Method and system for realizing data stream acceleration based on NAT (Network Address Translation) acceleration engine

Abstract

The invention relates to the technical field of data stream acceleration, and discloses a method and system for realizing data stream acceleration based on an NAT acceleration engine, and the method comprises the steps: deploying a VPN module in a network environment, and building a VPN transmission tunnel of the VPN module based on a preset VPN protocol. And obtaining the target data stream, encapsulating the data packet, and encrypting the encapsulated data packet. And monitoring the network flow, obtaining the encrypted data packet, and analyzing the header information of the obtained data packet. And according to the header information, determining whether the data packet is in an encrypted state, and if the data packet is in the encrypted state, performing special identification. And obtaining a preset routing table, and determining the next hop of the identified data packet according to the preset routing table. And acquiring real-time performance data of the network link when the data packet is forwarded, and adjusting a processing strategy of the data stream according to the real-time performance data. According to the method, the network performance is optimized by monitoring and analyzing the encrypted data packet in real time and dynamically adjusting the data stream processing strategy.

Description

Technical Field

[0001] The present invention relates to the technical field of data flow acceleration, and in particular to a method and system for realizing data flow acceleration based on a NAT acceleration engine. Background Art

[0002] With the continuous growth of network communication demand, the security and efficiency of data transmission have become one of the key goals of network technology development. As a mature encrypted communication method, VPN (Virtual Private Network) technology achieves secure data transmission by creating an encrypted private channel on an insecure public network. However, with the widespread application of VPN, especially in network communication products with built-in VPN functions, such as devices that support OpenVPN, Wi reGuard and other protocols, the forwarding performance of encrypted encapsulated data packets has become increasingly prominent.

[0003] Existing VPN systems usually use standard network address translation (NAT) technology to forward data packets. However, after the data packets are encrypted and encapsulated by the VPN module, their data content and some header information are encrypted, making it impossible for traditional software NAT acceleration engines to directly perform NAT conversion on such encrypted data packets. As a result, such data packets must enter the system's protocol stack for a slow processing path, relying on the system's traditional forwarding mechanism to decrypt and process the encapsulated packets, which greatly affects the real-time forwarding performance of the data packets, resulting in increased transmission delays, increased packet loss rates, and a decrease in the overall user experience.

[0004] Therefore, there is an urgent need to invent a method for accelerating data flow to solve the problem of efficiently forwarding data flow in a VPN encryption environment in the prior art. Summary of the invention

[0005] In view of this, the present invention proposes a method and system for realizing data flow acceleration based on a NAT acceleration engine, aiming to solve the problem of efficiently forwarding data flows in a VPN encryption environment in the current technology.

[0006] The present invention proposes a method for realizing data flow acceleration based on a NAT acceleration engine, comprising:

[0007] Deploy a VPN module in a network environment, and establish a VPN transmission tunnel of the VPN module based on a preset VPN protocol;

[0008] Obtaining the target data stream to encapsulate data packets, and encrypting the encapsulated data packets through the VPN transmission tunnel;

[0009] Monitor the network traffic of the target network, obtain the encrypted data packet, and parse the data packet to obtain header information of the data packet, wherein the header information includes VPN header information and unencrypted network layer and outer layer protocol headers;

[0010] Determine whether the data packet is in an encrypted state according to the header information, wherein if the data packet is in an encrypted state, specially mark the data packet;

[0011] Obtaining a preset routing table, and determining the next hop of the identified data packet according to the preset routing table;

[0012] Acquire real-time performance data of the network link when forwarding the data packet, and adjust the processing strategy of the data stream according to the real-time performance data, wherein the real-time performance data includes the delay, bandwidth and packet loss rate during data packet transmission.

[0013] Further, parsing the data packet to obtain header information of the data packet includes:

[0014] Monitor the data flow in real time based on the data packet capture tool, and parse each of the data packets in the data flow layer by layer to identify the source IP address, destination IP address, protocol type and port number of the data packet;

[0015] Perform deep data packet inspection on the parsed data packet, and obtain the encryption protocol type, encryption algorithm and key exchange method of the data packet.

[0016] Further, obtaining real-time performance data of the network link when forwarding the data packet, and adjusting the processing strategy of the data flow according to the real-time performance data, includes:

[0017] Acquire the real-time delay, real-time bandwidth and real-time packet loss rate of the network link, compare the real-time delay, real-time bandwidth and real-time packet loss rate with the pre-configured preset delay, preset bandwidth and preset packet loss rate, and determine whether to adjust the processing strategy of the data flow according to the comparison result:

[0018] When the real-time delay is less than or equal to the preset delay, the real-time bandwidth is greater than or equal to the preset bandwidth, and the real-time packet loss rate is less than or equal to the preset packet loss rate, it is determined not to adjust the processing strategy of the data flow;

[0019] When the real-time delay is greater than the preset delay, and / or the real-time bandwidth is less than the preset bandwidth, and / or the real-time packet loss rate is greater than the preset packet loss rate, determining to adjust the processing strategy of the data stream;

[0020] Among them, when it is determined to adjust the processing strategy of the data flow, it includes: obtaining the real-time delay, real-time bandwidth and real-time packet loss rate of the transmission link in each of the processing strategies, evaluating each of the transmission links according to the relationship between the real-time delay, real-time bandwidth and real-time packet loss rate and the preset delay, preset bandwidth and preset packet loss rate, and sorting the evaluation results in reverse order, and adjusting the processing strategy corresponding to the first evaluation result to the processing strategy of the data flow.

