WO2016107318A1 - 一种安全通信系统 - Google Patents

一种安全通信系统 Download PDF

Info

Publication number
WO2016107318A1
WO2016107318A1 PCT/CN2015/094846 CN2015094846W WO2016107318A1 WO 2016107318 A1 WO2016107318 A1 WO 2016107318A1 CN 2015094846 W CN2015094846 W CN 2015094846W WO 2016107318 A1 WO2016107318 A1 WO 2016107318A1
Authority
WO
WIPO (PCT)
Prior art keywords
network server
encryption
certificate
sub
server
Prior art date
Application number
PCT/CN2015/094846
Other languages
English (en)
French (fr)
Inventor
杭程
石彦伟
贾正强
Original Assignee
北京奇虎科技有限公司
奇智软件（北京）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京奇虎科技有限公司, 奇智软件（北京）有限公司 filed Critical 北京奇虎科技有限公司
Publication of WO2016107318A1 publication Critical patent/WO2016107318A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0478—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key

Definitions

  • the present invention relates to the field of Internet technologies, and in particular, to a secure communication system.
  • a browser is a piece of software that can display the contents of an HTML (Hyper Text Markup Language) file of a web server or a file system and allow users to interact with these files.
  • the browser mainly interacts with the web server through HTTP (HyperText Transfer Protocol) and acquires web pages, which is the most widely used for displaying images, animations, texts, videos, sounds and streaming media in the webpage.
  • HTTP HyperText Transfer Protocol
  • One of the client programs Common browsers on personal computers include Microsoft's IE (Internet Explorer), Apple's Safari, Google's Chrome, 360 Secure Browser, Sogou's high-speed browser and so on.
  • the present invention has been made in order to provide a secure communication system that overcomes the above problems or at least partially solves the above problems.
  • a secure communication system comprising: a secure browser device and a network server; wherein the network server is configured to establish an encrypted connection communication with the secure browser device; After the encrypted connection communication is successfully established, performing the service data interaction with the secure browser device through the second encrypted channel;
  • the secure browser device includes: a browser main service process module and an encryption sub-process module, wherein the browsing The main business process module is configured to start an encryption sub-process module of the encryption sub-process communicating with the main business process of the browser in the browser client, wherein the encryption sub-process is used as a connection agent to implement the first encryption channel The conversion to the second encryption channel, and the data forwarding;
  • the encryption sub-process module comprising: a proxy sub-module, configured to listen to the browser main business process, and obtain the first sent by the browser main business process a connection request; and after the encrypted connection communication is successfully established, the encryption sub-process executes Transfer data between the first encryption and the second encryption passage channel; secure connection sub-module for the connection request according to
  • the encryption process is implemented as a proxy to implement the conversion of the first encrypted channel to the second encrypted channel, and the data is forwarded, and a secure encrypted channel is successfully established between the main service process of the browser and the network server, thereby ensuring
  • the secure transmission of business data can reduce the risk of business data leakage and improve the security and reliability of business data transmission.
  • the browser client can automatically start the encryption sub-process to establish a secure channel between the main service process and the network server to implement the above functions. Improves the security and reliability of data flow between the browser and the web server, enabling a secure browser to be implemented.
  • FIG. 1 shows a flow chart of a method for implementing a secure browser according to an embodiment of the present invention
  • FIG. 2 shows a flow chart of a method for implementing a secure browser according to an embodiment of the present invention
  • FIG. 3 is a schematic diagram showing an agent mechanism of an encryption sub-process according to an embodiment of the present invention
  • FIG. 4 is a schematic diagram showing a handshake process of an encryption sub-process and a network server according to an embodiment of the present invention
  • FIG. 5 is a block diagram showing the structure of a secure communication system according to an embodiment of the present invention.
  • FIG. 6 is a block diagram showing the structure of a secure communication system according to an embodiment of the present invention.
  • FIG. 7 is a structural block diagram of an encryption sub-process module according to an embodiment of the present invention.
  • FIG. 8 is a structural block diagram of a browser main service process module according to an embodiment of the present invention.
  • FIG. 9 shows a block diagram of a computing device for performing an implementation of a secure browser in accordance with the present invention.
  • Figure 10 illustrates a storage unit for holding or carrying program code implementing an implementation of a secure browser in accordance with the present invention.
  • Embodiment 1 is a diagrammatic representation of Embodiment 1:
  • FIG. 1 is a flow chart showing the steps of an implementation method of a secure browser according to an embodiment of the present invention. Specifically, the method may include the following steps:
  • Step 102 Start an encryption sub-process that communicates with a browser main service process in a browser client, where the encryption sub-process is used as a connection proxy to implement conversion of the first encrypted channel to the second encrypted channel, and data Forward.
  • HTTP Hyper Text Transfer Protocol
  • the network server uses different encryption protocols or algorithms, so that the two cannot communicate directly and cannot access the webpage of the web server.
  • a secure browser client which also sets an encryption sub-process that communicates with the browser main business process in the browser.
  • the main function of the encryption sub-process is as a connection proxy, implementing conversion of the first encrypted channel to the second encrypted channel, and data forwarding. That is, the encryption sub-process is used as the proxy of the main business process, which can perform encrypted communication with the main business process of the browser, and can also perform secure communication with the network server, such as the business data of the main business process of the browser.
  • An encrypted channel is sent to the encryption sub-process, and the encryption sub-process transmits the service data to the network server through the second encryption channel to implement data forwarding and communication between the two encrypted channels.
  • the main business process of the browser communicates directly with the network server. However, if the communication is performed on the HTTP channel targeted for security, the main business process cannot parse the data information fed back by the network server. And the encryption sub-process is started as a proxy connection, that is, the encryption sub-process acts as a proxy between the main service process and the network server.
  • the first encryption channel is a secure communication channel of the browser main service process and the encryption sub-process; and the second encryption channel is a secure communication channel of the encryption sub-process and the network server.
  • the encryption sub-process realizes the main service process and the network server by converting the encryption sub-process and the first encryption channel of the main service process into a second encryption channel of the encryption sub-process and the network server. Connection agent between.
  • the encryption sub-process may send the service data to the network server through the second encryption channel.
  • Step 104 The encryption sub-process listens to the browser main service process, and acquires a first connection request sent by the browser main service process.
  • the encryption sub-process listens to the main business process of the browser, so that the first connection request sent by the main business process of the browser is obtained in the first time.
  • the encryption sub-process can listen to the browser main service process through the service port. When the encryption sub-process detects that the first connection request comes, the encryption sub-process receives the first connection request sent by the main service process.
  • the first connection request sent by the browser main service process may specifically include service data.
  • Step 106 The encryption sub-process establishes an encrypted connection communication with the network server according to the first connection request.
  • the encryption sub-process After the encryption sub-process receives the first connection request sent by the main service process, the encryption sub-process establishes an encrypted connection communication with the network server according to the first connection request.
  • the encryption sub-process establishes an encrypted connection communication with the network server, that is, the encryption sub-process and the network server perform security authentication to confirm that it is a secure and legal communication party, thereby establishing a channel for secure communication.
  • the encryption sub-process establishes an encrypted connection communication with the network server, and the encryption sub-process can also communicate with the main service process, so the encryption sub-process is respectively established with the main service process and the network server.
  • encrypted connection communication can serve as a bridge for data exchange between the two ends.
  • Step 108 After the encrypted connection communication is successfully established, the encryption sub-process performs forwarding of the service data between the first encrypted channel and the second encrypted channel.
  • the first encryption channel is a secure communication channel of the browser main service process and the encryption sub-process; and the second encryption channel is a secure communication channel of the encryption sub-process and the network server. .
  • the encryption sub-process successfully establishes an encrypted connection communication with the network server, which means that the encryption sub-process and the network server can send data to each other, and the data is encrypted and processed to ensure data flow security and reliability.
  • the encryption sub-process may send the received service data in the first connection request to the network server. Specifically, the encryption sub-process performs forwarding of the service data between the first encrypted channel and the second encrypted channel, that is, The encryption sub-process may receive the service data through the first encryption channel, perform decryption, and then encrypt the service data by using an encryption method agreed by the second encryption channel, and then send the service data to the network server. In this way, the service data is forwarded from the first encrypted channel to the second encrypted channel, and the service data is forwarded from the primary service process to the network server.
  • an encryption sub-process that communicates with a browser main service process is started in a browser client, where the encryption sub-process is used as a connection proxy to implement conversion of the first encrypted channel to the second encrypted channel, and Data forwarding; then the encryption sub-process listens to the browser main business process, and acquires a first connection request sent by the browser main service process; and then according to the first connection request, the encryption sub-process and The network server establishes an encrypted connection communication; finally, after the encrypted connection communication is successfully established, the encryption sub-process performs forwarding of the service data between the first encrypted channel and the second encrypted channel; wherein, the An encrypted channel a secure communication channel of the browser main service process and the encryption sub-process; the second encryption channel is a secure communication channel of the encryption sub-process and the network server.
  • the encryption process is implemented as a proxy to implement the conversion of the first encrypted channel to the second encrypted channel, and the data is forwarded, and a secure encrypted channel is successfully established between the main service process of the browser and the network server, thereby ensuring
  • the secure transmission of business data can reduce the risk of business data leakage and improve the security and reliability of business data transmission.
  • the browser client can automatically start the encryption sub-process to establish a secure channel between the main service process and the network server to implement the above functions. Improves the security and reliability of data flow between the browser and the web server, enabling a secure browser to be implemented.
  • Embodiment 2 is a diagrammatic representation of Embodiment 1:
  • this embodiment continues to discuss the implementation method of the secure browser.
  • FIG. 2 is a flow chart showing the steps of an implementation method of a secure browser according to an embodiment of the present invention. Specifically, the method may include the following steps:
  • Step 202 Start an encryption sub-process that communicates with a browser main service process in a browser client, where the encryption sub-process is used as a connection proxy to implement conversion of the first encrypted channel to the second encrypted channel, and data Forward.
  • the encryption sub-process that initiates communication with the browser main service process in the browser client can be automatically started by the browser. Specifically, when the communication between the main business process of the browser and the network server fails, the browser automatically The encryption sub-process is started, and the encryption sub-process receives the first connection request of the main service process, and performs corresponding processing according to the service data included in the first connection request to form a proxy connection of the browser main service process.
  • the first encryption channel is a secure communication channel of the browser main service process and the encryption sub-process; and the second encryption channel is a secure communication channel of the encryption sub-process and the network server. Therefore, the encryption sub-process realizes the main service process and the network server by converting the encryption sub-process and the first encryption channel of the main service process into a second encryption channel of the encryption sub-process and the network server. Connection agent between.
  • the encryption sub-process may send the service data to the network server through the second encryption channel.
  • the browser main service process and the encryption sub-process adopt two kinds of communication modes: proxy and IPC (Inter-Process Communication), so that the encryption sub-process can be used as a connection proxy, and is responsible for the main business process of the browser.
  • An encrypted channel, channel conversion and data forwarding to the second encrypted channel of the network server, and the IPC communication mode is responsible for inter-process data transfer.
  • the encryption sub-process agent implementation mechanism is as shown in FIG. 3, and specifically includes the following structure:
  • Main thread Read various configurations, create a listening thread, main business thread, and IPC pass of the browser main process.
  • Listening thread used to listen to the service port, when there is a connection request in the main business process and accept (accept) successfully Perform the appropriate proxy action.
  • Service processing thread establishes and maintains the corresponding encrypted channel connection with the main business process and the network server respectively, so as to bridge the data exchange between the two ends.
  • Step 204 The encryption sub-process listens to the main service process of the browser, and acquires a first connection request sent by the main service process of the browser.
  • the encryption sub-process listens to the main business process of the browser, which can be implemented by: the encryption sub-process creates a listening thread; the listening thread performs the main service process of the browser through the service port. Listening. Receiving, by the listening thread, the first connection request sent by the main service process when the first connection request arrives.
  • the first connection request sent by the browser main service process may specifically include service data.
  • the encryption sub-process listens to the main business process of the browser, so that the first connection request sent by the main business process of the browser is obtained in the first time.
  • Step 206 The encryption sub-process establishes an encrypted connection communication with the network server according to the first connection request.
  • the encryption sub-process establishes an encrypted connection communication with the network server, which may specifically include the following sub-steps:
  • Sub-step 1 after confirming that the first connection request is successfully received, the encryption sub-process and the network server sequentially perform encrypted data negotiation and certificate authentication.
  • Sub-step 2 after the encrypted data negotiation is completed and the certificate authentication is passed, the encrypted connection communication between the browser client and the network server is established.
  • the step of performing the encrypted data negotiation between the encryption sub-process and the network server in the sub-step 1 may be implemented by: firstly, the encryption sub-process sends a client greeting to the network server. a message, wherein the client hello message includes first encrypted data of the browser client, the first encrypted data includes a plurality of protocol version numbers; and second, the network server feeds back a server greeting to the encrypted subprocess a message, wherein the server-side greeting message includes second encrypted data of the server client, and the second encrypted data includes: a protocol version number selected from the first encrypted data.
  • the client hello message and the server hello message are used to determine the secure transmission capability of the two parties, including attributes such as a number of protocol version numbers, session identifiers, and cipher suites, and generate and exchange random numbers.
  • the client hello message (ClientHello message) is the first message of the browser client and the network server handshake protocol. After the encryption sub-process sends the client greeting message to the network server, the network server waits for the network server to return the server greeting message.
  • Client problem message structure definition :
  • Clien_vision indicates the protocol version used by the client in this session.
  • the protocol version number is 1.1.
  • Radom is random information generated by the client, and its content includes always and random numbers.
  • session_id is the session identifier used by the client in the connection.
  • Session_id is a variable length field whose value is determined by the server. If there is no reusable session ID or if you want to negotiate security parameters, this field is blank, otherwise the client wants to reuse the session.
  • This session ID may be the previous connection ID, the current connection ID, or other connection ID in the connected state. After the session ID is generated, it should be consistently kept until the timeout is deleted or the connection associated with this session encounters a fatal error being closed. When a session fails or is closed, the connection associated with it should be forcibly closed.
  • cipher_suites is a list of cipher suites supported by the client.
  • the client should be arranged in the order of priority used by the cipher suite.
  • the cipher suite with the highest priority should be ranked first. If the session ID field is not empty, this field should contain at least the cipher suite used by the session to be reused.
  • Each cipher suite includes a key exchange algorithm, an encryption algorithm, and a check algorithm.
  • the server will select a matching cipher suite in the cipher suite list. If there is no matching cipher suite, the handshake failure alert message should be returned and the connection closed.
  • the compression_methods is a list of compression algorithms supported by the client.
  • the client should be arranged according to the priority order used by the compression algorithm, and the compression algorithm with the highest priority is ranked first.
  • the server will select a matching compression algorithm in the list of compression algorithms.
  • the list must contain a null compression algorithm so that the client and server can always negotiate a consistent compression algorithm.
  • the server can find a matching cipher suite from the client greeting message, the server sends the server hello message (Server Hello message) as a reply to the client greeting message. If no matching cipher suite is found, the server will respond with an alert message.
  • server hello message Server Hello message
  • the step of performing the certificate authentication by the encryption sub-process and the network server in the sub-step 1 may include: the encryption sub-process performing one-way certificate authentication on the network server; or The encryption sub-process and the network server perform mutual certificate authentication.
  • the encryption sub-process when performing the mutual authentication of the digital certificate, pops up a certificate selection box, and displays, in the certificate selection box, each user certificate loaded in the terminal where the browser is located. Information; receiving, by the certificate selection box, a user certificate selected by the user.
  • the method further includes: the encryption sub-process displaying a password input message, the password input message is used to prompt the user to input a protection password corresponding to the user certificate; the encryption sub-process receives the protection password input by the user, and the protection password is The verification is performed, and the protection password is confirmed to confirm that the user has the usage right of the user certificate.
  • the CA (Certificate Authority) organization issues different site certificates for different websites, and simultaneously issues different user certificates for different users of different websites.
