Communication method, apparatus and system, electronic device, and computer readable storage medium
The present disclosure relates to a communication method, apparatus and system, an electronic device, and a computer readable storage medium. The communication method includes: determining an accepting host to be connected; obtaining a public key and communication address information of the accepting host from a blockchain; generating to-be-verified information according to the public key of the accepting host and a private key of the initiating host; sending the to-be-verified information to the accepting host according to the communication address information; and sending a communication connection request to the accepting host according to the communication address information to establish a communication connection with the accepting host. By adoption of the present disclosure, the anti-risk and anti-attack capabilities of the communication system may be improved by the decentralized features and security features of the blockchain, and the communication security is improved.
1. A communication method, applied to an initiating host, comprising:
determining an accepting host to be connected, wherein the accepting host is configured to be connected with a server that provides data access for providing data access protection for the server;
obtaining a public key and communication address information of the accepting host from a blockchain;
generating to-be-verified information according to the public key of the accepting host and a private key of the initiating host;
sending the to-be-verified information to the accepting host according to the communication address information; and
sending a communication connection request to the accepting host according to the communication address information to establish a communication connection with the accepting host, wherein the communication connection is used by the initiating host to obtain data within the data access authority of the initiating host from the data subjected to the data access protection from the server.
2. The method according to claim 1 , wherein the step of generating the to-be-verified information according to the public key of the accepting host and the private key of the initiating host comprises:
obtaining a first share secret according to the public key of the accepting host and the private key of the initiating host; and
generating the to-be-verified information according to the first share secret.
3. The method according to claim 1 , wherein the communication connection is a virtual private network VPN connection;
the step of sending the communication connection request to the accepting host to establish the communication connection with the accepting host comprises:
receiving a certificate sent by the accepting host after the verification is passed, wherein the certificate at least comprises the public key of the initiating host; and
establishing the VPN connection with the accepting host by using the certificate.
4. The method according to claim 1 , wherein the communication connection is a virtual private network VPN connection;
the step of sending the communication connection request to the accepting host to establish the communication connection with the accepting host comprises:
receiving a first random number sent by the accepting host after the to-be-verified information passes the verification;
signing the received first random number by using the private key of the initiating host;
sending a first signature result comprising the first random number to the accepting host, wherein the first signature result is used by the accepting host for performing de-signature verification on the same by using the public key of the initiating host obtained from the blockchain, wherein the de-signature verification represents to decrypt the first signature result using the public key of the initiating host and to compare the result of decrypt with the first random number in the first signature result;
generating a second random number, and sending the second random number to the accepting host;
receiving a second signature result obtained by the accepting host by signing the second random number by using the private key of the initiating host;
performing de-signature verification on the second signature result by using the public key of the accepting host obtained from the blockchain; and
when the de-signature verification of the second signature result is passed, and when the de-signature verification of the accepting host on the first signature result is passed, executing key negotiation to establish the VPN connection.
5. The method according to claim 1 , wherein the step of obtaining the public key of the accepting host from the blockchain comprises:
determining whether a blockchain account bound with the initiating host has the authority of reading related information of the accepting host; and
when the blockchain account has the authority of reading the related information of the accepting host, obtaining the public key of the accepting host from the blockchain.
6. A communication method, applied to an accepting host, wherein the accepting host is configured to be connected with a server that provides data access for providing data access protection for the server;
the method includes:
receiving to-be-verified information sent by an initiating host;
obtaining a public key of the initiating host from a blockchain;
verifying the to-be-verified information according to the public key of the initiating host and a private key of the accepting host; and
after the to-be-verified information passes the verification, receiving a communication connection request sent by the initiating host to establish a communication connection with the initiating host; and
controlling the initiating host to obtain data within the data access authority from the data subjected to the data access protection through the communication connection according to the data access authority of the initiating host stored in the blockchain.
7. The method according to claim 6 , wherein the step of verifying the to-be-verified information according to the public key of the initiating host and the private key of the accepting host comprises:
obtaining a second share secret according to the private key of the accepting host and the public key of the initiating host;
verifying the to-be-verified information by using the second share secret, wherein the to-be-verified information is generated according to the first share secret, and the first share secret is obtained according to the public key of the accepting host and the private key of the initiating host; and
when the second share secret is the same as the first share secret, indicating that the verification is passed.
8. The method according to claim 6 , wherein the communication connection is a virtual private network VPN connection;
the step of receiving the communication connection request sent by the initiating host to establish the communication connection with the initiating host comprises:
after the verification is passed, generating a first certificate comprising the public key of the initiating host and a second certificate comprising the public key of the accepting host; and
sending the first certificate to the initiating host, wherein the first certificate is used by the initiating host to prove its own identity when establishing the VPN connection with the accepting host, and the second certificate is used by the accepting host to prove its own identity when establishing the VPN connection with the initiating host.
9. The method according to claim 6 , wherein the communication connection is a virtual private network VPN connection;
the step of receiving the communication connection request sent by the initiating host to establish the communication connection with the initiating host comprises:
after the to-be-verified information passes the verification, sending a first random number to the initiating host;
receiving a first signature result obtained by the initiating host by signing the first random number by using the private key of the accepting host;
performing de-signature verification on the first signature result by using the public key of the initiating host obtained from the blockchain, wherein the de-signature verification represents to decrypt the first signature result using the public key of the initiating host and to compare the result of decrypt with the first random number in the first signature result;
receiving a second random number sent by the initiating host;
signing the received second random number by using the private key of the accepting host;
sending a second signature result comprising the second random number to the initiating host, wherein the second signature result is used by the initiating host to perform the de-signature verification on the same by using the public key of the accepting host obtained from the blockchain; and
when the de-signature verification of the first signature result is passed, and when the de-signature verification of the initiating host on the second signature result is passed, executing key negotiation to establish the VPN connection.
10. A non-transitory computer readable storage medium, comprising a computer program is stored thereon, the program implements the following steps when executed by a processor:
determining an accepting host to be connected, wherein the accepting host is configured to be connected with a server that provides data access for providing data access protection for the server;
obtaining a public key and communication address information of the accepting host from a blockchain;
generating to-be-verified information according to the public key of the accepting host and a private key of the initiating host;
sending the to-be-verified information to the accepting host according to the communication address information; and
sending a communication connection request to the accepting host according to the communication address information to establish a communication connection with the accepting host, wherein the communication connection is used by the initiating host to obtain data within the data access authority of the initiating host from the data subjected to the data access protection from the server.
11. A non-transitory computer readable storage medium, comprising a computer program is stored thereon, the program implements the following steps when executed by a processor:
receiving to-be-verified information sent by an initiating host;
obtaining a public key of the initiating host from a blockchain;
verifying the to-be-verified information according to the public key of the initiating host and a private key of the accepting host; and
after the to-be-verified information passes the verification, receiving a communication connection request sent by the initiating host to establish a communication connection with the initiating host; and
controlling the initiating host to obtain data within the data access authority from the data subjected to the data access protection through the communication connection according to the data access authority of the initiating host stored in the blockchain.