[0021] Further, when evaluating each of the transmission links according to the relationship between the real-time delay, the real-time bandwidth and the real-time packet loss rate and the preset delay, the preset bandwidth and the preset packet loss rate, the process includes:

[0022] Acquire the real-time delay of each of the transmission links, acquire the delay mean of the real-time delay of each of the transmission links, and determine the preset delay by using the delay mean;

[0023] Obtaining a delay difference between the real-time delay of the transmission link and the preset delay, and determining a performance score of the transmission link when evaluating according to a relationship between the delay difference and a pre-configured first preset delay difference and a second preset delay difference;

[0024] When the delay difference is less than the first preset delay difference, determining that the performance score of the transmission link is L3;

[0025] When the delay difference is greater than or equal to the first preset delay difference, and the delay difference is less than the second preset delay difference, determining that the performance score of the transmission link is L2;

[0026] When the delay difference is greater than or equal to the second preset delay difference, determining that the performance score of the transmission link is L1;

[0027] The first preset delay difference is smaller than the second preset delay difference, and L1<L2<L3.

[0028] Further, when the performance score of the transmission link is determined to be Li, i=1, 2, 3, including:

[0029] Acquire the real-time bandwidth of each transmission link, acquire the bandwidth average of the real-time bandwidth of each transmission link, and determine the preset bandwidth by using the bandwidth average;

[0030] Comparing the real-time bandwidth of the transmission link with the preset bandwidth, and determining whether to adjust the performance score Li of the transmission link according to the comparison result;

[0031] When the real-time bandwidth is greater than or equal to the preset bandwidth, it is determined that the performance score Li of the transmission link is not adjusted;

[0032] When the real-time bandwidth is less than the preset bandwidth, the bandwidth difference between the real-time bandwidth and the preset bandwidth is obtained, an adjustment coefficient is determined according to the bandwidth difference, and the performance score Li of the transmission link is adjusted according to the adjustment coefficient.

[0033] Further, when determining the adjustment coefficient according to the bandwidth difference, it includes:

[0034] Determining the adjustment coefficient according to a relationship between the bandwidth difference and a preconfigured first preset bandwidth difference and a second preset bandwidth difference;

[0035] When the bandwidth difference is less than the first preset bandwidth difference, determining the adjustment coefficient to be M3;

[0036] When the bandwidth difference is greater than or equal to the first preset bandwidth difference, and the bandwidth difference is less than the second preset bandwidth difference, determining the adjustment coefficient to be M2;

[0037] When the bandwidth difference is greater than or equal to the second preset bandwidth difference, the adjustment coefficient is determined to be M1;

[0038] The first preset bandwidth difference is smaller than the second preset bandwidth difference, and M1<M2<M3.

[0039] Further, when the adjustment coefficient is determined to be Mi, i=1, 2, 3, including:

[0040] Acquire the real-time packet loss rate of each transmission link, acquire the average packet loss rate of the real-time packet loss rate of each transmission link, and determine the preset packet loss rate by using the average packet loss rate;

[0041] Compare the real-time packet loss rate with the preset packet loss rate, and determine whether to modify the adjustment coefficient Mi according to the comparison result;

[0042] When the real-time packet loss rate is less than or equal to the preset packet loss rate, it is determined that the adjustment coefficient Mi is not to be corrected;

[0043] When the real-time packet loss rate is greater than the preset packet loss rate, the packet loss rate difference between the real-time packet loss rate and the preset packet loss rate is obtained, a correction coefficient is determined according to the packet loss rate difference, and the adjustment coefficient Mi is corrected according to the correction coefficient.

[0044] Furthermore, when determining the correction coefficient according to the packet loss rate difference, it includes:

[0045] Determining the correction coefficient according to a relationship between the packet loss rate difference and a pre-configured first preset packet loss rate difference and a second preset packet loss rate difference;

[0046] When the packet loss rate difference is less than the first preset packet loss rate difference, determining the correction coefficient to be N3;

[0047] When the packet loss rate difference is greater than or equal to the first preset packet loss rate difference, and the packet loss rate difference is less than the second preset packet loss rate difference, determining the correction coefficient to be N2;

[0048] When the packet loss rate difference is greater than or equal to the second preset packet loss rate difference, determining the correction coefficient to be N3;

[0049] The first preset packet loss rate difference is smaller than the second preset packet loss rate difference, and N1<N2<N3<1.

[0050] Further, sorting the evaluation results in reverse order and adjusting the processing strategy corresponding to the first evaluation result to the processing strategy of the data flow includes:

[0051] Obtaining a performance score for each of the evaluation results, and obtaining an average of the performance scores for each of the evaluation results;

[0052] Compare the performance score with the average of the performance scores, and determine the ranking of the performance scores according to the comparison result:

[0053] When the performance score is lower than the performance score average, it is determined that the performance score is not to be sorted;

[0054] When the performance evaluation is higher than or equal to the performance score mean, the performance score is determined for ranking.

[0055] Compared with the prior art, the beneficial effect of the present invention is that by deploying a VPN module in a network environment and establishing a transmission tunnel based on a preset VPN protocol, data flow encapsulation and encryption processing can be realized. This tunnel mechanism ensures the security of the data flow, but at the same time brings problems that are difficult to handle with traditional NAT, because the encrypted and encapsulated data packets have been encrypted in the header information and data content, and the traditional software NAT acceleration engine cannot directly process such data packets, and needs to take a slow protocol stack path for parsing and forwarding, resulting in increased delay and decreased performance. Secondly, by monitoring the network traffic to obtain the encrypted data packets, and parsing the header information of the data packets, including the VPN header and the unencrypted network layer and transport layer protocol header information, the data packets in the encrypted encapsulation state can be accurately identified. This step utilizes the specific encapsulation format of the VPN protocol, and by parsing the VPN header information and the network layer header, it can be determined whether the data packet is in an encrypted state. Once it is confirmed that the data packet has been encrypted and encapsulated by VPN, the data packet will be specially marked, so as to facilitate the rapid distinction between encrypted data packets and ordinary data packets during subsequent processing, realize accurate classification management of data streams, and avoid unnecessary protocol stack path processing. Finally, this method quickly determines the next-hop forwarding path of the data packet by searching the preset routing table, so that the marked encrypted data packet can directly enter the optimized forwarding path instead of the traditional slow processing path. During the forwarding process, the performance data of the network link is monitored in real time, such as the delay, bandwidth and packet loss rate of the data packet transmission, and the processing strategy of the data stream is automatically adjusted according to the monitoring results. This dynamic adjustment strategy further improves the adaptability of the system, allowing the NAT acceleration engine to maintain efficient transmission performance when facing different network conditions. This not only improves the transmission speed of the VPN data stream, but also significantly optimizes the utilization of resources, providing users with a network transmission experience with lower latency, higher bandwidth and lower packet loss rate.

