proxy host 120 interrupts communication with the client device 130. When the proxy host 120 determines that the identification code is received within a preset time, the client device 130 encrypts the connection program 227 and the verification program 225 by using the public key through the main control program 221 to obtain encrypted data.

Since the proxy host 120 transmits the encrypted program through the plain code, if the attacker listens to the transmitted packet at this time, the identification code in the encrypted program can be seen. In order to avoid this type of attack, the compiled data (compiled encryption program) can be further shelled or aligned for defense.

The packed encryption program (executable file) can be directly executed, but the executable file itself is encrypted. So when the attacker wants to obtain information by watching the specific offset value of the packet, the attacker gets the encrypted ciphertext. The function of alignment is to make the position of the identification code in the memory a multiple of a specific number, so the compiler will generate padding according to the number of alignments set by the user, thereby changing the identification code in the encryption program (executing file). Offset value in.

Returning to FIG. 4, in step S425, the proxy host 120 sets a port to correspond to the client device 130 and writes the set port number to the connection program 227. Furthermore, in step S430, the proxy host 120 generates a verification code and writes the verification code to the verification program 225, and also stores the verification code in the storage device of the proxy host 120 for subsequent inspection. The verification code is, for example, a one-time password. For different client devices 130, the corresponding verification codes are different, and the verification codes used for each connection are also different. Here, the execution order of steps S425 and S430 is not limited. For example, step S430 may be performed first, and then step S425 may be performed; or steps S425 and S430 may be performed simultaneously.

After that, in step S435, the agent host 120 encrypts the connection program 227 (the port number has been written with the port) and the verification program 225 (the verification code has been written) by using the public key through the master program 221. Get encrypted data. Next, in step S440, the main control program 221 sends the encrypted data to the client device 130. After receiving the encrypted data, the client device 130 decrypts the encrypted data by using the private key through the encryption program 223 ', thereby obtaining the connection program 227' and the verification program 225 '. After the connection program 227 'and the verification program 225' are executed, the connection program 227 'and the verification program 225' are deleted, respectively, to prevent the verification code from being stolen. In addition, when re-transmitting the verification code, the encrypted data can be decrypted again by the encryption program 223 'to obtain the connection program 227' and the verification program 225 '.

After that, in step S450, a connection is established with the port through the connection program 227 'based on the port number. After establishing a connection with the port of the proxy host 120, in step S455, a verification code is transmitted to the port through the verification program 225 '.

In addition, in step S435, the proxy host 120 may also use the public key to automatically restart the program 229 together with the connection program 227 (the port number has been written into the port) and the verification program 225 (with the verification code written) Encrypt to obtain encrypted data. When the encrypted data is decrypted on the client device 120, the connection program 227 ', the verification program 225', and the automatic restart program 229 'can be obtained at the same time. The automatic restart program 229 'will automatically detect whether the verification program 225' is functioning normally. If the automatic restart program 229 'determines that the verification program 225' is not operating normally, it restarts the initialization program 211 to interrupt the connection with the proxy host 120 and re-sends a connection request through the initialization program 211 (re-execute steps) S405).

In step S460, the proxy host 120 monitors the port through the main control program 221 to determine whether a verification code is received from the client device 130. When the port receives the verification code and determines that the verification code is correct, in step S465, the proxy host 120 connects to the server 110, so that the client device 130 establishes a connection with the server 110 through the port provided by the proxy host 120. line. On the other hand, when the port receives the verification code and determines that the verification code is incorrect, the proxy host 120 closes the port to interrupt the connection between the client device 130 and the proxy host 120.

After enabling the client device 130 to establish a connection with the server 110 through the proxy host 120, the identity of the client device 130 can be further verified. An example is given below for illustration.

FIG. 5 is a flowchart of a method for authenticating a client device according to an embodiment of the present invention. Referring to FIG. 1, FIG. 2 and FIG. 5, in step S505, the client device 130 sends a verification code to the port of the proxy host 120 through the verification program 225 ′ every first fixed time (for example, 10 minutes). Next, in step S510, the agent host 120 continuously monitors the port through the main control program 221. In step S515, the main control program 221 determines whether a verification code is received every second fixed time (for example, 15 minutes). If the port does not listen to the verification code every second fixed time, in step S525, the main control program 221 closes the port to interrupt the connection between the proxy host 120 and the client device 130. If a verification code is received by the port every second fixed time, in step S520, the main control program 221 further determines whether the verification code is correct. If the verification code is correct, the process returns to step S515, and the main control program 221 continuously monitors whether the port receives the verification code every second fixed time. If the verification code is incorrect, in step S525, the main control program 221 closes the connection port to interrupt the connection between the proxy host 120 and the client device 130.