  • the digital certificate includes the public key of the site or the user, the information of the site or the user, and the digital signature.
  • the encryption sub-process can pop up a certificate selection box in the browser client, and The certificate selection box displays information of each user certificate loaded in the terminal where the browser is located; the user selection certificate is received by the certificate selection box, and the user selects the user certificate, and the encryption sub-process displays a password input message, the password input message is used to prompt the user to input a protection password corresponding to the user certificate, such as inputting a Personal Identification Number (PIN), and the encryption sub-process receives the protection password input by the user, and The protection password is verified, that is, the user identity can be authenticated by protecting the password, and the user is confirmed whether the user has the right to use the user certificate, so that the user has the permission to use the user certificate after the protection password is input correctly.
  • the above user certificate and protection password can be sent to the network server as authentication data in the user certificate authentication process.
  • the method further includes: the encryption sub-process prompting the user to insert a security key storage hardware by using a prompt information, where the security key storage hardware stores a user certificate; the encryption sub-process calling the driver to detect the security secret Key storage hardware; after detecting the security key storage hardware, the encryption sub-process obtains information of a user certificate stored in the security key storage hardware.
  • the encryption sub-process When the browser client loads the user certificate, the encryption sub-process first prompts the user to insert the security key storage hardware by using a prompt message.
  • the security key storage hardware is a USB Key, which is a USB (Universal Serial Bus).
  • the hardware device of the bus interface built-in single-chip microcomputer or smart card chip, has a certain storage space, can store the user's private key and digital certificate, and uses the public key algorithm built into the USB Key to realize the authentication of the user identity. Since the user's private key is stored in the password lock, it can theoretically be read in any way, thus ensuring the security of user authentication.
  • the encryption sub-process identifies the security key storage hardware by driving, and performs an encryption operation in the two-way certificate authentication process according to the hardware certificate carrier. For example, if two-way authentication is required during SSL (Secure Sockets Layer) connection establishment, the encryption sub-process prompts the user to insert the security key storage hardware, that is, the USBKey device. After the user inserts the security key storage hardware, the certificate selection dialog box can be automatically recognized and popped up, prompting the user to select a certificate.
  • SSL Secure Sockets Layer
  • the encryption sub-process automatically recognizes that the security key storage hardware needs to rely on two key information in the CSP (Cryptographic Service Provider) registry key: SKFImagePath: specifies the path of the SKF dynamic library and the TokenVidPid: string format.
  • CSP Cosmetic Service Provider
  • the VendorID and ProductID of the KEY device are in a format similar to the one in HKEY_LOCAL_MACHINE ⁇ SYSTEM ⁇ CurrentControlSet ⁇ Enum ⁇ USB, which is VID_XXXX&PID_XXXX.
  • the browser will associate the corresponding driver with the vendorid and productid of the USBKey device to complete the related operations.
  • the browser does not store the pin password entered by the user, nor does it store the private key information in the USBKey.
  • the specific process is as follows: first connect to the USBKey device; then open the corresponding application (Application), the Application is determined by the user; then open the corresponding container (Container), the Container is determined by the user; then verify the PIN code (personal identification number), After verifying the error, you will be prompted to re-enter; then get the signature certificate letter Information; then obtain the encrypted certificate information; finally close the device, disconnect.
  • Application Application
  • Container Container
  • PIN code personal identification number
  • the encryption sub-process performs one-way certificate authentication on the network server, which may be implemented in the following manner: First, the encryption sub-process receives the network server to send Server certificate message, the server certificate message includes a site signing certificate of the network server; secondly, the encrypting child process authenticates the site signing certificate of the network server.
  • the following describes the server certificate message (Server Certificate message) the network server needs to send a server certificate message to the client, the message is always followed by the server greeting message, when the selected cipher suite uses RSA or ECC Or the ECDHE algorithm, the content of the server certificate message is a server identifier and an IBC public parameter, and is used by the client to negotiate an IBC public parameter with the server.
  • the relationship between the key exchange algorithm and the certificate key type is shown in Table 1.
  • the encryption sub-process and the network server perform bidirectional certificate authentication, which may be implemented in the following manner:
  • the encryption sub-process receives a server certificate message sent by the network server, where the server certificate message includes a site signing certificate of the network server;
  • the encryption sub-process receives a certificate authentication request message sent by the network server, where the certificate authentication request message is used to indicate that the certificate authentication of the client is performed;
  • the encryption sub-process receives a server-side key exchange message sent by the network server, including a key exchange parameter;
  • the encryption sub-process receives a server greeting completion message sent by the network server
  • the encrypting sub-process After the site signing certificate is authenticated, the encrypting sub-process sends a client credential message to the web server, where the client credential message includes a signing certificate of the browser client, so that the web server The signature certificate is authenticated.
  • the method further includes the step of key exchange: the encrypting The child process randomly generates a pre-master key according to the key exchange parameter, wherein the pre-master key is obtained by using an encrypted public key of the network server to perform encryption calculation by an elliptic curve cryptographic algorithm SM2; The process generates the client key exchange message by using the pre-master key, and sends the message to the network server, so that the network server acquires the pre-master key.
  • the method further includes the step of verifying the certificate signature, specifically: the encrypting sub-process obtains a signature verification parameter calculated according to the site signature certificate, and generates a client certificate certificate.
  • the verification message is sent to the network server; the encryption sub-process sends a client password specification change message to the network server to indicate that the negotiation of the encrypted data is completed; the encryption sub-process sends a client handshake to the network server to end a message; the encryption sub-process receives a server-side password specification change message sent by the network server to identify a negotiation that approves the encrypted data; and the encryption sub-process receives a server-side handshake end message sent by the network server.
  • the server certificate is strictly verified.
  • the foregoing encryption data negotiation, certificate authentication, key exchange, and signature authentication are all performed during the handshake process of the encryption sub-process and the network server of the secure browser client.
  • the two-factor authentication adopts a dual-certificate mechanism
  • the asymmetric algorithm of the certificate adopts the SM2 algorithm
  • the signature certificate is used to implement identity authentication based on the ECDSA signature
  • the encryption certificate is used to implement key negotiation based on the ECDH.
  • the SM4 algorithm used is used to encrypt the data, and the data is summarized using the SM3 algorithm.
  • the SM2 algorithm is an elliptic curve public key cryptographic algorithm with a key length of 256 bits.
  • the SM3 algorithm is a cryptographic hash algorithm with a key length of 128 bits.
  • the SM4 algorithm is a block cipher algorithm with a packet length of 128 bits and a key length of 128 bits.
  • the handshake process between the encryption subprocess and the network server includes:
  • the encryption subprocess sends a client hello message ClientHello to the web server.
  • the web server sends a server-side greeting message SeverHello to the encrypted sub-process of the secure browser client.
  • the network server finds a matching cipher suite from the ClientHello message, sends SeverHello as a reply, and sends an alarm message if no matching cipher suite is found.
  • SeverHello Sever_vision indicates the version number supported by the server, such as 1.1; the random number generated by the Radom server; the session identifier used by the session_id server; the cipher suite selected by the server from the ClientHello message; and the compression_methods server from the ClientHello message.
  • the compression algorithm selected in is a matching cipher suite from the ClientHello message.
  • the network server sends a server certificate message Certificate to the encryption subprocess.
  • this message of SeverCertificate is a signed certificate and an encrypted certificate.
  • the network server sends a certificate authentication request message SeverRequest to the encryption sub-process.
  • the client is required to provide a certificate through the SeverRequest message. Also indicates the type of certification (ECDSA)
  • the network server sends the server key exchange message SeverKeyExchange to the encryption subprocess.
  • SeverKeyExchange is used for client computing to generate a 48-byte pre-master key.
  • the public key can be obtained directly from the server-side encryption certificate. If the client randomly generates the pre-master key pre_master_seceret key and uses the public key of the server certificate for ECDH operation.
  • the web server sends a greeting completion message SeverHelloDone to the encryption subprocess.
  • SeverHelloDone characterizes the completion of the hello message phase of the handshake process and then waits for the client's response message.
  • the encryption subprocess sends a client key exchange message Certificate to the web server.
  • the ClientCertificate message is the first message after the completion of the hello message phase, such as including the client's signature certificate (X.509 sequence).
  • the encryption subprocess sends the client key exchange message ClientKeyExchange to the network server.
  • the public key of the network server in the ClientKeyExchange message encrypts the pre-master key.
  • the encryption sub-process sends a certificate verification message CertificateVerify to the network server.
  • the CertificateVerify message is used to authenticate that the client is a legitimate holder of the certificate.
  • the user may be prompted to input a protection password, and the protection password is carried in the message to verify whether the user is legal.
  • the client uses the ECC private key of the signed certificate to perform an ESDSA signature on the digest of the handshake information.
  • the encryption subprocess sends a client password specification change message ChangeCipherSpec to the network server.
  • the ClientChangeCipherSpec message indicates to the server that the algorithm and key negotiation are completed.
  • the encryption sub-process sends a client handshake end message Finished to the network server.
  • the encryption sub-process calculates the master_seceret according to the random number of the client, the random number of the server, the pre_master_seceret using the key algorithm, and then uses the random number and the master_seceret to calculate the real data encryption key, and then encrypts all the handshake messages and then encrypts them.
  • a ClientFinished message is formed and sent to the server.
  • the network server sends a server-side password specification change message ChangeCipherSpec to the encryption sub-process.
  • the web server sends the server handshake end message Finished to the encryption subprocess.
  • the server verifies the client certificate and verifies the client's signature using the client's signing certificate.
  • the service uses its own encrypted private key and performs ECDH operation to obtain pre_master_seceret. The same algorithm is used to calculate the master_seceret and the data encryption key, verify the correctness of the SeverFinished message, and send a SeverChangeCipherSpec message to the client to indicate the approval algorithm and key agreement. .
  • the authentication and key agreement processes of the browser client and the network server are completed, so that the encryption sub-process and the network server can respectively encrypt the application data by using the negotiated key.
  • Step 208 After the encrypted connection communication is successfully established, establish a second encrypted channel for performing secure communication between the encryption sub-process and the network server.
  • the encryption sub-process and the network server perform encrypted communication in a second encrypted channel.
  • the data communicated in the second encrypted channel may be encrypted by using the symmetric encryption algorithm SM4.
  • Step 210 The encryption sub-process creates a service processing thread; the service processing thread establishes a connection with the first encryption channel and the second encryption channel, respectively.
  • the service processing thread created by the encryption sub-process establishes a connection with a first encryption channel between the encryption sub-process and a main service process, and a second encryption channel between the encryption sub-process and the network server.
  • the service processing thread specifically performs data exchange between the two ends as a bridge between the main service process and the network server.
  • Step 212 After the encrypted connection communication is successfully established, the encryption sub-process performs forwarding of the service data between the first encrypted channel and the second encrypted channel.
  • the forwarding of the service data between the first encryption channel and the second encryption channel in the embodiment of the present invention may be implemented by: the service processing thread receiving through the first encryption channel.
  • the above process is a process of converting the data of two channels by the encryption sub-process in the data communication process.
  • the encryption sub-process and the browser main service process establish an encrypted connection communication by using a handshake process, and after the encrypted connection communication succeeds, establishing the main service of the browser.
  • a first encrypted channel that performs secure communication with the encryption sub-process; wherein, in the handshake process, performing two-way certificate authentication between the encryption sub-process and the browser main service process by using a first asymmetric algorithm Key exchange, and performing certificate authentication; a symmetric key is generated during the key exchange process.
  • the first asymmetric algorithm may specifically be an RSA algorithm.
  • the method for implementing the secure browser further includes: the service processing thread encrypting the first connection request by using a second symmetric algorithm to obtain a second connection request;
  • the service processing thread sends the second connection request to the network server;
  • the service processing thread receives a second connection response fed back by the network server based on the second connection request;
  • the second connection request is the second connection request
  • the connection response is decrypted by the second symmetric algorithm to obtain a first connection response, and is fed back to the browser main service process.
  • the specific process of the service processing thread is as follows: (1) receiving the proxy data, and specifically receiving the http request data of the proxy connection. (2) SSL connection with the network server, including SSL connection establishment, SSL protocol negotiation, algorithm negotiation, client certificate verification (CRL check or OCSP authentication) (3) and web services Interaction. Specifically, the proxy connection http request data is sent to the web server via the SSL channel of the encryption algorithm to obtain the http response of the web server. (4) The sending network server returns data to the proxy connection. Specifically, the http response of the web server is transferred to the proxy connection. (5) Close the connection. If an error occurs in the business process flow, the connection is closed and an error page is returned to the agent connection. It should be noted that the second symmetric algorithm may specifically be a national secret algorithm.
  • SSL security technology is widely used to solve network application identity authentication and data confidentiality.
  • SSL modules are also built into mainstream browsers and web servers.
  • Professional SSL hardware products are also widely used.
  • current SSL products still have certain limitations:
  • the current publicly available symmetric algorithms are commonly used in SSL products, which do not meet the confidentiality requirements and have certain risks.
  • the cryptographic product symmetric algorithm uses the SM1 algorithm or the SM4 algorithm.
  • the current certificate asymmetric algorithm uses the RSA algorithm, and the elliptic curve cipher (ECC) used in this embodiment is a public key cipher with higher security and higher efficiency than RSA, with encryption/decryption and digital Significant and cryptographic functions such as signature and key negotiation can safely and conveniently meet important information security requirements such as user identification in various information networks, authenticity identification and confidential transmission of electronic information, and are core technologies in the field of information security. It has gradually been adopted by many international and national standards organizations as public key cryptography standards (IEEE P1363, ANSI X9, ISO/IEC and IETF, etc.), and will become one of the mainstream cryptographic technologies used by the information security industry.
  • the ECC (ECDSA+ECDH) algorithm was named SM2.
  • the implementation method of the secure browser provided by the embodiment can implement a network security browser conforming to the PKI mechanism and the password product management policy, and actively promotes the regulation of the domestic security product management and the rapid growth of the network application. effect.
  • this embodiment also discloses a secure communication system.
  • FIG. 5 there is shown a block diagram of an embodiment of a secure communication system in accordance with one embodiment of the present invention.
  • FIG. 6 there is shown a secure browser device in an embodiment of a secure communication system in accordance with one embodiment of the present invention. Structure diagram.
  • the secure communication system includes a secure browser device 504 and a web server 502.
  • the network server 502 is configured to establish an encrypted connection communication with the secure browser device, and perform service data interaction with the secure browser device through the second encrypted channel after the encrypted connection communication is successfully established.
  • the secure browser device 504 includes a browser main service process module 50402 and an encryption sub-process module 50404.
  • the browser main service process module 50402 is configured to start, in a browser client, an encryption sub-process module of an encryption sub-process that communicates with a browser main service process, where the encryption sub-process is used as a connection.
  • the proxy implements the conversion of the first encrypted channel to the second encrypted channel, and data forwarding.
  • the cipher sub-process module 50404 includes: a proxy sub-module 504042, configured to listen to a browser main service process, and obtain a first connection request sent by the browser main service process. And after the encrypted connection communication is successfully established, the encryption sub-process performs forwarding of the service data between the first encrypted channel and the second encrypted channel.
  • the secure connection sub-module 504044 is configured to establish, according to the first connection request, the encrypted sub-process to establish an encrypted connection communication with the network server.
  • the first encryption channel is a secure communication channel of the browser main service process and the encryption sub-process; and the second encryption channel is a secure communication channel of the encryption sub-process and the network server.
  • HTTP HTTP-Hypertext Transfer Protocol
  • the browser main business process Different encryption protocols or algorithms are used with the network server, so that the two cannot communicate directly and cannot access the webpage of the web server.
  • a secure browser client which also sets an encryption sub-process that communicates with the browser main business process in the browser.
  • the main function of the encryption sub-process is to implement the conversion of the first encrypted channel to the second encrypted channel as a connection proxy, and data forwarding. That is, the encryption sub-process is used as the proxy of the main business process, which can perform encrypted communication with the main business process of the browser, and can also perform secure communication with the network server, such as the business data of the main business process of the browser.
  • An encrypted channel is sent to the encryption sub-process, and the encryption sub-process transmits the service data to the network server through the second encryption channel to implement data forwarding and communication between the two encrypted channels.