[0056] On the other hand, the present application also provides a system for realizing data flow acceleration based on a NAT acceleration engine, comprising:

[0057] A VPN module is deployed in a network environment, the VPN module is configured to establish a VPN transmission tunnel based on a preset VPN protocol, and the VPN module is further configured to obtain a target data stream to encapsulate a data packet, and encrypt the encapsulated data packet based on the VPN transmission tunnel;

[0058] The parsing module is configured to monitor the network traffic of the target network, obtain the encrypted data packet, and parse the data packet to obtain the header information of the data packet;

[0059] A NAT acceleration module is configured with several transmission links;

[0060] an identification module, electrically connected to the parsing module, the identification module being configured to determine whether the data packet is in an encrypted state according to the header information, wherein if the data packet is in an encrypted state, the identification module performs a special identification on the data packet;

[0061] A central control module is electrically connected to the identification module, and is configured to obtain a preset routing table and determine the next hop of the identified data packet according to the preset routing table; the central control module is also configured to obtain real-time performance data of the network link when forwarding the data packet, and adjust the processing strategy of the data flow according to the real-time performance data.

[0062] It can be understood that the method and system for realizing data flow acceleration based on a NAT acceleration engine in the above-mentioned embodiments of the present invention have the same beneficial effects, which will not be described in detail. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0064] Figure 1 A flowchart of a method for implementing data flow acceleration based on a NAT acceleration engine provided by an embodiment of the present invention;

[0065] Figure 2 A functional block diagram of a data flow acceleration system based on a NAT acceleration engine provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0066] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art. It should be noted that, in the absence of conflict, the embodiments of the present invention and the features described in the embodiments can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0067] like Figure 1 As shown, in some embodiments of the present application, this embodiment provides a method including:

[0068] Step S100: deploy a VPN module in a network environment, and establish a VPN transmission tunnel of the VPN module based on a preset VPN protocol.

[0069] Specifically, choose a suitable VPN protocol (such as OpenVPN or Wi reGuard), which provides efficient encryption mechanisms and flexible configuration options to adapt to different network environments and needs. By deploying the VPN module, users can establish a private encrypted channel on an insecure public network, thereby protecting sensitive information from unauthorized access.

[0070] It is understandable that by choosing a suitable VPN protocol (such as OpenVPN or Wi reGuard), users can take advantage of the efficient encryption mechanism provided by these protocols to ensure the security of data transmission in various network environments. Specifically, these protocols greatly improve the confidentiality and integrity of data by encrypting the data so that it is not easily eavesdropped or tampered with during transmission. For example, OpenVPN, as a widely used open source VPN protocol, uses SSL / TLS for secure encryption, supports a variety of encryption algorithms and authentication methods, and is highly flexible and configurable. This allows users to choose different encryption strengths and transmission protocols according to their needs to cope with different network environments. In contrast, WireGuard is favored for its simple design and efficient performance, providing faster connection speeds and lower latency. The effective combination of these protocols enables the VPN module to provide users with a variety of security protection options to adapt to the ever-changing network threats. Secondly, by deploying the VPN module, users can establish a private encrypted channel when using public Wi-Fi or unsecured networks. This encrypted channel not only protects users' sensitive information, such as login credentials, financial transactions, and personal data, from being stolen by hackers or malware, but also effectively prevents man-in-the-middle attacks and other network security threats. Especially with the increasing popularity of remote work and online transactions, the use of VPN has become an important means to ensure data security. In addition, the flexible configuration options of the VPN module enable it to adapt to various network environments. For example, in the case of high latency or limited bandwidth, users can choose more suitable protocols and encryption methods to optimize performance and user experience. This adaptability not only improves network security, but also enables users to access network resources with peace of mind from any location and on any device.

[0071] Step S200: Obtain the target data stream to encapsulate data packets, and encrypt the encapsulated data packets through the VPN transmission tunnel.

[0072] It is understood that by identifying the data streams that need to be encrypted, this may include network requests from different applications, file transfers, or real-time communication data. After obtaining these target data streams, the system will encapsulate them, which usually involves reorganizing the source IP address, destination IP address, port information, and other relevant metadata of the original data packet. This encapsulation process not only ensures that the data can maintain integrity during transmission, but also hides the information of the original data stream, making it safer during transmission. Qi Cong. The encapsulated data packets will be encrypted through the established VPN transmission tunnel. This process uses the preset VPN protocol to encrypt the data to ensure that the data is in a secure state when transmitted on the network. The encryption process involves converting the data content into ciphertext so that it cannot be eavesdropped or tampered with during transmission. This encryption mechanism also includes generating encryption keys and using encryption algorithms (such as AES, ChaCha20, etc.) to ensure the confidentiality and integrity of the data.

[0073] Step S300, monitor the network traffic of the target network, obtain the encrypted data packets, and parse the data packets to obtain the header information of the data packets, wherein the header information includes VPN header information and unencrypted network layer and outer layer protocol headers.

