System and method for processing TCP (Transmission Control Protocol) data across public and private networks

Abstract

The invention discloses a TCP data processing system and method across public and private networks. The system comprises a public network terminal, a plurality of servers of a private network and a management platform crossing the public network and the private network, the platform comprises a first agent module, a distribution management module and a plurality of second agent modules. The first agent module obtains TCP-based first data of the terminal, packages the first data into HTTP second data and transmits the HTTP second data to the distribution management module; the distribution management module selects a target server according to a load balancing strategy, binds the terminal and the server through a consistent Hash algorithm, and transmits second data to a corresponding second agent module; the target second agent module analyzes the first data, transmits the first data to the server, packages TCP third data returned by the server into HTTP fourth data and transmits the HTTP fourth data back; and the first agent module analyzes third data and feeds back the third data to the terminal. According to the method and the device, the technical problem that cloud card reading and other services depending on TCP direct connection of the public network cannot run normally in a scene that an enterprise closes part of public network ports for network security is solved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a TCP data processing system and method across public and private networks. Background Art

[0002] Given the increasing complexity of the internet security landscape, enterprises are facing unprecedented challenges. The most pressing challenge is how to maintain network connectivity and efficiency for critical business systems while ensuring security. The increasing frequency of cyberattacks has prompted enterprises to adopt stricter network isolation strategies, particularly closing non-essential public network ports to reduce potential security risks. However, this strategy has led to significant business interruptions in certain business scenarios that rely on direct public network connections, such as the Smart Acceptance Assistant app in a cloud card reader platform. The app originally communicated directly with the cloud card reader server via the TCP protocol. With the port closed, the direct public network connection was severed, increasing card reading latency and dramatically reducing user experience. Traditional solutions (such as adding a public network forwarding server or VPN tunnel) present the following issues: Security risks: The newly exposed surface can easily become an attack entry point; High costs: The need to purchase third-party VPN equipment or services increases software, hardware, and operational expenses; Poor compatibility: The custom TCP protocol is difficult to adapt to standardized security protection tools.

[0003] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0004] The embodiments of the present application provide a TCP data processing system and method across public and private networks to at least solve the technical problem that services that rely on direct TCP connections to the public network, such as cloud card reading, cannot operate normally when an enterprise closes some public network ports for network security.

[0005] According to one aspect of an embodiment of the present application, a TCP data processing system across public and private networks is provided, comprising: a terminal on the public network side, multiple servers on the private network side, and a management platform across public and private networks, wherein the management platform comprises: a first proxy module corresponding to the terminal, a distribution management module, and multiple second proxy modules corresponding to the multiple servers, wherein the first proxy module is used to obtain first TCP-based data to be transmitted by the terminal, encapsulate the first data into second HTTP-based data, and transmit the second data to the distribution management module; the distribution management module is used to determine a target server from multiple servers based on a load balancing strategy, transmit the second data to a target second proxy module corresponding to the target server, and bind the terminal and the target server based on a hash consistency algorithm during the session; the target second proxy module is used to parse the first data from the second data and transmit the first data to the target server; the target server is used to respond to the first data, perform a database access action, and feedback third TCP-based data to the target second proxy module based on the access result; the target second proxy module is also used to encapsulate the third data into fourth HTTP-based data and transmit the fourth data to the first proxy module; the first proxy module is used to parse the third data from the fourth data and transmit the third data to the terminal.

[0006] Optionally, the management platform also includes: a security protection module, which includes: a web application firewall and a database activity monitoring unit; the web application firewall is used to perform security detection on the second data based on a preset rule set before the first proxy module transmits the second data to the distribution management module, and intercept network attacks, wherein the rule set is used to detect at least one of the following types of network attacks: SQL attacks, XSS attacks; the database activity monitoring unit is used to monitor the database access behavior of the target server in real time, detect abnormal access behavior based on a preset audit policy, and generate a security audit report.