  • the main business process of the browser communicates directly with the network server, but when the communication is performed on the HTTP channel targeted for security, if the main service process cannot feed back to the network server.
  • the data information is parsed, and the encryption sub-process is started as a proxy connection, that is, the encryption sub-process acts as a proxy between the main service process and the network server.
  • the first encryption channel is a secure communication channel of the browser main service process and the encryption sub-process; and the second encryption channel is a secure communication channel of the encryption sub-process and the network server.
  • the encryption sub-process realizes the main service process and the network server by converting the encryption sub-process and the first encryption channel of the main service process into a second encryption channel of the encryption sub-process and the network server. Connection agent between.
  • the encryption sub-process may send the service data to the network server through the second encryption channel.
  • the encryption sub-process After the encryption sub-process receives the first connection request sent by the main service process, the encryption sub-process establishes an encrypted connection communication with the network server according to the first connection request.
  • the encryption sub-process establishes an encrypted connection communication with the network server, that is, the encryption sub-process and the network server perform security authentication to confirm that it is a secure and legal communication party, thereby establishing a channel for secure communication.
  • the encryption sub-process establishes an encrypted connection communication with the network server, and the encryption sub-process can also communicate with the main service process, so the encryption sub-process is respectively established with the main service process and the network server.
  • encrypted connection communication can serve as a bridge for data exchange between the two ends.
  • the first encryption channel is a secure communication channel of the browser main service process and the encryption sub-process; and the second encryption channel is a secure communication channel of the encryption sub-process and the network server. .
  • the encryption sub-process successfully establishes an encrypted connection communication with the network server, which means that the encryption sub-process and the network server can send data to each other, and the data is encrypted and processed to ensure data flow security and reliability.
  • the encryption sub-process may send the received service data in the first connection request to the network server. Specifically, the encryption sub-process performs forwarding of the service data between the first encrypted channel and the second encrypted channel, that is, The encryption sub-process may receive the service data through the first encryption channel, perform decryption, and then encrypt the service data by using an encryption method agreed by the second encryption channel, and then send the service data to the network server. In this way, the service data is forwarded from the first encrypted channel to the second encrypted channel, and the service data is forwarded from the primary service process to the network server.
  • an encryption sub-process that communicates with a browser main service process is started in a browser client, where the encryption sub-process is used as a connection proxy to implement conversion of the first encrypted channel to the second encrypted channel, and Data forwarding; then the encryption sub-process listens to the browser main business process, and acquires a first connection request sent by the browser main service process; and then according to the first connection request, the encryption sub-process and The network server establishes an encrypted connection communication; finally, after the encrypted connection communication is successfully established, the encryption sub-process performs forwarding of the service data between the first encrypted channel and the second encrypted channel; wherein, the An encrypted channel is a secure communication channel of the browser main service process and the encryption subprocess; the second encryption channel is the Encrypting the child process and the secure communication channel of the network server.
  • the encryption process is implemented as a proxy to implement the conversion of the first encrypted channel to the second encrypted channel, and the data is forwarded, and a secure encrypted channel is successfully established between the main service process of the browser and the network server, thereby ensuring
  • the secure transmission of business data can reduce the risk of business data leakage and improve the security and reliability of business data transmission.
  • the browser client can automatically start the encryption sub-process to establish a secure channel between the main service process and the network server to implement the above functions. Improves the security and reliability of data flow between the browser and the web server, enabling a secure browser to be implemented.
  • the proxy sub-module 504042 is configured to create a listening thread by the encryption sub-process; and the listening thread listens to the main service process through a service port.
  • the secure connection sub-module 504044 is configured to, after confirming that the first connection request is successfully received, the encryption sub-process and the network server sequentially perform encrypted data negotiation and certificate authentication; After the encrypted data negotiation is completed and the certificate authentication is passed, the encrypted connection communication between the browser client and the network server is established.
  • the secure connection sub-module 504044 configured to send, by the encryption sub-process, a client hello message to the network server, where the client hello message includes first encrypted data of the browser client, the first Encrypting data includes a plurality of protocol version numbers; receiving a server-side greeting message fed back by the network server, wherein the server-side greeting message includes second encrypted data of the server client, and the second encrypted data includes: a protocol version number selected in the first encrypted data; the network server 502, configured to feed back the server greeting message to the secure browser device.
  • the secure connection sub-module 504044 is configured to perform one-way certificate authentication on the network server; or the encryption sub-process and the network server perform two-way certificate authentication.
  • the proxy sub-module 504042 is further configured to create a service processing thread; the service processing thread establishes a connection with the first encrypted channel and the second encrypted channel, respectively.
  • the proxy sub-module 504042 is configured to receive, by using the service processing thread, the first service data sent by the primary service process by using the first encryption channel, and decrypting the first service data by using a first symmetric algorithm. Acquiring the original service data; performing the encryption processing on the original service data by using the second symmetric algorithm to obtain the second service data; and transmitting the second service data to the network server by using the second encryption channel.
  • the network server 502 is configured to receive, by the secure browser, the second service data by using the second encrypted channel.
  • the network server 502 is configured to send a server certificate message of the network server to the secure browser, where the server certificate message includes a site signing certificate of the network server, and the secure browser device
  • the secure connection sub-module 504044 is configured to receive a server certificate message sent by the network server;
  • the encryption sub-process authenticates the site signing certificate of the network server.
  • the network server 502 is configured to send, by the network server, a server certificate message to the secure browser, the server certificate message includes a site signing certificate of the network server, and send a server key exchange message,
  • the server key exchange message includes a key exchange parameter, and sends a certificate authentication request message, where the certificate authentication request message is used to indicate that the client performs certificate authentication, and the server greets the completion message; and receives the message sent by the browser security device.
  • the client certificate message is used to authenticate the signed certificate, and the client certificate message includes a signature certificate of the secure browser client.
  • the secure connection sub-module 504044 is configured to receive, by the encryption sub-process, a server certificate message sent by the network server, where the encryption sub-process receives a server-side key exchange message sent by the network server; Receiving, by the process, a certificate authentication request message sent by the network server; the encryption sub-process receiving a server greeting completion message sent by the network server; the encryption sub-process authenticating the site signature certificate; when the site signature After the certificate authentication is passed, the encryption sub-process sends a client certificate message to the network server, where the client certificate message includes a signature certificate of the browser client.
  • the secure connection sub-module 504044 is further configured to randomly generate a pre-master key according to the key exchange parameter, where the pre-master key is performed by an elliptic curve cryptographic algorithm SM2 by using an encrypted public key of the network server.
  • the encrypted sub-process generates the client key exchange message by using the pre-master key, and sends the message to the network server.
  • the network server 502 is further configured to receive the secret sent by the secure browser device. And a key exchange message, the pre-master key is obtained from the key exchange message.
  • the secure connection sub-module 504044 is further configured to acquire a signature verification parameter calculated according to the site signature certificate, and generate a client certificate verification message to be sent to the network server; the encryption sub-process sends a client to the network server. End password specification change message, to complete the negotiation of the encrypted data; the encryption sub-process sends a client handshake end message to the network server; the encryption sub-process receives the server-side password specification change message sent by the network server, The acknowledgment sub-process receives the server-side handshake end message sent by the network server; the network server 502 is further configured to sequentially receive the client certificate certificate sent by the secure browser device. The message, the client password specification change message, and the client handshake end message; and the server password specification change message and the server handshake end message are sequentially sent to the secure browser device.
  • the secure browser client 504 uses the encryption sub-process module 50404 to proxy the browser main service process module 50402, and performs SSL encryption, such as encrypted data negotiation, certificate authentication, key exchange, and signature authentication, with the network server 502 through a handshake process.
  • SSL encryption such as encrypted data negotiation, certificate authentication, key exchange, and signature authentication
  • the communication process, the specific handshake process is shown in Figure 4, the relevant handshake information and encryption algorithm, please refer to the discussion in the second part of the embodiment.
  • the method further includes: the secure connection sub-module 504044, configured to establish, after the encrypted connection communication is successfully established, a second encrypted channel for performing secure communication between the encryption sub-process and the network server.
  • the proxy sub-module 504042 is further configured to use the encryption sub-process and the main service process to handshake Establishing an encrypted connection communication, and after the encrypted connection communication succeeds, establishing a first encrypted channel for performing secure communication between the primary service process and the encrypted sub-process; wherein the handshake process is performed by using the first asymmetric algorithm Performing two-way certificate authentication, key interaction, and certificate authentication between the encryption sub-process and the main service process; and generating a symmetric key in the key interaction process.
  • the proxy sub-module 504042 is further configured to: the service processing thread encrypts the first connection request by using a second symmetric algorithm to obtain a second connection request; and the service processing thread sends the second connection request to the a network server; the service processing thread receives a second connection response fed back by the network server based on the second connection request; and the second connection request decrypts the second connection response by using a second symmetric algorithm to obtain a first connection Responding to and reporting to the main service process; the network server 502 is configured to receive a second connection request sent by the secure browser device, and generate a second connection response after processing the second connection request, The second connection response is sent to the secure browser device.
  • the encryption process sub-module 50404 further includes: a hardware management module 504046, configured to identify the security key storage hardware by the driver.
  • the certificate verification module 504048 is configured to perform an encryption operation in the two-way certificate authentication process according to the hardware certificate carrier.
  • the cipher sub-process module shown in FIG. 7 is a structural block diagram of the specific implementation. It can be understood that the cipher sub-process module includes: a configuration module 702 and a proxy module 704 (described above).
  • the proxy sub-module corresponds to the CTL management module 706, the CRL management module 708, the Session management module 710, the certificate verification module 712, the SSL connection module 714 (corresponding to the above-mentioned secure connection sub-module), and the USBKey operation module 716 (with the above hardware management sub- The module corresponds).
  • the CTL management module 706 and the CRL management module 708 correspond to the above-mentioned certificate verification submodule.
  • the proxy module accepts the connection of the browser main business process module, and performs corresponding processing according to the type of the browser main business process module connection to form a connection proxy of the browser main business process module.
  • the CTL module is used to manage the list of trusted root certificates.
  • the CRL management module is used to obtain a CRL list and manage a local CRL list.
  • the Session management module manages the session connection between the agent process and the web server.
  • the SSL connection module is responsible for establishing a secure connection to the web server.
  • the USBKey management module is responsible for operating the USBKey device.
  • the configuration module is responsible for reading and storing the relevant configuration of the client.
  • the CTL management module 706 the working principle is as follows:
  • the CTL describes a browser trusted root certificate list for verifying the server-side certificate.
  • the supported trusted root certificate is PEM-encoded and supports two types of certificate addition: 1) adding a trusted root certificate internally; 2) adding a trusted root certificate to the configuration file, and saving the configuration file with des encryption.
  • the CTL can be configured to not support import and export.
  • the CRL management module 708 the working principle is as follows:
  • the CRL describes the certificate revocation list of the certificate authority CA, which is essentially the certificate serial number, and the certificate serial number is represented by the Integer coded by ASN.1.
  • X509v3 card An extension in the book (OID 2.5.29.31) is used to specify the CRL publishing point for the certificate.
  • the device locally caches the CRL, and the CRL search performs a primary index according to the CA.
  • the steps for verifying the CRL are as follows: (1) Obtain the Issuer entry in the certificate and locate the corresponding CA node. If the Issuer entry does not exist or the corresponding CA entry is not found, it is considered an illegal certificate. ((2) Search for all CRL entries under the CA using the binary method.
  • the SSL connection needs to add 4 handshakes based on the TCP 3 handshake.
  • the connection establishment process is time consuming. Therefore, saving the session and multiplexing before multiplexing can effectively optimize the connection performance.
  • the memory index of the host+port to the session is established, and the subsequent session reuses the previous session, for example, the session validity period is 1 hour. When the browser is closed and the USBKey device is unplugged, the previous session will be cleared.
  • the encryption sub-process prompts the user to insert the security key storage hardware, that is, the USBKey device.
  • the certificate selection dialog box can be automatically recognized and popped up, prompting the user to select a certificate.
  • the encryption sub-process automatically recognizes that the security key storage hardware needs to rely on two key information in the CSP registry key: SKFImagePath: specifies the path of the SKF dynamic library and the TokenVidPid: string format.
  • the VendorID and ProductID of the KEY device are in a format similar to the one in HKEY_LOCAL_MACHINE ⁇ SYSTEM ⁇ CurrentControlSet ⁇ Enum ⁇ USB, which is VID_XXXX&PID_XXXX.
  • the browser will associate the corresponding driver with the vendorid and productid of the USBKey device to complete the related operations.
  • the browser does not store the pin password entered by the user, nor does it store the private key information in the USBKey.
  • the specific process is as follows: first connect to the USBKey device; then open the corresponding application (Application), the Application is determined by the user; then open the corresponding container (Container), the Container is determined by the user; then verify the PIN code (personal identification number), After verifying the error, you will be prompted to re-enter; then get the signed certificate information; then get the encrypted certificate information; finally turn off the device and disconnect.
  • Application Application
  • Container Container
  • PIN code personal identification number
  • the certificate verification on the server side occurs in the handshake protocol process, and the browser sends the Certificate message after receiving the ServerHelloDone message.
  • Certificate verification mainly ensures the rationality of the server.
  • the verification process depends on the CTL and CRL modules. The specific process is performed in the sub-process certificate verification thread pool. The check steps are as follows: Initialize the list of trusted root certificates; check whether it is a self-signed certificate; check the certificate extension information; check the certificate trust relationship; check the CRL list; check the certificate signature; check the certificate time validity; check whether the certificate is in the blacklist.
  • the browser main service process module includes: a certificate display module 802 and a white list management module 804.
  • the certificate display module 802 is responsible for displaying the digital certificate.
  • the whitelist management module 804 is responsible for managing a web server list supporting the encryption algorithm of the present embodiment.
  • the web server certificate storage module 806 is used to store a certificate responsible for managing the web server.
  • the proxy setup module 808 proxy sets the proxy responsible for setting up and encrypting the child process.
  • the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment.
  • modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment.
  • the modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components.
  • any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined.
  • Each feature disclosed in this specification (including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent or similar purpose.
  • Various component embodiments of the present invention may be implemented in hardware or on one or more processors Software modules are implemented or implemented in a combination of these.
  • a microprocessor or digital signal processor may be used in practice to implement some or all of the functionality of some or all of the components of the secure communication system device in accordance with embodiments of the present invention.
  • the invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein.
  • a program implementing the invention may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.
  • Figure 9 illustrates a computing device that can implement an implementation of a secure browser in accordance with the present invention.
  • the computing device conventionally includes a processor 910 and a program product or readable medium in the form of a memory 920.
  • Memory 920 can be an electronic memory such as a flash memory, EEPROM (Electrically Erasable Programmable Read Only Memory), EPROM, or ROM.
  • Memory 920 has a memory space 930 for program code 931 for performing any of the method steps described above.
  • storage space 930 for program code may include various program code 931 for implementing various steps in the above methods, respectively.
  • These program codes can be read from or written to one or more program products.
  • These program products include program code carriers such as memory cards.
  • Such a program product is typically a portable or fixed storage unit as described with reference to FIG.
  • the storage unit may have storage segments, storage spaces, and the like that are similarly arranged to memory 920 in the computing device of FIG.
  • the program code can be compressed, for example, in an appropriate form.
  • the storage unit includes readable code 931', ie, code that can be read by a processor, such as 910, which, when executed by a computing device, causes the computing device to perform various steps in the methods described above. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Storage Device Security (AREA)