[0074] Specifically, parsing data packets and obtaining header information of data packets includes: monitoring data streams in real time based on data packet capture tools, and parsing each data packet in the data stream layer by layer to identify the source IP address, destination IP address, protocol type and port number of the data packet. Performing deep packet inspection on the parsed data packets and obtaining the encryption protocol type, encryption algorithm and key exchange method of the data packet.

[0075] It can be understood that by continuously monitoring the traffic of the target network, the data packets processed by VPN encryption are obtained in real time. This process provides the necessary basis for subsequent data analysis, allowing network administrators or applications to obtain key information about data flows without affecting data security. Secondly, in the process of parsing the data packet, the structure of the data packet is analyzed layer by layer, starting from the outermost protocol header, and basic network information such as source IP address, destination IP address, protocol type and port number are extracted. This information not only helps to understand the source and destination of the data flow, but also provides basic data for the management and optimization of network traffic. On this basis, deep data packet inspection is further performed to identify the encryption protocol type, encryption algorithm and key exchange method in the data packet. This parsing process is crucial to understand the encryption mechanism of the data packet, and then identify the security standards and technologies used, thereby ensuring the confidentiality and integrity of the data during transmission. In addition, this deep parsing technology is not only suitable for monitoring the security of data flows, but also can provide decision support for network optimization. By analyzing the encryption characteristics of different data packets, the system can identify potential bottlenecks and problems in the network. For example, if certain encryption algorithms lead to increased latency or low bandwidth utilization, network administrators or programs can adjust strategies accordingly, select more efficient encryption methods, or optimize the processing flow of data packets. This adaptive capability not only improves network performance, but also enhances flexibility and responsiveness in the face of ever-changing network environments. Step S400: Determine whether the data packet is in an encrypted state based on the header information, wherein if the data packet is in an encrypted state, the data packet is specially marked.

[0076] Step S400: Determine whether the data packet is in an encrypted state according to the header information, wherein if the data packet is in an encrypted state, the data packet is specially marked.

[0077] Specifically, for different types of VPN traffic, multiple unique tag values ​​are designed to support multiple encryption protocols (such as OpenVPN, Wi reGuard, etc.), and tags are dynamically assigned according to traffic characteristics; secondly, for multi-tenant traffic transmitted through the VPN tunnel, a unique tag can be assigned to each tenant based on the tenant's identity to ensure independent management and acceleration of each tenant's traffic; finally, when marking data packets, the timestamp of the tag assignment and the processing log are recorded to facilitate subsequent traffic tracking and performance analysis.

[0078] It is understandable that the header information of the data packet is parsed to identify its encryption status. This process not only involves determining whether the data packet is encrypted, but also requires in-depth analysis of its characteristics to ensure that different types of VPN traffic can be accurately distinguished. Through careful inspection of the data packet, it is possible to efficiently identify which data packets are encrypted, so as to carry out subsequent processing and management. Secondly, in order to support multiple encryption protocols (such as OpenVPN, Wi reGuard, etc.), multiple unique tag values ​​are designed. These tag values ​​are not only functionally able to distinguish different types of VPN traffic, but also highly flexible in structure, so that tags can be dynamically assigned according to actual traffic characteristics. This dynamic allocation mechanism not only improves the efficiency of data packet processing, but also provides strong support for subsequent traffic management. For example, when a specific traffic pattern is identified, a specific tag can be automatically assigned to ensure the rapid identification and processing of encrypted data. In addition, in a multi-tenant environment, unique tags can be assigned according to the identity of each tenant to ensure that the traffic of each tenant is independently managed and accelerated. This approach effectively solves the problem of traffic confusion that may occur in a shared environment, ensuring that the data traffic of each tenant can be clearly identified and processed independently. This feature is particularly suitable for cloud computing and shared network services, and can provide customized security protection and performance optimization for each user. Finally, when marking data packets, the timestamp assigned by the tag and the processing log are recorded. This practice not only facilitates subsequent traffic tracking and performance analysis, but also provides an important basis for problem diagnosis and system optimization. By analyzing historical records, network managers or programs can gain an in-depth understanding of the impact of different traffic patterns on network performance, thereby formulating more effective traffic management strategies. The application of this technical principle significantly improves the visualization and management capabilities of the network, allowing users to enjoy higher security and performance in complex VPN environments.

[0079] Step S500 obtains a preset routing table, and determines the next hop of the identified data packet according to the preset routing table.

[0080] Step S600, obtaining real-time performance data of the network link when forwarding data packets, and adjusting the processing strategy of the data flow according to the real-time performance data, wherein the real-time performance data includes the delay, bandwidth and packet loss rate during data packet transmission.

[0081] Specifically, obtaining the real-time performance data of the network link when forwarding data packets, and adjusting the processing strategy of the data flow according to the real-time performance data, includes: obtaining the real-time delay, real-time bandwidth and real-time packet loss rate of the network link, and comparing the real-time delay, real-time bandwidth and real-time packet loss rate with the pre-configured preset delay, preset bandwidth and preset packet loss rate, and judging whether to adjust the processing strategy of the data flow according to the comparison result: when the real-time delay is less than or equal to the preset delay, the real-time bandwidth is greater than or equal to the preset bandwidth, and the real-time packet loss rate is less than or equal to the preset packet loss rate, it is determined that the processing strategy of the data flow is not adjusted. When the real-time delay is greater than the preset delay, and / or the real-time bandwidth is less than the preset bandwidth, and / or the real-time packet loss rate is greater than the preset packet loss rate, it is determined that the processing strategy of the data flow is adjusted. Among them, when it is determined to adjust the processing strategy of the data flow, it includes: obtaining the real-time delay, real-time bandwidth and real-time packet loss rate of the transmission link in each processing strategy, evaluating each transmission link according to the relationship between the real-time delay, real-time bandwidth and real-time packet loss rate and the preset delay, preset bandwidth and preset packet loss rate, and sorting the evaluation results in reverse order, and adjusting the processing strategy corresponding to the first evaluation result to the processing strategy of the data flow.