[0007] Optionally, data transmission between the first proxy module and the distribution management module, between the distribution management module and the target second proxy module, and between the target second proxy module and the first proxy module is performed through a bidirectional encrypted HTTP link based on a long polling mechanism or a WebSocket mechanism.

[0008] Optionally, the first proxy module is used to binary encode the first data to obtain a first binary data stream, and encapsulate the first binary data stream based on a preset HTTP payload format to obtain second data, wherein the second data includes: a header identifier, a payload length, and a first binary data stream; the target second proxy module is used to binary encode the third data to obtain a second binary data stream, and encapsulate the second binary data stream based on the HTTP payload format to obtain fourth data, wherein the fourth data includes: a header identifier, a payload length, and a second binary data stream.

[0009] Optionally, the distribution management module includes: an Nginx reverse proxy unit; an Nginx reverse proxy unit, used to obtain the load status and QoS indicators of multiple servers in real time, analyze the load status and QoS indicators of multiple servers based on a preset load balancing strategy, and determine the target server from multiple servers that has the best system performance when processing the second data.

[0010] Optionally, the Nginx reverse proxy unit is further configured to periodically detect newly connected servers in the system and allocate corresponding second proxy modules to the newly connected servers.

[0011] Optionally, the target second proxy module is configured to parse the multiple sets of third data fed back by the target server using a non-blocking input / output model in a data concurrency scenario.

[0012] Optionally, the distribution management module is used to obtain the terminal identification of the terminal and generate a hash key corresponding to the terminal based on the terminal identification; construct a virtual hash ring and map multiple servers to the virtual hash ring based on a preset hash function, wherein each server corresponds to multiple nodes in the virtual hash ring; during the session, the hash key is bound to the target node corresponding to the target server on the virtual hash ring.

[0013] Optionally, the target second proxy module is used to periodically detect the communication status between the target second proxy module and the first proxy module using a heartbeat detection mechanism during the session; when it is detected that the target second proxy module is disconnected from the first proxy module, the communication connection between the target second proxy module and the first proxy module is automatically restored.

[0014] Optionally, the terminal is a card reader and the server is a cloud card reader server.

[0015] According to another aspect of an embodiment of the present application, a method for processing TCP data across public and private networks is also provided, including: calling the first proxy module on the terminal side to obtain the first TCP-based data to be transmitted by the terminal, and encapsulating the first data into second HTTP-based data; calling the distribution management module to determine the target server from multiple servers based on the load balancing strategy, transmitting the second data to the target second proxy module on the target server side, and binding the terminal and the target server based on the hash consistency algorithm during the session; calling the target second proxy module to parse the first data from the second data, transmit the first data to the target server, and encapsulate the third TCP-based data fed back by the target server into fourth HTTP-based data, and transmit the fourth data to the first proxy module; calling the first proxy module to parse the third data from the fourth data, and transmit the third data to the terminal.

[0016] According to another aspect of an embodiment of the present application, a computer program product is further provided, comprising: a computer program, wherein when the computer program is executed by a processor, the computer program implements the above-mentioned TCP data processing method across public and private networks.

[0017] According to another aspect of an embodiment of the present application, an electronic device is also provided, which includes: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the above-mentioned TCP data processing method across public and private networks through the computer program.

[0018] In the embodiment of the present application, the first proxy module can encapsulate the first data (original card reading instruction or data stream) based on the TCP protocol on the terminal side and convert it into the second data based on the HTTP protocol. This process not only ensures the security of data transmission in the public network, but also realizes the hiding of TCP data stream to avoid malicious detection or interception. By analyzing the real-time load conditions and QoS (quality of service) indicators of multiple private network servers, the distribution management module can intelligently select the optimal target server to ensure the efficiency and smoothness of data processing. The target second proxy module can quickly parse the first data from the second data based on HTTP to ensure the timely processing of the original TCP data. It also reflects the efficiency and accuracy of the proxy module in data processing. After processing the business logic, the target second proxy module is responsible for encapsulating the third data based on TCP fed back by the target server into the fourth data based on HTTP. This process once again utilizes the characteristics of the HTTP protocol to achieve the safe return of the response data. The first proxy module can accurately parse the fourth data based on HTTP returned from the target server, restore the third data based on TCP, and then transmit these data to the terminal to complete the last step of data delivery, thereby solving the technical problem that when the enterprise closes some public network ports for network security, services that rely on public network TCP direct connection, such as cloud card reading, cannot operate normally. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0020] Figure 1 This is a schematic diagram of the structure of an optional TCP data processing system across public and private networks according to an embodiment of the present application;