In addition, a method for isolating the environment is further provided in the client device 130 to prevent the client device 130 from being mastered by an attacker. The isolation environment method is, for example, a Container, a Sandbox, a Namespace, an Apparmor, a Security-Enhanced Linux (SELinux), and a Control Group (CGroups, control). groups) and so on. Applications running inside containers (such as Docker containers) can be controlled and isolated by resources. In the field of computer security, a sandbox is a security mechanism that provides an isolated environment for running programs. AppArmor is to record all the actions of a program and create a profile of the program to restrict the program from doing exceptions to prevent unauthorized access. Security-enhanced Linux is an implementation of mandatory access control. The control group is a function of the Linux kernel, which is used to limit, control, and separate the resources of a travel group (such as CPU, memory, disk input and output, etc.).

For example, if a client device is mastered by an attacker and has been granted the highest user authority (for example, a system administrator), the attacker can change the client program flow. After the fake client program passes the verification, it subsequently operates in the system. In the process, fake data is transmitted to the agent host 120. In order to avoid this type of problem, the client device 130 adopts an isolation environment method, which can protect the connection program 227 'in the client device 130, restricting illegal users to only perform prescribed procedures in the isolation environment to ensure illegal The user cannot use the connection program 227 'and the verification program 225'.

In summary, in the initial setting, the client device only has an initialization program. After a series of communication and verification, the client device can obtain other programs and verification codes from the proxy host. After that, the client device will periodically send The verification code is sent to the proxy host, and the proxy host determines whether the client device is authentic or not according to the verification code. The connection system of the embodiment can be flexibly deployed and applied to various Internet of Things systems to ensure that client devices deployed outside are secure and trusted devices.

Although the present invention has been disclosed as above with the examples, it is not intended to limit the present invention. Any person with ordinary knowledge in the technical field can make some modifications and retouching without departing from the spirit and scope of the present invention. The protection scope of the present invention shall be determined by the scope of the attached patent application.

100‧‧‧ Connected System

110‧‧‧ server 120‧‧‧ proxy host

130, 130-1, 130-2‧‧‧ client devices

211‧‧‧ initialization program

221‧‧‧Master Control Program

223, 223’‧‧‧ encryption program

225, 225’‧‧‧ verification program

227, 227’‧‧‧ Connect program

229, 229’‧‧‧Auto restart program

S305 ～ S325‧‧‧Steps of a connection method

S405 ～ S470‧‧‧ Steps of another connection method

S505 ～ S525‧‧‧Methods for verifying client device

FIG. 1 is a block diagram of a connection system according to an embodiment of the present invention. FIG. 2 is a block diagram of an internal configuration of a proxy host and a client device of a connection system according to an embodiment of the present invention. FIG. 3 is a flowchart of a connection method according to an embodiment of the present invention. FIG. 4 is a flowchart of another connection method according to an embodiment of the present invention. FIG. 5 is a flowchart of a method for authenticating a client device according to an embodiment of the present invention.

Claims (16)