[0082] It can be seen that by monitoring the performance data of the network link in real time (including delay, bandwidth and packet loss rate), and comparing these real-time data with the preset performance indicators, the data flow processing strategy can be dynamically adjusted. Specifically, the system obtains the performance data of the network link in real time to determine whether the current network status meets the preset conditions, and then decides whether the processing strategy needs to be adjusted. When the monitored real-time delay, bandwidth or packet loss rate exceeds the preset range, the transmission link performance of different processing strategies will be evaluated, and the transmission links will be sorted according to the relationship between the real-time data and the preset value, and finally the link with the best performance will be selected as the new data flow processing strategy.

[0083] It is understandable that by collecting real-time performance data of network links, these data include real-time delay, bandwidth and packet loss rate. These indicators are key parameters for evaluating network performance and can reflect the current state and transmission efficiency of the network. Real-time delay refers to the time required for a data packet to be transmitted in the network, while real-time bandwidth indicates the amount of data that the network can handle. Real-time packet loss rate refers to the proportion of data packets lost during transmission. The effectiveness of these data directly affects the user experience and the overall performance during data acceleration. Secondly, by comparing the real-time performance data with the preset performance indicators, it is possible to quickly determine whether the current network status meets the preset conditions. This process not only includes determining whether the real-time delay is less than or equal to the preset value, whether the real-time bandwidth is greater than or equal to the preset value, and whether the real-time packet loss rate is less than or equal to the preset value, but also requires comprehensive consideration of the comprehensive evaluation of these indicators. When any performance indicator does not meet the preset conditions, it will be determined that it is necessary to adjust the processing strategy of the data flow. This approach ensures that network management can respond in real time, thereby reducing delays and data loss and improving the efficiency of network transmission. In addition, once it is determined that the processing strategy needs to be adjusted, the real-time performance data of the transmission link in each processing strategy will be obtained and evaluated. This evaluation process not only considers a single delay or bandwidth, but also comprehensively considers the performance of each processing strategy in order to select the best processing strategy. The system will sort the evaluation results of all strategies in reverse order, so as to quickly identify the best performing strategy and adjust it as the new data flow processing strategy. This dynamic decision-making mechanism can quickly adapt when the network conditions change, maintaining the efficiency and stability of data transmission. Finally, through real-time monitoring and flexible adjustment of processing strategies, the system can intelligently allocate bandwidth and resources according to actual traffic demand and network conditions, reducing the risk of network congestion. At the same time, this dynamic adjustment capability also provides higher flexibility for network management, so that users can enjoy a better network experience in different application scenarios.

[0084] Specifically, the evaluation results are sorted in reverse order, and the processing strategy corresponding to the first evaluation result is adjusted to the processing strategy of the data stream, including: obtaining the performance score of each evaluation result, and obtaining the average performance score of each evaluation result. According to the comparison between the performance score and the average performance score, and according to the comparison result, the performance score is determined to be sorted: when the performance score is lower than the average performance score, it is determined that the performance score is not sorted. When the performance evaluation is higher than or equal to the average performance score, it is determined that the performance score is sorted.

[0085] It can be understood that by calculating the performance score of each evaluation result and finding the average of these scores. This average value serves as a performance benchmark, allowing for a relative evaluation of the performance of the link. When a performance score is higher than the average, it means that the link is performing well, and it is sorted so that those links with better performance are given priority. If the performance score is lower than the average, it indicates that there may be problems with the link, so it is not sorted. Through this sorting mechanism based on performance scores and averages, it is possible to quickly identify and prioritize links with excellent performance, thereby achieving efficient management and optimization of data flows and ensuring that network resources are optimally utilized.

[0086] Specifically, when evaluating each transmission link according to the relationship between the real-time delay, the real-time bandwidth and the real-time packet loss rate and the preset delay, the preset bandwidth and the preset packet loss rate, the method includes: obtaining the real-time delay of each transmission link, obtaining the delay mean of the real-time delay of each transmission link, and determining the preset delay by the delay mean. Obtain the delay difference between the real-time delay of the transmission link and the preset delay, and determine the performance score of the transmission link when evaluating according to the relationship between the delay difference and the pre-configured first preset delay difference and second preset delay difference. When the delay difference is less than the first preset delay difference, the performance score of the transmission link is determined to be L3. When the delay difference is greater than or equal to the first preset delay difference, and the delay difference is less than the second preset delay difference, the performance score of the transmission link is determined to be L2. When the delay difference is greater than or equal to the second preset delay difference, the performance score of the transmission link is determined to be L1. Among them, the first preset delay difference is less than the second preset delay difference, and L1<L2<L3.

[0087] Specifically, when the performance score of the transmission link is determined to be Li, i = 1, 2, 3, it includes: obtaining the real-time bandwidth of each transmission link, obtaining the bandwidth mean of the real-time bandwidth of each transmission link, and determining the preset bandwidth by the bandwidth mean. Comparing the real-time bandwidth of the transmission link with the preset bandwidth, and determining whether to adjust the performance score Li of the transmission link according to the comparison result: when the real-time bandwidth is greater than or equal to the preset bandwidth, it is determined not to adjust the performance score Li of the transmission link. When the real-time bandwidth is less than the preset bandwidth, the bandwidth difference between the real-time bandwidth and the preset bandwidth is obtained, and the adjustment coefficient is determined according to the bandwidth difference, and the performance score Li of the transmission link is adjusted according to the adjustment coefficient.