[0021] Figure 2 This is a schematic diagram of an optional cross-public and private network TCP data processing system implementation structure according to an embodiment of the present application;

[0022] Figure 3 This is a schematic diagram of a data transmission process in an optional TCP data processing system across public and private networks according to an embodiment of the present application;

[0023] Figure 4 This is a flow chart of an optional method for processing TCP data across public and private networks according to an embodiment of the present application;

[0024] Figure 5 It is a schematic structural diagram of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0026] It should be noted that the terms "first", "second", etc. in the specification, claims, and drawings of the present application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0027] Example 1

[0028] According to an embodiment of the present application, a TCP data processing system across public and private networks is provided, such as Figure 1 As shown, the TCP data processing system across public and private networks includes at least: a terminal 11 on the public network side, multiple servers 12 (1 to n) on the private network side, and a management platform 13 across public and private networks. The management platform includes: a first agent module 131 corresponding to the terminal, a distribution management module 132, and multiple second agent modules 133 (1 to m) corresponding to the multiple servers, wherein:

[0029] The first proxy module 131 is configured to obtain first TCP-based data to be transmitted by the terminal, encapsulate the first data into second HTTP-based data, and transmit the second data to the distribution management module 132;

[0030] a distribution management module 132 for determining a target server from a plurality of servers based on a load balancing strategy, transmitting the second data to a target second proxy module corresponding to the target server, and binding the terminal and the target server based on a hash consistency algorithm during the duration of the session;

[0031] a target second proxy module, configured to parse the first data from the second data and transmit the first data to a target server;

[0032] The target server is configured to respond to the first data, execute a database access action, and feed back third data based on TCP to the target second proxy module based on the access result;

[0033] The target second proxy module is further configured to encapsulate the third data into fourth data based on HTTP, and transmit the fourth data to the first proxy module;

[0034] The first agent module 131 is configured to parse the fourth data to obtain third data, and transmit the third data to the terminal 11 .

[0035] The following describes the functions of each module of the TCP data processing system across public and private networks in conjunction with a specific implementation process.

[0036] The first proxy module is configured to obtain first TCP-based data to be transmitted by the terminal, encapsulate the first data into second HTTP-based data, and transmit the second data to the distribution management module.

[0037] Among them, as an optional implementation, the first proxy module binary encodes the first data to obtain a first binary data stream, and encapsulates the first binary data stream based on a preset HTTP payload format to obtain second data, wherein the second data includes: a header identifier, a payload length, and a first binary data stream.

[0038] For example, a first proxy module is integrated into the Smart Acceptance Assistant app. When the card reader interacts with the app via the TCP protocol, the first proxy module captures this TCP-based first data in real time. After capturing the first data, the first proxy module immediately performs binary encoding on it, forming a first binary data stream. This step ensures the data's transportability across the network. Since the HTTP protocol is essentially text-based, binary encoding converts TCP data into a format understandable by HTTP. Next, the first proxy module encapsulates the first binary data stream using a pre-defined HTTP payload format. This payload format consists of three key components: a header identifier, a payload length, and the first binary data stream itself. The header identifier identifies the packet type, and the payload length informs the recipient of the actual data size for proper processing and decoding. After encapsulation, the first proxy module sends the HTTP-based second data to the distribution management module via a bidirectional encrypted HTTP link using long polling or a WebSocket mechanism. This emphasizes the encryption and bidirectional nature of data transmission, ensuring data security and low latency in public networks.