Abstract

一种安全通信系统，所述的系统包括：安全浏览器装置和网络服务器，所述安全浏览器装置，包括：浏览器主业务进程模块和加密子进程模块。其中，所述加密子进程模块的加密子进程作为连接代理实现第一加密通道到第二加密通道的转换，以及数据转发，并通过所述加密子进程模块与所述网络服务器建立加密连接通信，保证了业务数据的安全传输，可以降低业务数据泄露的风险，提高业务数据传输的安全性和可靠性。

Description

一种安全通信系统 技术领域
本发明涉及互联网技术领域，特别是涉及一种安全通信系统。
背景技术
浏览器是指可以显示网页服务器或者文件系统的HTML(Hyper Text Markup Language，超级文本标记语言)文件内容，并让用户与这些文件交互的一种软件。浏览器主要通过HTTP(HyperText Transfer Protocol，超文本传送协议)与网页服务器交互并获取网页，为用户在网页中显示图像、动画、文字、视频、声音以及流媒体等，堪称是应用最为广泛的客户端程序之一。个人电脑上常见的浏览器包括微软的IE(Internet Explorer)、苹果的Safari、谷歌的Chrome、360安全浏览器、搜狗高速浏览器等。
随着互联网的快速发展，网络应用已经成为一种趋势，越来越多的网络应用可以在浏览器中实现，如网上证券、网上银行、电子政务、电子商务、网上办公等。进而越来越多的重要信息在网络中流转，但是浏览器中的网络应用认证机制较弱，明文传输等安全隐患严重阻碍了信息化的发展，如何保护这些数据的流转安全是浏览器实现网络应用面临的一个重要问题。
发明内容
鉴于上述问题，提出了本发明以便提供一种克服上述问题或者至少部分地解决上述问题的安全通信系统。
依据本发明的一个方面，提供了一种安全通信系统，包括：安全浏览器装置和网络服务器；其中，所述网络服务器，用于与所述安全浏览器装置建立加密连接通信；以及在所述加密连接通信建立成功后，与所述安全浏览器装置通过第二加密通道执行业务数据交互；所述安全浏览器装置，包括：浏览器主业务进程模块和加密子进程模块，其中，所述浏览器主业务进程模块，用于在浏览器客户端中启动与浏览器主业务进程进行通信的加密子进程的加密子进程模块，其中，所述加密子进程用于作为连接代理实现第一加密通道到第二加密通道的转换，以及数据转发；所述加密子进程模块，包括：代理子模块，用于对浏览器主业务进程进行侦听，并获取所述浏览器主业务进程发送的第一连接请求；以及在所述加密连接通信建立成功后，所述加密子进程执行业务数据在所述第一加密通道和第二加密通道之间的转发；安全连接子模块，用于依据所述第一连接请求， 所述加密子进程与所述网络服务器建立加密连接通信；其中，所述第一加密通道为所述浏览器主业务进程和所述加密子进程的安全通信通道；所述第二加密通道为所述加密子进程和所述网络服务器的安全通信通道。
本实施例可以通过加密子进程作为代理实现第一加密通道到第二加密通道的转换，以及数据转发，成功在浏览器的主业务进程与网络服务器之间建立了一条安全的加密通道，保证了业务数据的安全传输，可以降低业务数据泄露的风险，提高业务数据传输的安全性和可靠性。而且，由于本实施例通过浏览器实现上述功能，因此在用户使用浏览器客户端的过程中，浏览器客户端可以自动启动加密子进程在主业务进程与网络服务器之间建立安全通道，实现上述功能，提高了浏览器与网络服务器进行数据流转的安全性和可靠性，使得安全浏览器得以实现。
上述说明仅是本发明技术方案的概述，为了能够更清楚了解本发明的技术手段，而可依照说明书的内容予以实施，并且为了让本发明的上述和其它目的、特征和优点能够更明显易懂，以下特举本发明的具体实施方式。
附图说明
通过阅读下文优选实施方式的详细描述，各种其他的优点和益处对于本领域普通技术人员将变得清楚明了。附图仅用于示出优选实施方式的目的，而并不认为是对本发明的限制。而且在整个附图中，用相同的参考符号表示相同的部件。在附图中：
图1示出了根据本发明一个实施例的一种安全浏览器的实现方法的流程图；
图2示出了根据本发明一个实施例的一种安全浏览器的实现方法的流程图；
图3示出了根据本发明一个实施例的加密子进程的一种代理机制示意图；
图4示出了根据本发明一个实施例的加密子进程和网络服务器的握手过程示意图；
图5示出了根据本发明一个实施例的一种安全通信系统的结构框图；
图6示出了根据本发明一个实施例的一种安全通信系统的结构框图；
图7示出了根据本发明实施例提供的加密子进程模块的一种结构框图；以及
图8示出了根据本发明实施例提供的浏览器主业务进程模块的一种结构框图；
图9示出了用于执行根据本发明的安全浏览器的实现方法的计算设备的框图；
图10示出了用于保持或者携带实现根据本发明的安全浏览器的实现方法的程序代码的存储单元。
具体实施方式
下面将参照附图更详细地描述本公开的示例性实施例。虽然附图中显示了本公开的示例性实施例，然而应当理解，可以以各种形式实现本公开而不应被这里阐述的实施例 所限制。相反，提供这些实施例是为了能够更透彻地理解本公开，并且能够将本公开的范围完整的传达给本领域的技术人员。
实施例一：
参照图1，示出了根据本发明一个实施例的一种安全浏览器的实现方法实施例的步骤流程图，具体可以包括如下步骤：
步骤102，在浏览器客户端中启动与浏览器主业务进程进行通信的加密子进程，其中，所述加密子进程用于作为连接代理实现第一加密通道到第二加密通道的转换，以及数据转发。
对于一些网站，如银行网站、支付宝网站等涉及金融业务的网站需要通过以安全为目标的HTTP(Hyper Text Transfer Protocol，超文本传送协议)通道进行加密数据的传输，但是有时浏览器主业务进程与网络服务器采用不同的加密协议或算法，导致两者无法直接通信，无法对该网络服务器的网页进行访问。
本实施例中，提供了一种安全浏览器客户端，其在浏览器中还设置了与浏览器主业务进程进行通信的加密子进程。为了使得安全浏览器能够实现，需要首先在浏览器客户端中启动与浏览器主业务进程进行通信的加密子进程。所述加密子进程的主要功能是作为连接代理，实现第一加密通道到第二加密通道的转换，以及数据转发。即采用加密子进程作为主业务进程的代理，其既能与浏览器主业务进程进行加密的安全通行，也能够与网络服务器进行加密的安全通信，如对于浏览器主业务进程的业务数据通过第一加密通道发送给加密子进程，该加密子进程将业务数据通过第二加密通道传输给网络服务器，实现数据转发以及两个加密通道的连通。
需要说明的是，通常情况下，浏览器的主业务进程与网络服务器直接进行通信，但是，在以安全为目标的HTTP通道进行通信时，若主业务进程无法对网络服务器反馈的数据信息进行解析，启动所述加密子进程作为代理连接，即所述加密子进程作为所述主业务进程与所述网络服务器之间的代理。本实施例中上述第一加密通道为所述浏览器主业务进程和所述加密子进程的安全通信通道；所述第二加密通道为所述加密子进程和网络服务器的安全通信通道。因此所述加密子进程通过将加密子进程与所述主业务进程的第一加密通道，转换为加密子进程与网络服务器的第二加密通道，来实现所述主业务进程与所述网络服务器之间的连接代理。当然对于主业务进程通过所述第一加密通道发送给加密子进程的业务数据，加密子进程可以将所述业务数据通过第二加密通道发送给网络服务器。
步骤104，所述加密子进程对浏览器主业务进程进行侦听，并获取所述浏览器主业务进程发送的第一连接请求。
加密子进程对浏览器主业务进程进行侦听，是为了第一时间获取浏览器主业务进程发送的第一连接请求。具体实现时，加密子进程可以通过服务端口对所述浏览器主业务进程进行侦听。当加密子进程侦听到第一连接请求到来时，加密子进程接收所述主业务进程发送的第一连接请求。所述浏览器主业务进程发送的第一连接请求，具体可以包括业务数据。
步骤106，依据所述第一连接请求，所述加密子进程与所述网络服务器建立加密连接通信。
加密子进程接收到主业务进程发送来的第一连接请求之后，所述加密子进程依据所述第一连接请求，与所述网络服务器建立加密连接通信。所述加密子进程与所述网络服务器建立加密连接通信，即所述加密子进程和所述网络服务器进行安全认证，以确认是安全、合法的通信方，从而建立安全通信的通道。
需要说明的是，所述加密子进程与所述网络服务器建立加密连接通信，结合加密子进程与主业务进程也可以进行通信，因此加密子进程分别与主业务进程和网络服务器这两端建立了相应连接，加密连接通信可以作为所述两端进行数据交换的桥梁。
步骤108，在所述加密连接通信建立成功后，所述加密子进程执行业务数据在所述第一加密通道和第二加密通道之间的转发。
本实施例中所述第一加密通道为所述浏览器主业务进程和所述加密子进程的安全通信通道；所述第二加密通道为所述加密子进程和所述网络服务器的安全通信通道。
所述加密子进程与所述网络服务器成功建立加密连接通信，意味着加密子进程与网络服务器之间能够相互发送数据，并且这些数据经加密处理，可以保证数据流转的安全可靠。加密子进程可以将接收到的所述第一连接请求中的业务数据发送给网络服务器，具体地，加密子进程执行业务数据在所述第一加密通道和第二加密通道之间的转发，即加密子进程可以通过所述第一加密通道接收业务数据，进行解密后，再采用第二加密通道约定的加密方法对业务数据进行加密后，发送给所述网络服务器。这样所述业务数据就从第一加密通道转发至第二加密通道，代表业务数据从主业务进程转发至网络服务器了。
本实施例首先在浏览器客户端中启动与浏览器主业务进程进行通信的加密子进程，其中，所述加密子进程用于作为连接代理实现第一加密通道到第二加密通道的转换，以及数据转发；然后所述加密子进程对浏览器主业务进程进行侦听，并获取所述浏览器主业务进程发送的第一连接请求；接着依据所述第一连接请求，所述加密子进程与所述网络服务器建立加密连接通信；最后在所述加密连接通信建立成功后，所述加密子进程执行业务数据在所述第一加密通道和第二加密通道之间的转发；其中，所述第一加密通道 为所述浏览器主业务进程和所述加密子进程的安全通信通道；所述第二加密通道为所述加密子进程和所述网络服务器的安全通信通道。本实施例可以通过加密子进程作为代理实现第一加密通道到第二加密通道的转换，以及数据转发，成功在浏览器的主业务进程与网络服务器之间建立了一条安全的加密通道，保证了业务数据的安全传输，可以降低业务数据泄露的风险，提高业务数据传输的安全性和可靠性。而且，由于本实施例通过浏览器实现上述功能，因此在用户使用浏览器客户端的过程中，浏览器客户端可以自动启动加密子进程在主业务进程与网络服务器之间建立安全通道，实现上述功能，提高了浏览器与网络服务器进行数据流转的安全性和可靠性，使得安全浏览器得以实现。
实施例二：
在上述实施例的基础上，本实施例继续论述安全浏览器的实现方法。
参照图2，示出了根据本发明一个实施例的一种安全浏览器的实现方法实施例的步骤流程图，具体可以包括如下步骤：
步骤202，在浏览器客户端中启动与浏览器主业务进程进行通信的加密子进程，其中，所述加密子进程用于作为连接代理实现第一加密通道到第二加密通道的转换，以及数据转发。
本实施例中在浏览器客户端中启动与浏览器主业务进程进行通信的加密子进程，可以由浏览器自动启动，具体地，当浏览器主业务进程与网络服务器通信失败时，浏览器自动启动所述加密子进程，所述加密子进程接收主业务进程的第一连接请求，根据所述第一连接请求中包含的业务数据进行相应处理，形成浏览器主业务进程的代理连接。
本实施例中上述第一加密通道为所述浏览器主业务进程和所述加密子进程的安全通信通道；所述第二加密通道为所述加密子进程和网络服务器的安全通信通道。因此所述加密子进程通过将加密子进程与所述主业务进程的第一加密通道，转换为加密子进程与网络服务器的第二加密通道，来实现所述主业务进程与所述网络服务器之间的连接代理。当然对于主业务进程通过所述第一加密通道发送给加密子进程的业务数据，加密子进程可以将所述业务数据通过第二加密通道发送给网络服务器。
本实施例中，浏览器主业务进程与加密子进程采用代理及IPC(Inter-Process Communication，进程间通信)两种通信方式，从而加密子进程可以作为连接代理，负责和浏览器主业务进程第一加密通道，到和网络服务器的第二加密通道的通道转换及数据转发，而IPC通信方式负责进程间数据传递。本实施例中，加密子进程代理实现机制如图3所示，具体可以包括如下结构：
主线程：读取各类配置，创建监听线程、主业务线程，以及浏览器主进程IPC通。
侦听线程：用于监听服务端口，当有主业务进程存在连接请求并接收(accept)成功 执行相应的代理操作。
业务处理线程：与主业务进程和网络服务器两端分别建立相应加密通道连接并维持，从而作为桥梁进行两端的数据交换。
步骤204，所述加密子进程对浏览器主业务进程进行侦听，并获取所述浏览器主业务进程发送的第一连接请求。
所述加密子进程对浏览器主业务进程进行侦听，具体可以通过以下方式来实现：所述加密子进程创建侦听线程；所述侦听线程通过服务端口对所述浏览器主业务进程进行侦听。当侦听线程侦听到第一连接请求到来时，接收所述主业务进程发送的第一连接请求。所述浏览器主业务进程发送的第一连接请求，具体可以包括业务数据。加密子进程对浏览器主业务进程进行侦听，是为了第一时间获取浏览器主业务进程发送的第一连接请求。
步骤206，依据所述第一连接请求，所述加密子进程与所述网络服务器建立加密连接通信。
本实施例中依据所述第一连接请求，所述加密子进程与所述网络服务器建立加密连接通信，具体可以包括以下子步骤：
子步骤一，在确认所述第一连接请求接收成功后，所述加密子进程与所述网络服务器依次进行加密数据协商和证书认证。
子步骤二，在加密数据协商完毕且证书认证通过后，建立所述浏览器客户端与网络服务器的加密连接通信。