[0088] Specifically, when determining the adjustment coefficient according to the bandwidth difference, it includes: determining the adjustment coefficient according to the relationship between the bandwidth difference and the pre-configured first preset bandwidth difference and the second preset bandwidth difference. When the bandwidth difference is less than the first preset bandwidth difference, the adjustment coefficient is determined to be M3. When the bandwidth difference is greater than or equal to the first preset bandwidth difference, and the bandwidth difference is less than the second preset bandwidth difference, the adjustment coefficient is determined to be M2. When the bandwidth difference is greater than or equal to the second preset bandwidth difference, the adjustment coefficient is determined to be M1. Among them, the first preset bandwidth difference is less than the second preset bandwidth difference, and M1<M2<M3.

[0089] Specifically, when the adjustment coefficient is determined to be Mi, i=1, 2, 3, it includes: obtaining the real-time packet loss rate of each transmission link, obtaining the average packet loss rate of the real-time packet loss rate of each transmission link, and determining the preset packet loss rate from the average packet loss rate. Compare the real-time packet loss rate with the preset packet loss rate, and determine whether to correct the adjustment coefficient Mi according to the comparison result. When the real-time packet loss rate is less than or equal to the preset packet loss rate, it is determined not to correct the adjustment coefficient Mi. When the real-time packet loss rate is greater than the preset packet loss rate, the packet loss rate difference between the real-time packet loss rate and the preset packet loss rate is obtained, and the correction coefficient is determined according to the packet loss rate difference, and the adjustment coefficient Mi is corrected according to the correction coefficient.

[0090] Specifically, when determining the correction coefficient based on the packet loss rate difference, it includes: determining the correction coefficient based on the relationship between the packet loss rate difference and the pre-configured first preset packet loss rate difference and the second preset packet loss rate difference. When the packet loss rate difference is less than the first preset packet loss rate difference, the correction coefficient is determined to be N3. When the packet loss rate difference is greater than or equal to the first preset packet loss rate difference, and the packet loss rate difference is less than the second preset packet loss rate difference, the correction coefficient is determined to be N2. When the packet loss rate difference is greater than or equal to the second preset packet loss rate difference, the correction coefficient is determined to be N3. Among them, the first preset packet loss rate difference is less than the second preset packet loss rate difference, and N1<N2<N3<1.

[0091] It can be seen that by performing hierarchical evaluation and dynamic adjustment on the real-time performance data (delay, bandwidth and packet loss rate) of the network transmission link, efficient management and optimization of network traffic can be achieved. A performance score (L1, L2 or L3) is assigned to each transmission link based on the difference between the real-time delay and the preset delay. The score reflects the performance of the link. Subsequently, by further analyzing the relationship between the real-time bandwidth and the preset bandwidth, the performance score is adjusted to reflect the impact of insufficient bandwidth on link performance. Similarly, by comparing the real-time packet loss rate with the preset packet loss rate, the previously determined adjustment coefficient can be corrected to comprehensively consider the impact of delay, bandwidth and packet loss rate on link performance.

[0092] It is understandable that by monitoring the real-time delay of the network link and calculating the average delay, it is compared with the preset delay. This process ensures that the performance of the link is evaluated within a dynamic range. According to the size of the delay difference, the link is divided into three performance scores (L1, L2, L3), where L3 indicates excellent performance and L1 indicates poor performance. This hierarchical scoring mechanism not only enables network managers or programs to intuitively understand the performance status of different links, but also quickly identify links that need to be optimized, thereby improving the overall management efficiency of the network. Secondly, after the delay evaluation, the real-time bandwidth is monitored. This process is equally important because bandwidth is a key factor affecting the network traffic processing capacity. When the real-time bandwidth is lower than the preset value, an adjustment coefficient is determined based on the bandwidth difference, which further affects the performance score. In this way, the impact of insufficient bandwidth on network performance can be reflected in real time, and corresponding adjustments can be made when necessary. This flexible response mechanism enables the network to maintain a high transmission quality when traffic fluctuates, reducing network congestion and user experience degradation caused by insufficient bandwidth. In addition, the monitoring and evaluation of packet loss rate cannot be ignored. By obtaining the packet loss rate of the link in real time and comparing it with the preset value, the link performance evaluation process is further improved. If the real-time packet loss rate exceeds the preset value, the packet loss rate difference will be calculated, and the correction coefficient will be determined based on this difference. Such a correction mechanism ensures the accuracy of the performance score, so that when the link is abnormal, it can respond and make adjustments in time. Finally, through the comprehensive evaluation of delay, bandwidth and packet loss rate, a comprehensive performance analysis of each transmission link can be carried out, thereby providing strong data support for the optimization management of network traffic. Moreover, through the dynamic evaluation and adjustment mechanism based on multi-dimensional performance indicators, the network's adaptive ability is greatly improved, allowing the network to flexibly respond to changing traffic demands and network conditions. As users have higher and higher requirements for network quality, this not only improves the utilization efficiency of network resources, but also enhances user experience and ensures the stability and reliability of network services in different application scenarios.

[0093] In the above embodiment, by deploying a VPN module in a network environment and establishing a transmission tunnel based on a preset VPN protocol, data flow encapsulation and encryption processing can be achieved. This tunnel mechanism ensures the security of the data flow, but at the same time brings problems that are difficult to handle with traditional NAT, because the encrypted and encapsulated data packets have been encrypted in the header information and data content, and the traditional software NAT acceleration engine cannot directly process such data packets, and needs to take a slow protocol stack path for parsing and forwarding, resulting in increased delay and decreased performance. Secondly, by monitoring the network traffic to obtain the encrypted data packets, and parsing the header information of the data packets, including the VPN header and the unencrypted network layer and transport layer protocol header information, the data packets in the encrypted encapsulation state can be accurately identified. This step uses the specific encapsulation format of the VPN protocol, and by parsing the VPN header information and the network layer header, it can be determined whether the data packet is in an encrypted state. Once it is confirmed that the data packet has been encrypted and encapsulated by VPN, the data packet will be specially marked, so as to facilitate the rapid distinction between encrypted data packets and ordinary data packets during subsequent processing, and realize accurate classification management of data flows, avoiding unnecessary protocol stack path processing. Finally, this method quickly determines the next-hop forwarding path of the data packet by searching the preset routing table, so that the marked encrypted data packet can directly enter the optimized forwarding path instead of the traditional slow processing path. During the forwarding process, the performance data of the network link is monitored in real time, such as the delay, bandwidth and packet loss rate of the data packet transmission, and the processing strategy of the data stream is automatically adjusted according to the monitoring results. This dynamic adjustment strategy further improves the adaptability of the system, allowing the NAT acceleration engine to maintain efficient transmission performance when facing different network conditions. This not only improves the transmission speed of the VPN data stream, but also significantly optimizes the utilization of resources, providing users with a network transmission experience with lower latency, higher bandwidth and lower packet loss rate.