[0039] The distribution management module is used to determine the target server from multiple servers based on the load balancing strategy, transmit the second data to the target second agent module corresponding to the target server, and bind the terminal and the target server based on the hash consistency algorithm during the session.

[0040] As an optional implementation, the management platform also includes: a security protection module, which includes: a web application firewall and a database activity monitoring unit; the web application firewall is used to perform security detection on the second data based on a preset rule set before the first proxy module transmits the second data to the distribution management module, and intercept network attacks, wherein the rule set is used to detect at least one of the following types of network attacks: SQL attacks, XSS attacks; the database activity monitoring unit is used to monitor the database access behavior of the target server in real time, detect abnormal access behavior based on a preset audit policy, and generate a security audit report.

[0041] For example, the security protection module within the management platform includes a web application firewall (WAF) and a database activity monitoring (DAS) unit, which together form the system's security defenses. The WAF performs security checks before all data enters and exits the distribution management module, intercepting potential attacks such as SQL injection and XSS cross-site scripting. The WAF rule set should be regularly updated to protect against the latest security threats. The DAS monitors database access activity on the target server in real time. If it detects abnormal access behavior (such as frequent reads and writes, suspicious queries, etc.), it immediately triggers an alarm and generates a security audit report to facilitate subsequent security incident analysis and response.

[0042] As an optional implementation, data transmission between the first proxy module and the distribution management module, between the distribution management module and the target second proxy module, and between the target second proxy module and the first proxy module is carried out through a bidirectional encrypted HTTP link based on a long polling mechanism or a WebSocket mechanism.

[0043] For example, TLS 1.3 encrypts HTTP communications, ensuring data security during transmission. The persistent connection feature of the WebSocket protocol reduces connection establishment and disconnection latency, making it more suitable for applications requiring frequent interaction and real-time responses. Long polling, on the other hand, provides a low-latency alternative when WebSocket isn't suitable (e.g., on older devices or with limited network environments). This approach simulates real-time communication by having the client remain in a state of waiting for data from the server. Long polling is a technique for simulating real-time communication: the client initiates an HTTP request, and the server maintains the connection open until new data arrives. The server then responds and closes the connection, prompting the client to initiate a new request, repeating the cycle. This achieves low-latency data push. WebSocket is a full-duplex communication protocol over a single TCP connection. It uses the HTTP handshake and upgrades to persistent connections, allowing the server and client to send data in both directions without frequent connection establishment and closure. This reduces communication latency and improves real-time performance. TLS 1.3 is the latest version of the Transport Layer Security protocol, providing encrypted communication between client and server, ensuring the security and confidentiality of data during transmission.

[0044] As an optional implementation, the distribution management module includes: an Nginx reverse proxy unit; an Nginx reverse proxy unit, which is used to obtain the load status and QoS indicators of multiple servers in real time, analyze the load status and QoS indicators of multiple servers based on a preset load balancing strategy, and determine the target server from multiple servers that has the best system performance when processing the second data.

[0045] The Nginx reverse proxy unit is also used to periodically detect newly connected servers in the system and allocate corresponding second proxy modules to the newly connected servers.

[0046] For example, the Nginx reverse proxy unit in the distribution management module monitors the load status and QoS (Quality of Service) indicators of each private network-side server in real time, such as CPU usage, memory occupancy, network bandwidth, etc. Nginx regularly detects the status of each server node through a built-in health check mechanism, such as whether it responds, response time, etc., and evaluates the health level of the server based on this. At the same time, Nginx, based on a dynamic weight algorithm (such as the minimum number of connections strategy, weighted polling strategy, etc.), comprehensively considers the load status and QoS, and intelligently selects the optimal target server to ensure rapid data response and efficient use of system resources. After selecting the target server, Nginx forwards the second data based on HTTP (that is, the encapsulated TCP data) to the target second proxy module on the server to start the data processing process.

[0047] The target second proxy module is configured to parse the first data from the second data and transmit the first data to the target server.

[0048] The target server is configured to respond to the first data, execute a database access action, and feed back TCP-based third data to the target second proxy module based on the access result.