需要说明的是，所述子步骤一中加密子进程与所述网络服务器进行加密数据协商的步骤，具体可以通过以下方式来实现：首先，所述加密子进程向所述网络服务器发送客户端问候消息，其中，所述客户端问候消息包括所述浏览器客户端的第一加密数据，所述第一加密数据包括若干协议版本号；其次，所述网络服务器向所述加密子进程反馈服务端问候消息，其中，所述服务端问候消息包括所述服务器客户端的第二加密数据，所述第二加密数据包括：从所述第一加密数据中选定的协议版本号。需要说明的是，上述客户端问候消息和服务端问候消息用于确定双方的安全传输能力，包括若干协议版本号、会话标识、密码套件等属性，并且产生和交换随机数。
客户端问候消息(ClientHello消息)作为浏览器客户端和网络服务器握手协议的第一条消息，所述加密子进程向所述网络服务器发送客户端问候消息之后，等待网络服务器返回服务器问候消息。客户端问题消息结构定义：
1、Clien_vision表示客户端在这个会话中使用的协议版本。如协议版本号是1.1。
2、Radom是客户端产生的随机信息，其内容包括始终和随机数。
3、session_id是客户端在连接中使用的会话标识。session_id是一个可变长字段，其值由服务器决定。如果没有可重用的会话标识或希望协商安全参数，该字段为空，否则表示客户端希望重用该会话。这个会话标识可能是之前的连接标识，当前连接标识，或其他处于连接状态的连接标识。会话标识生成后应一致保持到被超时删除或与这个会话相关的连接遇到致命错误被关闭。一个会话失效或被关闭时则与其相关的连接都应被强制关闭。
4、cipher_suites是客户端所支持的密码套件列表，客户端应按照密码套件使用的优先级顺序排列，优先级最高的密码套件应排在首位。如果会话标识字段不为空，本字段应至少包含将重用的会话所使用的密码套件。每个密码套件包括一个密钥交换算法，一个加密算法和一个校验算法。服务器将在密码套件列表中选择一个与之匹配的密码套件，如果没有可匹配的密码套件，应返回握手失败报警消息并且关闭连接。
5、compression_methods是客户端所支持的压缩算法列表，客户端应该按照压缩算法使用的优先级顺序排列，优先级最高的压缩算法排在首位。服务器将在压缩算法列表中选择一个与之匹配的压缩算法，列表中必须包含空压缩算法，这样客户端和服务器总能协商出一致的压缩算法。
需要说明的是，服务器如果能从客户端问候消息中找到匹配的密码套件，服务器发送所述服务端问候消息(Server Hello消息)作为对客户端问候消息的回复。如果找不到匹配的密码套件，服务器将回应报警消息。
需要说明的是，所述子步骤一中加密子进程与所述网络服务器依次进行证书认证的步骤，具体可以包括：所述加密子进程对所述网络服务器进行单向证书认证；或，所述加密子进程和所述网络服务器进行双向证书认证。
本发明一个可选实施例中，在进行数字证书的双向认证时，所述加密子进程弹出证书选择框，并在所述证书选择框中显示所述浏览器所在终端中加载的各用户证书的信息；通过所述证书选择框接收用户选择的用户证书。
还包括：所述加密子进程显示口令输入消息，所述口令输入消息用于提示用户输入所述用户证书对应的保护口令；所述加密子进程接收用户输入的保护口令，并对所述保护口令进行验证，在确认所述保护口令确认所述用户具有所述用户证书的使用权限。
本实施例中，为了保证访问网站和用户的安全，CA(Certificate Authority，认证中心)机构为不同的网站颁布不同的站点证书，同时为不同网站的不同用户颁布不同的用户证书。其中，数字证书中包括站点或用户的公钥，站点或用户的信息，以及数字签名等内容。
在双向认证过程中，所述加密子进程可以在浏览器客户端中弹出证书选择框，并在 所述证书选择框中显示所述浏览器所在终端中加载的各用户证书的信息；通过所述证书选择框接收用户选择的用户证书，用户在对用户证书进行选择后，所述加密子进程显示口令输入消息，所述口令输入消息用于提示用户输入所述用户证书对应的保护口令，如输入个人识别码(Personal Identification Number，PIN)，所述加密子进程接收用户输入的保护口令，并对所述保护口令进行验证，即通过保护口令可以对用户身份进行认证，确认用户是否具有该用户证书的使用权项，从而在保护口令输入正确后确认所述用户具有所述用户证书的使用权限。并且，上述用户证书和保护口令可以作为用户证书认证过程中的认证数据发送给网络服务器。
可选的，还包括：所述加密子进程通过提示信息提示用户插入安全密钥存储硬件，所述安全密钥存储硬件中存储有用户证书；所述加密子进程调用驱动程序检测所述安全密钥存储硬件；当检测到所述安全密钥存储硬件后，所述加密子进程获取所述安全密钥存储硬件中存储的用户证书的信息。
浏览器客户端加载用户证书时，首先所述加密子进程通过提示信息提示用户插入安全密钥存储硬件，该安全密钥存储硬件即USB Key，它是一种USB(Universal Serial Bus，通用串行总线)接口的硬件设备，内置单片机或智能卡芯片，有一定的存储空间，可以存储用户的私钥以及数字证书，利用USB Key内置的公钥算法实现对用户身份的认证。由于用户私钥保存在密码锁中，理论上使用任何方式都无法读取，因此保证了用户认证的安全性。
所述加密子进程通过驱动识别安全密钥存储硬件，并依据所述硬件证书载体在双向证书认证过程中进行加密运算。例如，SSL(Secure Sockets Layer，安全套接层)连接建立过程中如果需要双向认证，所述加密子进程会提示用户插入安全密钥存储硬件，即USBKey设备。在用户插入安全密钥存储硬件后能够自动识别并弹出证书选择对话框，提示用户选择证书。所述加密子进程自动识别安全密钥存储硬件需要依赖CSP(Cryptographic Service Provider，加密服务提供)注册表项中的两个关键信息：SKFImagePath：指定SKF动态库的路径和TokenVidPid：字符串格式。
KEY设备的VendorID和ProductID，采用的格式类似HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB中的格式，也即VID_XXXX&PID_XXXX。浏览器会通过USBKey设备的vendorid、productid关联到相应驱动，完成相关操作。浏览器不会存储用户输入的pin密码，也不会存储USBKey中的私钥信息。具体流程如下：首先连接到USBKey设备；然后打开相应应用(Application)，Application由用户选择决定；然后打开相应容器(Container)，Container由用户选择决定；接着校验PIN码(个人身份识别码)，验证错误后会提示重新输入；然后获取签名证书信 息；接着获取加密证书信息；最后关闭设备、断开连接。
1、单向认证
在本发明实施例的一种可选示例中，所述加密子进程对所述网络服务器进行单向证书认证，具体可以通过以下方式来实现：首先，所述加密子进程接收所述网络服务器发送的服务端证书消息，所述服务端证书消息包括所述网络服务器的站点签名证书；其次，所述加密子进程对所述网络服务器的站点签名证书进行认证。下面对服务端证书消息(Server Certificate消息)进行说明，网络服务器需要发送一个服务端证书消息给客户端，该消息总是紧跟在服务端问候消息之后，当选中的密码套件使用RSA或ECC或ECDHE算法时，所述服务端证书消息的内容为服务端标识和IBC公共参数，用于客户端与服务器协商IBC公开参数。密钥交换算法与证书密钥类型的关系如表1所示。
密钥交换算法 证书密钥类型
RSA RSA公钥，必须使用加密证书中的公钥
IBC 服务端标识和IBC公共参数
IBSDH 服务端标识和IBC公共参数
ECC ECC公钥，必须使用加密证书中的公钥
ECDHE ECC公钥，必须使用加密证书中的公钥
表1，密钥交换算法与证书密钥类型关系表
2、双向认证
在本发明实施例的一种可选示例中，所述加密子进程和所述网络服务器进行双向证书认证，具体可以通过以下方式来实现：
1)所述加密子进程接收所述网络服务器发送的服务端证书消息，所述服务端证书消息包括所述网络服务器的站点签名证书；
2)所述加密子进程接收所述网络服务器发送的证书认证请求消息，所述证书认证请求消息用于指示进行客户端的证书认证；
3)所述加密子进程接收所述网络服务器发送的服务端密钥交换消息，包括密钥交换参数；
4)所述加密子进程接收所述网络服务器发送的服务端问候完结消息；
5)所述加密子进程对所述站点签名证书进行认证；
6)当所述站点签名证书认证通过后，所述加密子进程向所述网络服务器发送客户端证书消息，所述客户端证书消息包括所述浏览器客户端的签名证书，以使所述网络服务器对所述签名证书进行认证。
在本发明实施例的一种可选示例中，所述的方法还包括密钥交换的步骤：所述加密 子进程依据所述密钥交换参数随机产生预主密钥，其中，所述预主密钥是采用所述网络服务器的加密公钥通过椭圆曲线密码算法SM2进行加密计算得到的；所述加密子进程采用所述预主密钥生成客户端密钥交换消息，并发送给网络服务器，以使所述网络服务器获取所述预主密钥。
在本发明实施例一种可选示例中，所述的方法还包括验证证书签名的步骤，具体包括：所述加密子进程获取依据站点签名证书计算的签名校验参数，并生成客户端证书校验消息发送给所述网络服务器；所述加密子进程向所述网络服务器发送客户端密码规格变更消息，以表征加密数据的协商完成；所述加密子进程向所述网络服务器发送客户端握手结束消息；所述加密子进程接收所述网络服务器发送的服务端密码规格变更消息，以表征认可该加密数据的协商；所述加密子进程接收所述网络服务器发送的服务端握手结束消息。需要说明的是，国密SSL连接过程的每次SSL握手处理中，都对服务器证书进行了严格的验证。
本实施例中，上述加密数据协商、证书认证、密钥交换以及签名认证都是在安全浏览器客户端的加密子进程和网络服务器的握手过程中执行的。本实施例中，双向认证采用了双证书机制，证书的非对称算法采用SM2算法，使用签名证书基于ECDSA签名实现身份认证，使用加密证书基于ECDH实现密钥协商。使用的SM4算法对数据进行加密，使用SM3算法对数据进行摘要。
其中，SM2算法(SM2 algorithm)是一种椭圆曲线公钥密码算法，其密钥长度为256比特。SM3算法(SM3 algorithm)是一种密码杂凑算法，其密钥长度为128比特，SM4算法(SM4 algorithm)是一种分组密码算法，分组长度为128比特，密钥长度为128比特。
如图4所示，加密子进程和网络服务器的握手过程包括：
4.02、加密子进程发送客户端问候消息ClientHello给网络服务器。
4.04、网络服务器发送服务端问候消息SeverHello给所述安全浏览器客户端的加密子进程。
其中，网络服务器从ClientHello消息中找到匹配的密码套件，发送SeverHello作为回复，若找不到匹配的密码套件，则发送报警消息。该SeverHello中，Sever_vision，表示服务器支持的版本号，如1.1；Radom服务器端产生的随机数；session_id服务端使用的会话标识；cipher_suites服务端从ClientHello消息中选取的密码套件；compression_methods服务端从ClientHello消息中选取的压缩算法。
4.06、网络服务器发送服务端证书消息Certificate给加密子进程。
即SeverCertificate本消息内容为签名证书和加密证书。如服务端的站点签名证书 (X.509序列)
4.08、网络服务器发送证书认证请求消息SeverRequest给加密子进程。
通过SeverRequest消息要求客户端提供证书。同时指明了认证类型(ECDSA)
4.10、网络服务器发送服务端密钥交换消息SeverKeyExchange给加密子进程。
SeverKeyExchange用于客户端计算产生48字节的预主密钥。公钥可以直接从服务器端的加密证书中获取。如客户端随机产生预主密钥pre_master_seceret密钥，并使用服务器证书的公钥进行ECDH运算
4.12、网络服务器发送问候完结消息SeverHelloDone给加密子进程。
SeverHelloDone表征握手过程的hello消息阶段完成，然后等待客户端的响应消息。
4.14、加密子进程发送客户密钥交换消息Certificate给网络服务器。
即ClientCertificate消息是hello消息阶段完成后的第一条消息，如包括客户的签名证书(X.509序列)。
4.16、加密子进程发送客户密钥交换消息ClientKeyExchange给网络服务器。
ClientKeyExchange消息中网络服务器的公钥加密预主密钥。
4.18、加密子进程发送证书校验消息CertificateVerify给网络服务器。
CertificateVerify消息用于鉴别客户端是够为证书的合法持有者。本实施例中，提示用户插入USBKey后可以提示用户输入保护口令，该保护口令即携带在该消息中验证用户是否合法。如，客户端使用签名证书的ECC私钥对握手信息的摘要进行ESDSA签名。
4.20、加密子进程发送客户端密码规格变更消息ChangeCipherSpec给网络服务器。
即ClientChangeCipherSpec消息向服务端表明算法及密钥协商完成。
4.22、加密子进程发送客户端握手结束消息Finished给网络服务器。
本实施例中，加密子进程根据客户端的随机数、服务端的随机数、pre_master_seceret使用密钥算法计算master_seceret，然后再使用随机数和master_seceret计算真正的数据加密密钥，然后将所有握手消息摘要后加密形成ClientFinished消息向服务端发送。