A connection method includes: sending a connection request to a proxy host through an initialization program of a client device; after the proxy host receives the connection request, a connection program and a verification are performed through the proxy host The program encrypts to obtain an encrypted data, and transmits the encrypted data to the client device; decrypts the encrypted data through the client device to obtain the connection program and the verification program; and in the client device through the The connection program connects with the proxy host, and sends a verification code to the proxy host through the verification program; and when the proxy host determines that the verification code is correct, the client device and a server are established through the proxy host. Connection between the devices. The connection method according to item 1 of the scope of patent application, wherein after the proxy host receives the connection request, the method further includes: transmitting, by the proxy host, an encryption program to the client device; and executing through the client device The encryption program obtains a public key and a private key; and sends the public key to the proxy host through the client device, wherein the proxy host uses the public key to the connection program and the verification program Encryption is performed to obtain the encrypted data, and the client device uses the private key to decrypt the encrypted data. The connection method according to item 2 of the scope of patent application, wherein after the proxy host receives the connection request, the method further includes: writing an identification code to the encryption program through the proxy host and compiling to obtain a compilation Post-compiled data and send the compiled data to the client device; and interpret the compiled data through the client device to obtain the identification code and the encryption program; wherein the encrypted program is executed by the client device to After the step of obtaining the public key and the private key, the method further includes: transmitting the public key and the identification code to the proxy host through the client device; judging whether the identification code is received through the proxy host; If the proxy host determines that the identification code is not received within a preset time, the proxy host interrupts communication with the client device; and when the proxy host determines that the identification code is received within the preset time, then The proxy host uses the public key to encrypt the connection program and the verification program to obtain the encrypted data. The connection method according to item 1 of the scope of patent application, wherein after the proxy host receives the connection request, the method further includes: setting a port by the proxy host to correspond to the client device; through the proxy host Write the set port number of the port to the connection program; generate the verification code through the proxy host, write the verification code to the verification program, and store the verification code in a storage device of the proxy host ; And obtaining the encrypted data by encrypting the connection program and the verification program through the proxy host. The connection method according to item 4 of the scope of patent application, wherein the steps of connecting the proxy device to the proxy host through the connection program in the client device, and transmitting the verification code to the proxy host through the verification program include: : Based on the port number, establish a connection with the port through the connection program; and send the verification code to the port through the verification program. The connection method according to item 4 of the scope of patent application, further comprising: monitoring the port through the proxy host to determine whether the verification code is received from the client device; receiving the verification code at the port, When the verification code is determined to be correct, the proxy host is connected to the server, so that the client device establishes a connection with the server through the port provided by the proxy host; and the verification is received at the port. When the verification code is determined to be incorrect, the proxy host closes the port to interrupt the connection between the client device and the proxy host. The connection method according to item 4 of the scope of patent application, wherein after the step of obtaining the connection program and the verification program by decrypting the encrypted data through the client device, the method further includes: in the client device , Sending the verification code to the port of the proxy host through the verification program every first fixed time; in the proxy host, monitoring whether the port receives the verification code every second fixed time; if If the port does not listen to the port to receive the verification code every second fixed time, the port is closed; if the port receives the verification code to the port every second fixed time, determine whether the verification code is correct ; If the verification code is correct, continuously monitor whether the port receives the verification code every second fixed time; and if the verification code is incorrect, close the port. The connection method according to item 1 of the scope of patent application, wherein the encrypted data further includes an automatic restart program, and the connection method further includes: after the client device decrypts the encrypted data to obtain the automatic restart program To determine whether the verification program is working normally through the automatic restart program; and when the verification program is not working normally, restart the initialization program through the automatic restart program to interrupt the connection with the proxy host and re-pass The initialization program sends the connection request. A connection system includes: a server; a proxy host connected to the server, wherein the proxy host stores a connection program and a verification program; and a client device installed with an initialization program through which the initialization The program communicates with the master program of the proxy host, wherein the client device sends a connection request to the proxy host through the initialization program; after the proxy host receives the connection request, it sends a connection request to a connection program And an authentication program to encrypt to obtain an encrypted data, and send the encrypted data to the client device; the client device decrypts the encrypted data to obtain the connection program and the verification program, and then through the connection The program connects with the proxy host, and sends a verification code to the proxy host through the verification program; when the proxy host determines that the verification code is correct, establishes a connection between the client device and the server through the proxy host. Connection. The connection system according to item 9 of the scope of patent application, wherein after the proxy host receives the connection request, the proxy host sends an encryption program to the client device; the client device executes the encryption program to obtain A public key and a private key, and transmitting the public key to the proxy host, wherein the proxy host uses the public key to encrypt the connection program and the verification program to obtain the encrypted data, and the The client device uses the private key to decrypt the encrypted data. The connection system according to item 10 of the scope of patent application, wherein after the proxy host receives the connection request, the proxy host writes an identification code to the encryption program and compiles to obtain a compiled data, and Sending the compiled data to the client device; the client device interprets the compiled data to obtain the identification code and the encryption program, and sends the public key and the identification code to the proxy host; the proxy host judges Whether the identification code is received, when the proxy host determines that the identification code has not been received within a preset time, the proxy host interrupts communication with the client device; and when the proxy is within the preset time The host determines that the identification code is received, and then uses the public key to encrypt the connection program and the verification program to obtain the encrypted data. The connection system according to item 9 of the scope of patent application, wherein after the proxy host receives the connection request, the proxy host sets a port corresponding to the client device and writes the set port The port number to the connection program, generate the verification code and write the verification code to the verification program and store the verification code in a storage device of the proxy host, and then the proxy host sends the connection program and the The verification program encrypts to obtain the encrypted data. The connection system according to item 12 of the scope of patent application, wherein the client device establishes a connection with the port through the connection program based on the port number, and sends the verification code to the port through the verification program. . The connection system according to item 12 of the scope of patent application, wherein the proxy host monitors the port to determine whether the verification code is received from the client device; the verification code is received at the port, and the When the verification code is correct, the proxy host connects with the server, so that the client device establishes a connection with the server via the port provided by the proxy host; the verification code is received at the port, and the When the verification code is incorrect, the proxy host closes the port to interrupt the connection between the client device and the proxy host. The connection system according to item 12 of the scope of patent application, wherein the client device sends the verification code to the port of the proxy host through the verification program every first fixed time; every one of the proxy hosts The second fixed time monitors whether the port receives the verification code; if the port does not listen to the verification code every second fixed time, the proxy host closes the port; if every second fixed time If the verification code is received by the port, the proxy host judges whether the verification code is correct; if the verification code is correct, the proxy host continuously monitors whether the port receives the verification code every second fixed time; If the verification code is incorrect, the proxy host closes the port. The connection system according to item 9 of the patent application scope, wherein the encrypted data further includes an automatic restart program. After the client device decrypts the encrypted data to obtain the automatic restart program, the automatic restart program is used to determine the encrypted restart data. Whether the verification program works normally; when it is determined that the verification program is not working normally, restart the initialization program through the automatic restart program to interrupt the connection with the proxy host and re-send the connection through the initialization program request.