[0049] The target second proxy module is further configured to encapsulate the third data into fourth data based on HTTP, and transmit the fourth data to the first proxy module.

[0050] Among them, the target second proxy module is used to binary encode the third data to obtain a second binary data stream, and encapsulate the second binary data stream based on the HTTP payload format to obtain fourth data, wherein the fourth data includes: a header identifier, a payload length, and a second binary data stream.

[0051] The first agent module is configured to parse the fourth data to obtain the third data and transmit the third data to the terminal.

[0052] For example, the target second proxy module uses predefined rules, such as parsing the Content-Type field, identifying the data format, and extracting header identifiers and payload length information to correctly process the subsequent binary data stream. The target second proxy module converts the data stream in the HTTP payload back into TCP format using Base64 or a custom binary decoding algorithm. The target second proxy module uses the Smz-Terminal-Id and Sm session stickiness mechanisms to ensure a stable and efficient TCP connection. Once the connection is established, the proxy module transmits the data to the target server using a standard TCP socket API. Upon receiving the TCP data, the target server executes relevant business logic, such as processing cloud card reader requests and database queries. The server's business logic layer parses the TCP packet and invokes the appropriate processing function or service based on the data type. For example, for a cloud card reader request, the server may need to verify user permissions and read ID information, then organize the results into a TCP response. Based on the business processing results, the target server constructs a third data packet based on TCP for transmission. The response data also follows the TCP protocol format and contains necessary control information and business data. For example, for database query results, the server returns the size, structure, and specific content of the query result set, all encapsulated in a TCP response packet. The target second proxy module receives the TCP feedback data (third data), encodes it into a second binary data stream, and encapsulates it into the fourth data based on HTTP. The proxy module uses binary encoding (such as Base64 encoding) to convert the TCP response data into a binary string, and then adds the necessary header identifier (such as ###REPLY###) and payload length field in the HTTP response body, finally forming the fourth data that complies with the HTTP specification. The target second proxy module carries the terminal identifier and session information through the HTTP response header, sends the fourth data back to the first proxy module, and adds Smz-Terminal-Id and Smz-Socket-Id to the HTTP response header to ensure that the response data can be accurately identified by the first proxy module and associated with the correct terminal session. After receiving the fourth data, the first proxy module parses the header identifier, payload length and the second binary data stream. The proxy module checks the Smz-Terminal-Id and Sm session information in the HTTP response header to ensure that the data is fed back to the correct terminal. The first proxy module decodes the second binary data stream into original TCP feedback data (third data), and also uses a decoding algorithm such as Base64 to convert the binary string in the HTTP response body back into feedback data in TCP format, completing the closed-loop transmission of data.The first proxy module transmits the decoded TCP feedback data to the client terminal, such as the smart acceptance assistant APP, to complete the final delivery of the data. The proxy module calls the local TCP socket and sends the TCP feedback data to the card reader or other client program through the predetermined port, realizing the transparent transmission of data from the public network to the intranet.

[0053] The target second agent module is used to parse multiple sets of third data fed back by the target server using a non-blocking input / output model in a data concurrency scenario.

[0054] The distribution management module is used to obtain the terminal identification of the terminal and generate a hash key corresponding to the terminal based on the terminal identification; build a virtual hash ring and map multiple servers to the virtual hash ring based on a preset hash function, wherein each server corresponds to multiple nodes in the virtual hash ring; during the session, the hash key is bound to the target node corresponding to the target server on the virtual hash ring.

[0055] The target second proxy module is used to periodically detect the communication status between the target second proxy module and the first proxy module using a heartbeat detection mechanism during the session; when it is detected that the target second proxy module is disconnected from the first proxy module, the communication connection between the target second proxy module and the first proxy module is automatically restored.

[0056] The terminal type is a card reader, and the server type is a cloud card reader server.