4.24、网络服务器发送服务端密码规格变更消息ChangeCipherSpec给加密子进程。
4.26、网络服务器发送服务端握手结束消息Finished给加密子进程。
服务端验证客户端证书，使用客户端的签名证书验证客户端的签名。服务使用自身的加密私钥和进行ECDH运算，获得pre_master_seceret，采用客户端同样的算法计算master_seceret和数据加密密钥，验证SeverFinished消息的正确性，向客户端发送SeverChangeCipherSpec消息，表示认可算法及密钥协商。
通过上述握手过程完成了浏览器客户端和网络服务器双方的认证、密钥协商等过程，从而加密子进程和网络服务端可以分别使用协商计算出的密钥加密应用数据。
步骤208，在所述加密连接通信建立成功后，建立为所述加密子进程和所述网络服务器进行安全通信的第二加密通道。
所述加密子进程和所述网络服务器在第二加密通道中进行加密通信。具体地，可以将在第二加密通道中进行通信的数据采用对称加密算法SM4对业务数据进行加密。
步骤210，所述加密子进程创建业务处理线程；所述业务处理线程分别与所述第一加密通道和所述第二加密通道建立连接。
所述加密子进程创建的业务处理线程，与所述加密子进程与主业务进程之间的第一加密通道，和所述加密子进程与网络服务器之间的第二加密通道都建立连接。所述业务处理线程具体作为所述主业务进程和所述网络服务器之间的桥梁进行两端的数据交换。
步骤212，在所述加密连接通信建立成功后，所述加密子进程执行业务数据在所述第一加密通道和第二加密通道之间的转发。
本实施例中所述加密子进程执行业务数据在所述第一加密通道和第二加密通道之间的转发，具体可以通过以下方式来实现：所述业务处理线程通过所述第一加密通道接收所述浏览器主业务进程发送的第一业务数据；所述业务处理线程采用第一对称算法对所述第一业务数据进行解密处理，获取原始业务数据；所述业务处理线程采用第二对称算法对所述原始业务数据进行加密处理，获取所述第二业务数据；所述业务处理线程采用通过所述第二加密通道间所述第二业务数据发送给所述网络服务器。需要说明的是，上述过程是数据通信过程中加密子进程分别对两个通道数据转换的过程。
在本发明实施例的一种可选示例中，所述加密子进程和所述浏览器主业务进程通过握手过程建立加密连接通信，并在加密连接通信成功后，建立为所述浏览器主业务进程和所述加密子进程进行安全通信的第一加密通道；其中，所述握手过程中执行通过第一非对称算法执行所述加密子进程和所述浏览器主业务进程之间的双向证书认证、密钥交换，以及执行证书认证；所述密钥交换过程中生成对称密钥。需要说明的是，第一非对称算法具体可以是RSA算法。
在本发明实施例的一种可选示例中，所述安全浏览器的实现方法还包括：所述业务处理线程将第一连接请求通过第二对称算法进行加密处理得到第二连接请求；所述业务处理线程将所述第二连接请求发送给所述网络服务器；所述业务处理线程接收所述网络服务器基于所述第二连接请求反馈的第二连接应答；第二连接请求将所述第二连接应答通过第二对称算法进行解密处理得到第一连接应答，并反馈给所述浏览器主业务进程。
需要说明的是，业务处理线程的具体流程如下：(1)接收代理数据，具体接收代理连接的http request数据。(2)与网络服务器进行SSL连接，具体包括SSL连接的建立，SSL协议协商，算法协商，客户端证书验证(CRL检查或OCSP认证)(3)与web服务 器交互。具体将代理连接http request数据经由加密算法的SSL通道发给Web服务器，获取Web服务器的http response。(4)发送网络服务器返回数据给代理连接。具体将网络服务器的http response转给代理连接。(5)关闭连接。业务处理流程中如果发生错误，则关闭连接，同时给代理连接返回错误页面。需要说明的是，所述第二对称算法具体可以是国密算法。
需要说明的是，采用SSL的安全技术解决网络应用身份认证以及数据保密性得到广泛的认可，主流的浏览器和网络服务器中也内置了SSL模块，专业的SSL硬件产品也广泛使用。但当前SSL产品还都存在一定局限性：
(1)当前SSL产品普遍采用单证书机制。而双证书机制是当前PKI(Public Key Infrastructure，公钥基础设施)体系建设的主流模式。本实施例使用签名证书进行身份认证，使用加密证书进行密钥的交换和保护，发挥了PKI技术非对称密钥的优势。
(2)当前的SSL产品中普遍采用国外公开的对称算法，不符合保密要求，具有一定风险性。本实施例中密码产品对称算法采用SM1算法或SM4算法。
(3)当前的证书非对称算法采用RSA算法，而本实施例采用的椭圆曲线密码(ECC)是一种比RSA具有更高安全性、更高效率的公钥密码，具有加密/解密、数字签名和密钥协商等重要的密码功能，可以安全且方便地满足各种信息网络中的用户身份识别、电子信息的真伪鉴别和保密传输等重要的信息安全需求，是信息安全领域的核心技术，并已逐渐被诸多国际和国家标准组织采纳为公钥密码标准(IEEE P1363、ANSI X9、ISO/IEC和IETF等)，将会成为信息安全产业界使用的主流密码技术之一。将该ECC(ECDSA+ECDH)算法命名为SM2。
本实施例提供的安全浏览器的实现方法，可以实现符合该PKI机制和密码产品管理政策的网络安全浏览器，对国内安全产品的管理的规范性和网络应用的快速增长都起到积极的推动作用。
对于方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本发明实施例并不受所描述的动作顺序的限制，因为依据本发明实施例，某些步骤可以采用其他顺序或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作并不一定是本发明实施例所必须的。
实施例三
在上述实施例的基础上，本实施例还公开了一种安全通信系统。
参照图5，示出了根据本发明一个实施例的安全通信系统实施例的结构框图。
参照图6，示出了根据本发明一个实施例的安全通信系统实施例中安全浏览器装置的 结构框图。
该安全通信系统，包括：安全浏览器装置504和网络服务器502。
其中，所述网络服务器502，用于与所述安全浏览器装置建立加密连接通信；以及在所述加密连接通信建立成功后，与所述安全浏览器装置通过第二加密通道执行业务数据交互。
所述安全浏览器装置504，包括：浏览器主业务进程模块50402和加密子进程模块50404。
其中，所述浏览器主业务进程模块50402，用于在浏览器客户端中启动与浏览器主业务进程进行通信的加密子进程的加密子进程模块，其中，所述加密子进程用于作为连接代理实现第一加密通道到第二加密通道的转换，以及数据转发。
所述加密子进程模块50404，包括：代理子模块504042，用于对浏览器主业务进程进行侦听，并获取所述浏览器主业务进程发送的第一连接请求。以及在所述加密连接通信建立成功后，所述加密子进程执行业务数据在所述第一加密通道和第二加密通道之间的转发。
安全连接子模块504044，用于依据所述第一连接请求，所述加密子进程与所述网络服务器建立加密连接通信。
其中，所述第一加密通道为所述浏览器主业务进程和所述加密子进程的安全通信通道；所述第二加密通道为所述加密子进程和所述网络服务器的安全通信通道。
对于一些网站，如银行网站、支付宝网站等涉及金融业务的网站需要通过以安全为目标的HTTP(HTTP-Hypertext transfer protocol，超文本传送协议)通道进行加密数据的传输，但是有时浏览器主业务进程与网络服务器采用不同的加密协议或算法，导致两者无法直接通信，无法对该网络服务器的网页进行访问。
本实施例中，提供了一种安全浏览器客户端，其在浏览器中还设置了与浏览器主业务进程进行通信的加密子进程。为了使得安全浏览器能够实现，需要首先在浏览器客户端中启动与浏览器主业务进程进行通信的加密子进程。所述加密子进程的主要功能是作为连接代理实现第一加密通道到第二加密通道的转换，以及数据转发。即采用加密子进程作为主业务进程的代理，其既能与浏览器主业务进程进行加密的安全通行，也能够与网络服务器进行加密的安全通信，如对于浏览器主业务进程的业务数据通过第一加密通道发送给加密子进程，该加密子进程将业务数据通过第二加密通道传输给网络服务器，实现数据转发以及两个加密通道的连通。
需要说明的是，通常情况下，浏览器的主业务进程与网络服务器直接进行通信，但是，在以安全为目标的HTTP通道进行通信时，若主业务进程无法对网络服务器反馈的 数据信息进行解析，启动所述加密子进程作为代理连接，即所述加密子进程作为所述主业务进程与所述网络服务器之间的代理。本实施例中上述第一加密通道为所述浏览器主业务进程和所述加密子进程的安全通信通道；所述第二加密通道为所述加密子进程和网络服务器的安全通信通道。因此所述加密子进程通过将加密子进程与所述主业务进程的第一加密通道，转换为加密子进程与网络服务器的第二加密通道，来实现所述主业务进程与所述网络服务器之间的连接代理。当然对于主业务进程通过所述第一加密通道发送给加密子进程的业务数据，加密子进程可以将所述业务数据通过第二加密通道发送给网络服务器。
加密子进程接收到主业务进程发送来的第一连接请求之后，所述加密子进程依据所述第一连接请求，与所述网络服务器建立加密连接通信。所述加密子进程与所述网络服务器建立加密连接通信，即所述加密子进程和所述网络服务器进行安全认证，以确认是安全、合法的通信方，从而建立安全通信的通道。需要说明的是，所述加密子进程与所述网络服务器建立加密连接通信，结合加密子进程与主业务进程也可以进行通信，因此加密子进程分别与主业务进程和网络服务器这两端建立了相应连接，加密连接通信可以作为所述两端进行数据交换的桥梁。
本实施例中所述第一加密通道为所述浏览器主业务进程和所述加密子进程的安全通信通道；所述第二加密通道为所述加密子进程和所述网络服务器的安全通信通道。
所述加密子进程与所述网络服务器成功建立加密连接通信，意味着加密子进程与网络服务器之间能够相互发送数据，并且这些数据经加密处理，可以保证数据流转的安全可靠。加密子进程可以将接收到的所述第一连接请求中的业务数据发送给网络服务器，具体地，加密子进程执行业务数据在所述第一加密通道和第二加密通道之间的转发，即加密子进程可以通过所述第一加密通道接收业务数据，进行解密后，再采用第二加密通道约定的加密方法对业务数据进行加密后，发送给所述网络服务器。这样所述业务数据就从第一加密通道转发至第二加密通道，代表业务数据从主业务进程转发至网络服务器了。
本实施例首先在浏览器客户端中启动与浏览器主业务进程进行通信的加密子进程，其中，所述加密子进程用于作为连接代理实现第一加密通道到第二加密通道的转换，以及数据转发；然后所述加密子进程对浏览器主业务进程进行侦听，并获取所述浏览器主业务进程发送的第一连接请求；接着依据所述第一连接请求，所述加密子进程与所述网络服务器建立加密连接通信；最后在所述加密连接通信建立成功后，所述加密子进程执行业务数据在所述第一加密通道和第二加密通道之间的转发；其中，所述第一加密通道为所述浏览器主业务进程和所述加密子进程的安全通信通道；所述第二加密通道为所述 加密子进程和所述网络服务器的安全通信通道。本实施例可以通过加密子进程作为代理实现第一加密通道到第二加密通道的转换，以及数据转发，成功在浏览器的主业务进程与网络服务器之间建立了一条安全的加密通道，保证了业务数据的安全传输，可以降低业务数据泄露的风险，提高业务数据传输的安全性和可靠性。而且，由于本实施例通过浏览器实现上述功能，因此在用户使用浏览器客户端的过程中，浏览器客户端可以自动启动加密子进程在主业务进程与网络服务器之间建立安全通道，实现上述功能，提高了浏览器与网络服务器进行数据流转的安全性和可靠性，使得安全浏览器得以实现。
本发明一个可选实施例中，代理子模块504042，用于所述加密子进程创建侦听线程；所述侦听线程通过服务端口对所述主业务进程进行侦听。
本发明一个可选实施例中，所述安全连接子模块504044，用于在确认所述第一连接请求接收成功后，所述加密子进程与所述网络服务器依次进行加密数据协商和证书认证；在加密数据协商完毕且证书认证通过后，建立所述浏览器客户端与网络服务器的加密连接通信。
所述安全连接子模块504044，用于所述加密子进程向所述网络服务器发送客户端问候消息，其中，所述客户端问候消息包括所述浏览器客户端的第一加密数据，所述第一加密数据包括若干协议版本号；接收所述网络服务器反馈的服务端问候消息，其中，所述服务端问候消息包括所述服务器客户端的第二加密数据，所述第二加密数据包括：从所述第一加密数据中选定的协议版本号；所述网络服务器502，用于向所述安全浏览器装置反馈服务端问候消息。
所述安全连接子模块504044，用于对所述网络服务器进行单向证书认证；或，所述加密子进程和所述网络服务器进行双向证书认证。
所述代理子模块504042，还用于创建业务处理线程；所述业务处理线程分别与所述第一加密通道和所述第二加密通道建立连接。
所述代理子模块504042，用于采用所述业务处理线程通过所述第一加密通道接收所述主业务进程发送的第一业务数据；采用第一对称算法对所述第一业务数据进行解密处理，获取原始业务数据；采用第二对称算法对所述原始业务数据进行加密处理，获取所述第二业务数据；采用通过所述第二加密通道将所述第二业务数据发送给所述网络服务器；所述网络服务器502，用于接收所述安全浏览器通过所述第二加密通道发送所述第二业务数据。