[0094] In another preferred embodiment based on the above embodiment, Figure 2 As shown, this embodiment provides a system for realizing data flow acceleration based on a NAT acceleration engine, including: a VPN module, a parsing module, a NAT acceleration module, an identification module and a central control module.

[0095] Specifically, the VPN module is deployed in a network environment, and the VPN module is configured to establish a VPN transmission tunnel based on a preset VPN protocol. The VPN module is also configured to obtain a target data stream to encapsulate a data packet, and encrypt the encapsulated data packet based on the VPN transmission tunnel. The parsing module is configured to monitor the network traffic of the target network, obtain the encrypted data packet, parse the data packet, and obtain the header information of the data packet. The NAT acceleration module is configured with several transmission links. The identification module is electrically connected to the parsing module, and the identification module is configured to determine whether the data packet is in an encrypted state based on the header information, wherein if the data packet is in an encrypted state, the identification module specially identifies the data packet. The central control module is electrically connected to the identification module, and the central control module is configured to obtain a preset routing table, and determine the next hop of the identified data packet based on the preset routing table. The central control module is also configured to obtain real-time performance data of the network link when forwarding the data packet, and adjust the processing strategy of the data stream based on the real-time performance data.

[0096] It can be understood that the method and system for realizing data flow acceleration based on a NAT acceleration engine in the above-mentioned embodiments of the present invention have the same beneficial effects, which will not be described in detail.

[0097] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0098] The present application is described with reference to flowcharts and / or block diagrams of methods, devices (systems) and computer program products according to embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0099] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0100] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0101] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for realizing data flow acceleration based on NAT acceleration engine, characterized in that: include: Deploy a VPN module in a network environment, and establish a VPN transmission tunnel of the VPN module based on a preset VPN protocol; Obtaining the target data stream to encapsulate data packets, and encrypting the encapsulated data packets through the VPN transmission tunnel; Monitor the network traffic of the target network, obtain the encrypted data packet, and parse the data packet to obtain header information of the data packet, wherein the header information includes VPN header information and unencrypted network layer and outer layer protocol headers; Determine whether the data packet is in an encrypted state according to the header information, wherein if the data packet is in an encrypted state, specially mark the data packet; Obtaining a preset routing table, and determining the next hop of the identified data packet according to the preset routing table; Acquire real-time performance data of the network link when forwarding the data packet, and adjust the processing strategy of the data stream according to the real-time performance data, wherein the real-time performance data includes the delay, bandwidth and packet loss rate during data packet transmission.

2. The method for realizing data flow acceleration based on NAT acceleration engine as claimed in claim 1, characterized in that: Parsing the data packet to obtain header information of the data packet includes: Monitor the data flow in real time based on the data packet capture tool, and parse each of the data packets in the data flow layer by layer to identify the source IP address, destination IP address, protocol type and port number of the data packet; Perform deep data packet inspection on the parsed data packet, and obtain the encryption protocol type, encryption algorithm and key exchange method of the data packet.

3. The method for realizing data flow acceleration based on NAT acceleration engine as claimed in claim 1, characterized in that: Acquiring real-time performance data of the network link when forwarding the data packet, and adjusting the processing strategy of the data flow according to the real-time performance data, includes: Acquire the real-time delay, real-time bandwidth and real-time packet loss rate of the network link, compare the real-time delay, real-time bandwidth and real-time packet loss rate with the pre-configured preset delay, preset bandwidth and preset packet loss rate, and determine whether to adjust the processing strategy of the data flow according to the comparison result: When the real-time delay is less than or equal to the preset delay, the real-time bandwidth is greater than or equal to the preset bandwidth, and the real-time packet loss rate is less than or equal to the preset packet loss rate, it is determined not to adjust the processing strategy of the data flow; When the real-time delay is greater than the preset delay, and / or the real-time bandwidth is less than the preset bandwidth, and / or the real-time packet loss rate is greater than the preset packet loss rate, determining to adjust the processing strategy of the data stream; Among them, when it is determined to adjust the processing strategy of the data flow, it includes: obtaining the real-time delay, real-time bandwidth and real-time packet loss rate of the transmission link in each of the processing strategies, evaluating each of the transmission links according to the relationship between the real-time delay, real-time bandwidth and real-time packet loss rate and the preset delay, preset bandwidth and preset packet loss rate, and sorting the evaluation results in reverse order, and adjusting the processing strategy corresponding to the first evaluation result to the processing strategy of the data flow.

4. The method for realizing data flow acceleration based on NAT acceleration engine as claimed in claim 3, characterized in that: When evaluating each of the transmission links according to the relationship between the real-time delay, the real-time bandwidth, and the real-time packet loss rate and the preset delay, the preset bandwidth, and the preset packet loss rate, the method includes: Acquire the real-time delay of each of the transmission links, acquire the delay mean of the real-time delay of each of the transmission links, and determine the preset delay by using the delay mean; Obtaining a delay difference between the real-time delay of the transmission link and the preset delay, and determining a performance score of the transmission link when evaluating according to a relationship between the delay difference and a pre-configured first preset delay difference and a second preset delay difference; When the delay difference is less than the first preset delay difference, determining that the performance score of the transmission link is L3; When the delay difference is greater than or equal to the first preset delay difference, and the delay difference is less than the second preset delay difference, determining that the performance score of the transmission link is L2; When the delay difference is greater than or equal to the second preset delay difference, determining that the performance score of the transmission link is L1; The first preset delay difference is smaller than the second preset delay difference, and L1<L2<L3.

5. The method for realizing data flow acceleration based on NAT acceleration engine as claimed in claim 4, characterized in that: When the performance score of the transmission link is determined to be Li, i=1, 2, 3, including: Acquire the real-time bandwidth of each transmission link, acquire the bandwidth average of the real-time bandwidth of each transmission link, and determine the preset bandwidth by using the bandwidth average; Comparing the real-time bandwidth of the transmission link with the preset bandwidth, and determining whether to adjust the performance score Li of the transmission link according to the comparison result; When the real-time bandwidth is greater than or equal to the preset bandwidth, determining not to adjust the performance score Li of the transmission link; When the real-time bandwidth is less than the preset bandwidth, the bandwidth difference between the real-time bandwidth and the preset bandwidth is obtained, an adjustment coefficient is determined according to the bandwidth difference, and the performance score Li of the transmission link is adjusted according to the adjustment coefficient.

6. The method for realizing data flow acceleration based on NAT acceleration engine as claimed in claim 5, characterized in that: When determining the adjustment coefficient according to the bandwidth difference, it includes: Determining the adjustment coefficient according to a relationship between the bandwidth difference and a preconfigured first preset bandwidth difference and a second preset bandwidth difference; When the bandwidth difference is less than the first preset bandwidth difference, determining the adjustment coefficient to be M3; When the bandwidth difference is greater than or equal to the first preset bandwidth difference, and the bandwidth difference is less than the second preset bandwidth difference, determining the adjustment coefficient to be M2; When the bandwidth difference is greater than or equal to the second preset bandwidth difference, the adjustment coefficient is determined to be M1; The first preset bandwidth difference is smaller than the second preset bandwidth difference, and M1<M2<M3.

7. The method for realizing data flow acceleration based on NAT acceleration engine as claimed in claim 6, characterized in that: When the adjustment coefficient is determined to be Mi, i=1, 2, 3, including: Acquire the real-time packet loss rate of each transmission link, acquire the average packet loss rate of the real-time packet loss rate of each transmission link, and determine the preset packet loss rate by using the average packet loss rate; Compare the real-time packet loss rate with the preset packet loss rate, and determine whether to modify the adjustment coefficient Mi according to the comparison result; When the real-time packet loss rate is less than or equal to the preset packet loss rate, it is determined that the adjustment coefficient Mi is not to be corrected; When the real-time packet loss rate is greater than the preset packet loss rate, the packet loss rate difference between the real-time packet loss rate and the preset packet loss rate is obtained, a correction coefficient is determined according to the packet loss rate difference, and the adjustment coefficient Mi is corrected according to the correction coefficient.

8. The method for realizing data flow acceleration based on NAT acceleration engine as claimed in claim 7, characterized in that: Determining the correction coefficient according to the packet loss rate difference includes: Determining the correction coefficient according to a relationship between the packet loss rate difference and a pre-configured first preset packet loss rate difference and a second preset packet loss rate difference; When the packet loss rate difference is less than the first preset packet loss rate difference, determining the correction coefficient to be N3; When the packet loss rate difference is greater than or equal to the first preset packet loss rate difference, and the packet loss rate difference is less than the second preset packet loss rate difference, determining the correction coefficient to be N2; When the packet loss rate difference is greater than or equal to the second preset packet loss rate difference, determining the correction coefficient to be N3; The first preset packet loss rate difference is smaller than the second preset packet loss rate difference, and N1<N2<N3<1.

9. The method for realizing data flow acceleration based on NAT acceleration engine as claimed in claim 3, characterized in that: Sorting the evaluation results in reverse order and adjusting the processing strategy corresponding to the first evaluation result to the processing strategy of the data flow includes: Obtaining a performance score for each of the evaluation results, and obtaining an average of the performance scores for each of the evaluation results; Compare the performance score with the average of the performance scores, and determine the ranking of the performance scores according to the comparison result: When the performance score is lower than the performance score average, it is determined that the performance score is not to be sorted; When the performance evaluation is higher than or equal to the performance score mean, the performance score is determined for ranking.

10. A system for realizing data flow acceleration based on a NAT acceleration engine, applicable to a method for realizing data flow acceleration based on a NAT acceleration engine as claimed in any one of claims 1 to 9, characterized in that: include: A VPN module is deployed in a network environment, the VPN module is configured to establish a VPN transmission tunnel based on a preset VPN protocol, and the VPN module is further configured to obtain a target data stream to encapsulate a data packet, and encrypt the encapsulated data packet based on the VPN transmission tunnel; The parsing module is configured to monitor the network traffic of the target network, obtain the encrypted data packet, and parse the data packet to obtain the header information of the data packet; A NAT acceleration module is configured with several transmission links; an identification module, electrically connected to the parsing module, the identification module being configured to determine whether the data packet is in an encrypted state according to the header information, wherein if the data packet is in an encrypted state, the identification module performs a special identification on the data packet; A central control module is electrically connected to the identification module, and is configured to obtain a preset routing table and determine the next hop of the identified data packet according to the preset routing table; the central control module is also configured to obtain real-time performance data of the network link when forwarding the data packet, and adjust the processing strategy of the data flow according to the real-time performance data.

Images