所述网络服务器502，用于发送所述网络服务器的服务端证书消息给所述安全浏览器，所述服务端证书消息包括所述网络服务器的站点签名证书；所述安全浏览器装置中，所述安全连接子模块504044，用于接收所述网络服务器发送的服务端证书消息；以及所 述加密子进程对所述网络服务器的站点签名证书进行认证。
所述网络服务器502，用于所述网络服务器的服务端证书消息给所述安全浏览器，所述服务端证书消息包括所述网络服务器的站点签名证书；发送服务端密钥交换消息，所述服务端密钥交换消息包括密钥交换参数；发送证书认证请求消息，所述证书认证请求消息用于指示进行客户端的证书认证；发送服务端问候完结消息；以及接收所述浏览器安全装置发送的客户端证书消息，对签名证书进行认证，所述客户端证书消息包括所述安全浏览器客户端的签名证书。所述安全连接子模块504044，用于所述加密子进程接收所述网络服务器发送的服务端证书消息；所述加密子进程接收所述网络服务器发送的服务端密钥交换消息；所述加密子进程接收所述网络服务器发送的证书认证请求消息；所述加密子进程接收所述网络服务器发送的服务端问候完结消息；所述加密子进程对所述站点签名证书进行认证；当所述站点签名证书认证通过后，所述加密子进程向所述网络服务器发送客户端证书消息，所述客户端证书消息包括所述浏览器客户端的签名证书。
所述安全连接子模块504044，还用于依据所述密钥交换参数随机产生预主密钥，其中，所述预主密钥是采用所述网络服务器的加密公钥通过椭圆曲线密码算法SM2进行加密计算得到的；所述加密子进程采用所述预主密钥生成客户端密钥交换消息，并发送给网络服务器；所述网络服务器502，还用于接收所述安全浏览器装置发送的密钥交换消息，从所述密钥交换消息中获取所述预主密钥。
所述安全连接子模块504044，还用于获取依据站点签名证书计算的签名校验参数，并生成客户端证书校验消息发送给所述网络服务器；所述加密子进程向所述网络服务器发送客户端密码规格变更消息，以表征加密数据的协商完成；所述加密子进程向所述网络服务器发送客户端握手结束消息；所述加密子进程接收所述网络服务器发送的服务端密码规格变更消息，以表征认可该加密数据的协商；所述加密子进程接收所述网络服务器发送的服务端握手结束消息；所述网络服务器502，还用于依次接收所述安全浏览器装置发送的客户端证书校验消息、客户端密码规格变更消息和客户端握手结束消息；以及依次发送服务端密码规格变更消息和服务端握手结束消息给所述安全浏览器装置。
本实施例中，安全浏览器客户端504采用加密子进程模块50404代理浏览器主业务进程模块50402，与网络服务器502通过握手过程进行加密数据协商、证书认证、密钥交换和签名认证等SSL加密通信过程，具体握手过程如图4所示，相关握手信息和加密算法请参见实施例二部分的论述。
还包括：所述安全连接子模块504044，还用于在所述加密连接通信建立成功后，建立为所述加密子进程和所述网络服务器进行安全通信的第二加密通道。
所述代理子模块504042，还用于采用所述加密子进程和所述主业务进程通过握手过 程建立加密连接通信，并在加密连接通信成功后，建立为所述主业务进程和所述加密子进程进行安全通信的第一加密通道；其中，所述握手过程中执行通过第一非对称算法执行所述加密子进程和所述主业务进程之间的双向证书认证、密钥交互，以及执行证书认证；所述密钥交互过程中生成对称密钥。
所述代理子模块504042，还用于所述业务处理线程将第一连接请求通过第二对称算法进行加密处理得到第二连接请求；所述业务处理线程将所述第二连接请求发送给所述网络服务器；所述业务处理线程接收所述网络服务器基于所述第二连接请求反馈的第二连接应答；第二连接请求将所述第二连接应答通过第二对称算法进行解密处理得到第一连接应答，并反馈给所述主业务进程；所述网络服务器502，用于接收所述安全浏览器装置发送的第二连接请求，对所述第二连接请求处理后生成第二连接应答，将所述第二连接应答发送给所述安全浏览器装置。
所述加密进程子模块50404，还包括：硬件管理模块504046，用于加密子进程通过驱动识别安全密钥存储硬件。证书验证模块504048，用于并依据所述硬件证书载体在双向证书认证过程中进行加密运算。
需要说明的是，可以参照图7所示的加密子进程模块是其在具体实施中的一种结构框图，可以进行理解的是，加密子进程模块包括：配置模块702、代理模块704(与上述代理子模块对应)、CTL管理模块706、CRL管理模块708、Session管理模块710、证书验证模块712、SSL连接模块714(与上述安全连接子模块对应)、USBKey操作模块716(与上述硬件管理子模块对应)。CTL管理模块706、CRL管理模块708与上述证书验证子模块对应，
其中，代理模块接受浏览器主业务进程模块的连接，根据浏览器主业务进程模块连接的类型进行相应处理，形成浏览器主业务进程模块的连接代理。CTL模块用于管理信任根证书列表。CRL管理模块用于获取CRL列表，管理本地CRL列表。Session管理模块管理代理进程与web服务器的session连接。SSL连接模块负责建立与网络服务器的安全连接。USBKey管理模块负责操作USBKey设备。配置模块负责读取、存储客户端的相关配置。
其中，对于CTL管理模块706，其工作原理如下：CTL描述的是浏览器信任根证书列表，用于验证服务器端证书。安全浏览器客户端中，支持的信任根证书为PEM编码方式，同时支持两种证书添加方式：1)程序内部添加信任根证书；2)配置文件添加信任根证书，配置文件采用des加密保存。其中，CTL可以配置为不支持导入导出功能。
对于CRL管理模块708，其工作原理如下：CRL描述的是证书颁发机构CA的证书撤销列表，其本质是证书序列号，证书序列号以ASN.1编码的Integer表示。X509v3证 书中的一个扩展项(OID为2.5.29.31)用于指定该证书的CRL发布点。本实施例的安全浏览器中装置对CRL进行了本地缓存，同时CRL查找根据CA进行一级索引。对CRL的验证操作的步骤如下：(1)获取证书中的Issuer项，定位对应的CA节点，如果Issuer项不存在或者找不到对应的CA项，则认为是非法证书。((2)使用二分法搜索该CA下所有的CRL项。
对于Session管理模块710，SSL连接需要在TCP 3次握手的基础上增加4次握手，连接建立过程是比较耗时的，因此保存Session、复用之前的连接可以有效优化连接性能。本实施例的安全浏览器装置中在一次SSL连接建立完成之后，会建立host+port到session的内存索引，后续操作会复用之前的session，如session有效期为1小时。浏览器关闭、USBKey设备拔出时会清空之前的session。
对于证书验证模块612，SSL连接建立过程中如果需要双向认证，所述加密子进程会提示用户插入安全密钥存储硬件，即USBKey设备。在用户插入安全密钥存储硬件后能够自动识别并弹出证书选择对话框，提示用户选择证书。所述加密子进程自动识别安全密钥存储硬件需要依赖CSP注册表项中的两个关键信息：SKFImagePath：指定SKF动态库的路径和TokenVidPid：字符串格式。KEY设备的VendorID和ProductID，采用的格式类似HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB中的格式，也即VID_XXXX&PID_XXXX。浏览器会通过USBKey设备的vendorid、productid关联到相应驱动，完成相关操作。浏览器不会存储用户输入的pin密码，也不会存储USBKey中的私钥信息。具体流程如下：首先连接到USBKey设备；然后打开相应应用(Application)，Application由用户选择决定；然后打开相应容器(Container)，Container由用户选择决定；接着校验PIN码(个人身份识别码)，验证错误后会提示重新输入；然后获取签名证书信息；接着获取加密证书信息；最后关闭设备、断开连接。
本实施例中，针对上述方法实施例的证书验证过程，对服务器端的证书验证发生在握手协议过程中，浏览器收到ServerHelloDone消息之后，发送Certificate消息之前。证书验证主要确保服务器的合理性，验证过程依赖于CTL，CRL模块，具体过程在子进程证书验证线程池中进行。检查步骤如下：初始化受信任根证书列表；检查是否是自签名证书；检查证书扩展信息；检查证书信任关系；检查CRL列表；检查证书签名；检查证书时间有效性；检查证书是否在黑名单中。
需要说明的是，参照图8所示的浏览器主业务进程模块在具体实施中的一种结构框图，可以理解的是，浏览器主业务进程模块包括：证书显示模块802、白名单管理模块804、网络服务器证书存储模块806、代理设置模块808。其中证书显示模块802负责显示数字证书。白名单管理模块804负责管理支持本实施例的加密算法的web服务器列表。 网络服务器证书存储模块806用于存储负责管理网络服务器的证书。代理设置模块808代理设置负责设置与加密子进程的代理。
对于装置实施例而言，由于其与方法实施例基本相似，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
在此提供的算法和显示不与任何特定计算机、虚拟系统或者其它设备固有相关。各种通用系统也可以与基于在此的示教一起使用。根据上面的描述，构造这类系统所要求的结构是显而易见的。此外，本发明也不针对任何特定编程语言。应当明白，可以利用各种编程语言实现在此描述的本发明的内容，并且上面对特定语言所做的描述是为了披露本发明的最佳实施方式。
在此处所提供的说明书中，说明了大量具体细节。然而，能够理解，本发明的实施例可以在没有这些具体细节的情况下实践。在一些实例中，并未详细示出公知的方法、结构和技术，以便不模糊对本说明书的理解。
类似地，应当理解，为了精简本公开并帮助理解各个发明方面中的一个或多个，在上面对本发明的示例性实施例的描述中，本发明的各个特征有时被一起分组到单个实施例、图、或者对其的描述中。然而，并不应将该公开的方法解释成反映如下意图：即所要求保护的本发明要求比在每个权利要求中所明确记载的特征更多的特征。更确切地说，如下面的权利要求书所反映的那样，发明方面在于少于前面公开的单个实施例的所有特征。因此，遵循具体实施方式的权利要求书由此明确地并入该具体实施方式，其中每个权利要求本身都作为本发明的单独实施例。
本领域那些技术人员可以理解，可以对实施例中的设备中的模块进行自适应性地改变并且把它们设置在与该实施例不同的一个或多个设备中。可以把实施例中的模块或单元或组件组合成一个模块或单元或组件，以及此外可以把它们分成多个子模块或子单元或子组件。除了这样的特征和/或过程或者单元中的至少一些是相互排斥之外，可以采用任何组合对本说明书(包括伴随的权利要求、摘要和附图)中公开的所有特征以及如此公开的任何方法或者设备的所有过程或单元进行组合。除非另外明确陈述，本说明书(包括伴随的权利要求、摘要和附图)中公开的每个特征可以由提供相同、等同或相似目的的替代特征来代替。
此外，本领域的技术人员能够理解，尽管在此所述的一些实施例包括其它实施例中所包括的某些特征而不是其它特征，但是不同实施例的特征的组合意味着处于本发明的范围之内并且形成不同的实施例。例如，在下面的权利要求书中，所要求保护的实施例的任意之一都可以以任意的组合方式来使用。
本发明的各个部件实施例可以以硬件实现，或者以在一个或者多个处理器上运行的 软件模块实现，或者以它们的组合实现。本领域的技术人员应当理解，可以在实践中使用微处理器或者数字信号处理器(DSP)来实现根据本发明实施例的安全通信系统设备中的一些或者全部部件的一些或者全部功能。本发明还可以实现为用于执行这里所描述的方法的一部分或者全部的设备或者装置程序(例如，计算机程序和计算机程序产品)。这样的实现本发明的程序可以存储在计算机可读介质上，或者可以具有一个或者多个信号的形式。这样的信号可以从因特网网站上下载得到，或者在载体信号上提供，或者以任何其他形式提供。
例如，图9示出了可以实现根据本发明的安全浏览器的实现方法的计算设备。该计算设备传统上包括处理器910和以存储器920形式的程序产品或者可读介质。存储器920可以是诸如闪存、EEPROM(电可擦除可编程只读存储器)、EPROM或者ROM之类的电子存储器。存储器920具有用于执行上述方法中的任何方法步骤的程序代码931的存储空间930。例如，用于程序代码的存储空间930可以包括分别用于实现上面的方法中的各种步骤的各个程序代码931。这些程序代码可以从一个或者多个程序产品中读出或者写入到这一个或者多个程序产品中。这些程序产品包括诸如存储卡之类的程序代码载体。这样的程序产品通常为如参考图10所述的便携式或者固定存储单元。该存储单元可以具有与图9的计算设备中的存储器920类似布置的存储段、存储空间等。程序代码可以例如以适当形式进行压缩。通常，存储单元包括可读代码931’，即可以由例如诸如910之类的处理器读取的代码，这些代码当由计算设备运行时，导致该计算设备执行上面所描述的方法中的各个步骤。
应该注意的是上述实施例对本发明进行说明而不是对本发明进行限制，并且本领域技术人员在不脱离所附权利要求的范围的情况下可设计出替换实施例。在权利要求中，不应将位于括号之间的任何参考符号构造成对权利要求的限制。单词“包含”不排除存在未列在权利要求中的元件或步骤。位于元件之前的单词“一”或“一个”不排除存在多个这样的元件。本发明可以借助于包括有若干不同元件的硬件以及借助于适当编程的计算机来实现。在列举了若干装置的单元权利要求中，这些装置中的若干个可以是通过同一个硬件项来具体体现。单词第一、第二、以及第三等的使用不表示任何顺序。可将这些单词解释为名称。

Claims (15)

  1. 一种安全通信系统，包括：安全浏览器装置和网络服务器；其中，
    所述网络服务器，用于与所述安全浏览器装置建立加密连接通信；以及在所述加密连接通信建立成功后，与所述安全浏览器装置通过第二加密通道执行业务数据交互；
    所述安全浏览器装置，包括：浏览器主业务进程模块和加密子进程模块，
    其中，所述浏览器主业务进程模块，用于在浏览器客户端中启动与浏览器主业务进程进行通信的加密子进程的加密子进程模块，其中，所述加密子进程用于作为连接代理实现第一加密通道到第二加密通道的转换，以及数据转发；
    所述加密子进程模块，包括：
    代理子模块，用于对浏览器主业务进程进行侦听，并获取所述浏览器主业务进程发送的第一连接请求；以及在所述加密连接通信建立成功后，所述加密子进程执行业务数据在所述第一加密通道和第二加密通道之间的转发；
    安全连接子模块，用于依据所述第一连接请求，所述加密子进程与所述网络服务器建立加密连接通信；
    其中，所述第一加密通道为所述浏览器主业务进程和所述加密子进程的安全通信通道；所述第二加密通道为所述加密子进程和所述网络服务器的安全通信通道。
  2. 如权利要求1所述的系统，其特征在于：
    代理子模块，用于所述加密子进程创建侦听线程；所述侦听线程通过服务端口对所述主业务进程进行侦听。
  3. 如权利要求1所述的系统，其特征在于：
    所述安全连接子模块，用于在确认所述第一连接请求接收成功后，所述加密子进程与所述网络服务器依次进行加密数据协商和证书认证；在加密数据协商完毕且证书认证通过后，建立所述浏览器客户端与网络服务器的加密连接通信。
  4. 如权利要求3所述的系统，其特征在于：
    所述安全连接子模块，用于所述加密子进程向所述网络服务器发送客户端问候消息，其中，所述客户端问候消息包括所述浏览器客户端的第一加密数据，所述第一加密数据包括若干协议版本号；接收所述网络服务器反馈的服务端问候消息，其中，所述服务端问候消息包括所述服务器客户端的第二加密数据，所述第二加密数据包括：从所述第一加密数据中选定的协议版本号；
    所述网络服务器，用于向所述安全浏览器装置反馈服务端问候消息。
  5. 如权利要求3所述的系统，其特征在于：
    所述安全连接子模块，用于对所述网络服务器进行单向证书认证；或，所述加密子进程和所述网络服务器进行双向证书认证。
  6. 如权利要求1所述的系统，其特征在于：
    所述代理子模块，还用于创建业务处理线程；所述业务处理线程分别与所述第一加密通道和所述第二加密通道建立连接。
  7. 如权利要求6所述的系统，其特征在于：
    所述代理子模块，用于采用所述业务处理线程通过所述第一加密通道接收所述主业务进程发送的第一业务数据；采用第一对称算法对所述第一业务数据进行解密处理，获取原始业务数据；采用第二对称算法对所述原始业务数据进行加密处理，获取所述第二业务数据；采用通过所述第二加密通道将所述第二业务数据发送给所述网络服务器；
    所述网络服务器，用于接收安全浏览器通过所述第二加密通道发送的第二业务数据。
  8. 如权利要求5所述的系统，其特征在于：
    所述网络服务器，用于发送所述网络服务器的服务端证书消息给所述安全浏览器，所述服务端证书消息包括所述网络服务器的站点签名证书；
    所述安全浏览器装置中，所述安全连接子模块，用于接收所述网络服务器发送的服务端证书消息；以及所述加密子进程对所述网络服务器的站点签名证书进行认证。
  9. 如权利要求5所述的系统，其特征在于：
    所述网络服务器，用于所述网络服务器的服务端证书消息给所述安全浏览器，所述服务端证书消息包括所述网络服务器的站点签名证书；发送服务端密钥交换消息，所述服务端密钥交换消息包括密钥交换参数；发送证书认证请求消息，所述证书认证请求消息用于指示进行客户端的证书认证；发送服务端问候完结消息；以及接收所述浏览器安全装置发送的客户端证书消息，对签名证书进行认证，所述客户端证书消息包括所述安全浏览器客户端的签名证书；
    所述安全连接子模块，用于所述加密子进程接收所述网络服务器发送的服务端证书消息；所述加密子进程接收所述网络服务器发送的服务端密钥交换消息；所述加密子进程接收所述网络服务器发送的证书认证请求消息；所述加密子进程接收所述网络服务器发送的服务端问候完结消息；所述加密子进程对所述站点签名证书进行认证；当所述站点签名证书认证通过后，所述加密子进程向所述网络服务器发送客户端证书消息，所述客户端证书消息包括所述浏览器客户端的签名证书。
  10. 如权利要求9所述的系统，其特征在于：
    所述安全连接子模块，还用于依据所述密钥交换参数随机产生预主密钥，其中，所述预主密钥是采用所述网络服务器的加密公钥通过椭圆曲线密码算法SM2进行加密计算得到的；所述加密子进程采用所述预主密钥生成客户端密钥交换消息，并发送给网络服务器；
    所述网络服务器，还用于接收所述安全浏览器装置发送的密钥交换消息，从所述密钥交换消息中获取所述预主密钥。
  11. 如权利要求9所述的系统，其特征在于：
    所述安全连接子模块，还用于获取依据站点签名证书计算的签名校验参数，并生成客户端证书校验消息发送给所述网络服务器；所述加密子进程向所述网络服务器发送客户端密码规格变更消息，以表征加密数据的协商完成；所述加密子进程向所述网络服务器发送客户端握手结束消息；所述加密子进程接收所述网络服务器发送的服务端密码规格变更消息，以表征认可该加密数据的协商；所述加密子进程接收所述网络服务器发送的服务端握手结束消息；
    所述网络服务器，还用于依次接收所述安全浏览器装置发送的客户端证书校验消息、客户端密码规格变更消息和客户端握手结束消息；以及依次发送服务端密码规格变更消息和服务端握手结束消息给所述安全浏览器装置。
  12. 如权利要求11所述的系统，其特征在于，还包括：
    所述安全连接子模块，还用于在所述加密连接通信建立成功后，建立为所述加密子进程和所述网络服务器进行安全通信的第二加密通道。
  13. 如权利要求7所述的系统，其特征在于：
    所述代理子模块，还用于采用所述加密子进程和所述主业务进程通过握手过程建立加密连接通信，并在加密连接通信成功后，建立为所述主业务进程和所述加密子进程进行安全通信的第一加密通道；其中，所述握手过程中执行通过第一非对称算法执行所述加密子进程和所述主业务进程之间的双向证书认证、密钥交互，以及执行证书认证；所述密钥交互过程中生成对称密钥。
  14. 如权利要求1所述的系统，其特征在于：
    所述代理子模块，还用于所述业务处理线程将第一连接请求通过第二对称算法进行加密处理得到第二连接请求；所述业务处理线程将所述第二连接请求发送给所述网络服务器；所述业务处理线程接收所述网络服务器基于所述第二连接请求反馈的第二连接应答；第二连接请求将所述第二连接应答通过第二对称算法进行解密处理得到第一连接应答，并反馈给所述主业务进程；
    所述网络服务器，用于接收所述安全浏览器装置发送的第二连接请求，对所述第二连接请求处理后生成第二连接应答，将所述第二连接应答发送给所述安全浏览器装置。
  15. 如权利要求5所述的系统，其特征在于，所述加密子进程模块，还包括：
    硬件管理子模块，用于加密子进程通过驱动识别安全密钥存储硬件；
    证书验证子模块，用于依据所述硬件证书载体在双向证书认证过程中进行加密运算。
PCT/CN2015/094846 2014-12-30 2015-11-17 一种安全通信系统 WO2016107318A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410849875.9A CN104580189B (zh) 2014-12-30 2014-12-30 一种安全通信系统
CN201410849875.9 2014-12-30

Publications (1)

Publication Number Publication Date
WO2016107318A1 true WO2016107318A1 (zh) 2016-07-07

Family

ID=53095370

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/094846 WO2016107318A1 (zh) 2014-12-30 2015-11-17 一种安全通信系统

Country Status (2)

Country Link
CN (1) CN104580189B (zh)
WO (1) WO2016107318A1 (zh)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112020037A (zh) * 2020-09-25 2020-12-01 卡斯柯信号(郑州)有限公司 一种适用于轨道交通的国产通信加密方法
CN112398805A (zh) * 2019-08-15 2021-02-23 罗伯特·博世有限公司 在客户机和服务机之间建立通信通道的方法
CN112437437A (zh) * 2020-12-10 2021-03-02 深圳市天辰防务通信技术有限公司 一种利用4g网络进行点到点保密通信连接的方法及系统
CN114143082A (zh) * 2021-11-30 2022-03-04 北京天融信网络安全技术有限公司 一种加密通信方法、系统及装置
CN115001936A (zh) * 2022-07-18 2022-09-02 确信信息股份有限公司 一种基于管理代理的运维管理系统、方法及计算机设备
CN115085949A (zh) * 2021-03-10 2022-09-20 航天信息股份有限公司 一种基于国密ssl透明代理的数据通信方法和装置

Families Citing this family (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104618108B (zh) * 2014-12-30 2018-07-27 北京奇虎科技有限公司 安全通信系统
CN104639534B (zh) * 2014-12-30 2019-02-12 北京奇虎科技有限公司 网站安全信息的加载方法和浏览器装置
CN104580189B (zh) * 2014-12-30 2019-02-12 北京奇虎科技有限公司 一种安全通信系统
CN104580190B (zh) * 2014-12-30 2018-09-04 北京奇虎科技有限公司 安全浏览器的实现方法和安全浏览器装置
US10728043B2 (en) * 2015-07-21 2020-07-28 Entrust, Inc. Method and apparatus for providing secure communication among constrained devices
CN105243330A (zh) * 2015-10-13 2016-01-13 武汉大学 一种面向Android系统内部数据传递过程的保护方法及系统
CN105681279A (zh) * 2015-12-28 2016-06-15 上海瀚银信息技术有限公司 一种应用数据传输方法及移动终端
CN106330942A (zh) * 2016-08-31 2017-01-11 成都秦川科技发展有限公司 一种基于物联网信息私密通道和公共网络模糊的信息分送方法、装置及系统
CN108270739B (zh) * 2016-12-30 2021-01-29 华为技术有限公司 一种管理加密信息的方法及装置
GB201710168D0 (en) * 2017-06-26 2017-08-09 Microsoft Technology Licensing Llc Introducing middleboxes into secure communications between a client and a sever
CN108429620B (zh) * 2018-01-25 2021-10-12 新华三技术有限公司 安全连接的建立方法、系统、以及客户端和服务端
CN109714337B (zh) * 2018-12-26 2021-08-10 网宿科技股份有限公司 一种数据加密传输方法及设备
CN110225515B (zh) * 2019-06-24 2022-08-23 喀斯玛(北京)科技有限公司 一种认证管理系统、方法及装置
CN111381903B (zh) * 2020-03-18 2023-05-26 支付宝(杭州)信息技术有限公司 程序运行方法、装置、设备及介质
CN112507269B (zh) * 2020-12-10 2023-08-08 中国农业科学院农业信息研究所 一种网站后台风险评估系统
CN112613025A (zh) * 2020-12-30 2021-04-06 宁波三星医疗电气股份有限公司 一种计算机上usb设备和浏览器的通信方法
CN113904773B (zh) * 2021-10-11 2023-07-07 博雅中科(北京)信息技术有限公司 Ssl连接建立方法、装置、电子设备及计算机可读存储介质
CN114553476A (zh) * 2022-01-10 2022-05-27 网宿科技股份有限公司 基于国密和国际算法的https请求的处理方法和装置
CN114553957B (zh) * 2022-01-10 2024-05-24 网宿科技股份有限公司 兼容国密和国际https传输的业务系统和方法
CN115987688B (zh) * 2023-03-20 2023-08-01 北京网藤科技有限公司 一种保障plc和上位机之间安全通信的方法及系统

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1359074A (zh) * 2001-11-29 2002-07-17 上海格尔软件股份有限公司 具有mime数据类型过滤技术的ssl代理方法
CN1879382A (zh) * 2003-11-04 2006-12-13 Ntt通信公司 在设备间建立加密通信通道的方法、设备和程序
US20080235508A1 (en) * 2007-03-22 2008-09-25 Cisco Technology, Inc. (A California Corporation) Reducing processing load in proxies for secure communications
CN102103725A (zh) * 2009-12-22 2011-06-22 新竹货运股份有限公司 资讯处理系统、处理站及货到刷卡方法
CN103188074A (zh) * 2011-12-28 2013-07-03 上海格尔软件股份有限公司 一种增强浏览器ssl算法强度的代理方法
CN104580189A (zh) * 2014-12-30 2015-04-29 北京奇虎科技有限公司 一种安全通信系统
CN104580190A (zh) * 2014-12-30 2015-04-29 北京奇虎科技有限公司 安全浏览器的实现方法和安全浏览器装置

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1359074A (zh) * 2001-11-29 2002-07-17 上海格尔软件股份有限公司 具有mime数据类型过滤技术的ssl代理方法
CN1879382A (zh) * 2003-11-04 2006-12-13 Ntt通信公司 在设备间建立加密通信通道的方法、设备和程序
US20080235508A1 (en) * 2007-03-22 2008-09-25 Cisco Technology, Inc. (A California Corporation) Reducing processing load in proxies for secure communications
CN102103725A (zh) * 2009-12-22 2011-06-22 新竹货运股份有限公司 资讯处理系统、处理站及货到刷卡方法
CN103188074A (zh) * 2011-12-28 2013-07-03 上海格尔软件股份有限公司 一种增强浏览器ssl算法强度的代理方法
CN104580189A (zh) * 2014-12-30 2015-04-29 北京奇虎科技有限公司 一种安全通信系统
CN104580190A (zh) * 2014-12-30 2015-04-29 北京奇虎科技有限公司 安全浏览器的实现方法和安全浏览器装置

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112398805A (zh) * 2019-08-15 2021-02-23 罗伯特·博世有限公司 在客户机和服务机之间建立通信通道的方法
CN112020037A (zh) * 2020-09-25 2020-12-01 卡斯柯信号(郑州)有限公司 一种适用于轨道交通的国产通信加密方法
CN112437437A (zh) * 2020-12-10 2021-03-02 深圳市天辰防务通信技术有限公司 一种利用4g网络进行点到点保密通信连接的方法及系统
CN115085949A (zh) * 2021-03-10 2022-09-20 航天信息股份有限公司 一种基于国密ssl透明代理的数据通信方法和装置
CN114143082A (zh) * 2021-11-30 2022-03-04 北京天融信网络安全技术有限公司 一种加密通信方法、系统及装置
CN114143082B (zh) * 2021-11-30 2023-10-13 北京天融信网络安全技术有限公司 一种加密通信方法、系统及装置
CN115001936A (zh) * 2022-07-18 2022-09-02 确信信息股份有限公司 一种基于管理代理的运维管理系统、方法及计算机设备

Also Published As

Publication number Publication date
CN104580189B (zh) 2019-02-12
CN104580189A (zh) 2015-04-29

Similar Documents

Publication Publication Date Title
WO2016107318A1 (zh) 一种安全通信系统
WO2016107320A1 (zh) 网站安全信息的加载方法和浏览器装置
WO2016107322A1 (zh) 安全浏览器的实现方法和安全浏览器装置
WO2016107319A1 (zh) 加载安全密钥存储硬件的方法和浏览器客户端装置
WO2016107321A1 (zh) 安全通信系统
US20210367795A1 (en) Identity-Linked Authentication Through A User Certificate System
CN109088889B (zh) 一种ssl加解密方法、系统及计算机可读存储介质
WO2017045552A1 (zh) 一种在ssl或tls通信中加载数字证书的方法和装置
EP2792100B1 (en) Method and device for secure communications over a network using a hardware security engine
US9565180B2 (en) Exchange of digital certificates in a client-proxy-server network configuration
US8532620B2 (en) Trusted mobile device based security
US8539569B2 (en) Systems and methods for facilitating user authentication over a network
CN108347419A (zh) 数据传输方法和装置
CN110995414B (zh) 基于国密算法在tls1_3协议中建立通道的方法
CN103546289A (zh) 一种基于USBKey的安全传输数据的方法及系统
CN103685187A (zh) 一种按需转换ssl认证方式以实现资源访问控制的方法
KR20110122452A (ko) 전자서명 검증 서버 및 이를 이용한 전자거래 방법
CN117081736A (zh) 密钥分发方法、密钥分发装置、通信方法及通信装置
KR102128244B1 (ko) Ssl/tls 기반의 네트워크 보안 장치 및 방법
CN104901974A (zh) 安全超文本传输方法
CN106464684B (zh) 业务处理方法及装置
Ortiz-Yepes Optimizing TLS for low bandwidth environments
KR101161733B1 (ko) 온라인 서비스를 위한 전자서명 방법
WO2022141157A1 (zh) 一种 Profile 数据的安全传输方法和相应装置
CN116545673A (zh) 一种数据传输方法、装置、云喇叭、电子设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15874998

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15874998

Country of ref document: EP

Kind code of ref document: A1