[0057] For example, in a high-concurrency scenario, the target second proxy module receives HTTP-based fourth data, that is, multiple sets of TCP-based third data fed back by the target server. These data may contain response information from multiple clients and need to be correctly and efficiently parsed and processed. In this process, the target second proxy module uses a non-blocking input / output (I / O) model to process the large amount of received data. The non-blocking I / O model allows the module to continue processing other tasks without blocking the execution flow of the application while waiting for data input or output. This is usually implemented through an asynchronous I / O library or framework, such as the java.nio package in Java, or the event-driven model in Node.js. Non-blocking I / O can significantly improve the response speed and resource utilization of the proxy module in a high-concurrency environment, avoiding performance bottlenecks caused by waiting for a single connection.

[0058] When the distribution management module receives a request from a client terminal (such as a card reader), it first extracts the terminal's identifier, which can be an IP address, MAC address, or user ID. It then generates a hash key corresponding to the terminal using a pre-defined hash function. The choice of hash function is crucial to the efficiency of the session stickiness mechanism. A consistent hashing algorithm is typically used, ensuring that requests from the same terminal are directed to similar server nodes even if the server cluster changes, reducing the number of reallocations and the impact on system stability. The distribution management module constructs a virtual hash ring and then uses a hash function to map multiple servers on the private network side (in this scenario, cloud card reader servers) to this ring. Each server may correspond to multiple nodes on the ring, improving the granularity of load balancing and the robustness of the system. When constructing the virtual hash ring, the hash value position of each node (i.e., server) is determined not only by its own identifier but also by its capacity and weight to ensure load balancing. For example, if node A has higher processing power and capacity, it may have a higher number of nodes and a higher position on the hash ring to attract more requests. During a session, the distribution management module binds the terminal's hash key to the target node corresponding to the target server on the virtual hash ring, ensuring that subsequent requests from the same terminal are directed to the same server, maintaining session continuity. Using a hash consistency algorithm, the distribution management module maps the terminal's hash key to the node on the ring closest to the key value. The server corresponding to this node becomes the target server bound to the session. This session stickiness mechanism avoids frequent server switching, improving data processing efficiency and user experience.

[0059] During the session, the target second proxy module uses a heartbeat detection mechanism to periodically detect the communication status with the first proxy module to ensure the real-time connectivity of the link. The heartbeat packet is usually a lightweight data packet sent periodically to test the validity of the network connection and the activity status of the server. The target second proxy module and the first proxy module exchange heartbeat packets regularly. If one party does not receive the other party's heartbeat response within a predetermined time, it will be determined that the connection is interrupted. Once the connection with the first proxy module is detected to be interrupted, the target second proxy module will automatically trigger the reconnection process and try to re-establish the communication connection with the first proxy module to ensure the continuity of data transmission and the availability of the service. The disconnection reconnection mechanism usually includes a retry strategy (such as exponential backoff retry), which waits for an increasing period of time when the connection fails and then tries to establish the connection again. In addition, the proxy module may also adopt a backup connection or a strategy of reallocating to other healthy nodes to quickly restore network communication.

[0060] Through the above analysis and implementation details, it can be seen that the mechanism aims to build a highly reliable and scalable data communication system through the combination of non-blocking I / O, hash consistency algorithm, and the use of heartbeat detection + disconnection reconnection strategy. It is particularly suitable for cloud card reading services that require high-frequency, low-latency data interaction, and can effectively respond to various technical challenges and security threats in the public network environment.

[0061] Figure 2 The implementation structure diagram of the above system is given as follows: Figure 2 As shown in the figure, the public network side includes mobile apps and authentication terminals (such as card readers), which interact with the system through the public network. The private network side includes multiple servers (such as cloud card readers) and related network equipment (such as Ethernet switches) in the internal cloud environment. The middle layer includes the concentrator, firewall, WAF (Web Application Firewall), and management platform. Figure 3 The data transmission process diagram of the system is given as follows: Figure 3 As shown in the figure, the card reader initiates a connection request to the front-end agent. After receiving the request, the front-end agent establishes a connection with the card reader and returns a confirmation message of "connection successful". The front-end agent attempts to establish a data transmission connection with the back-end agent. If the connection is successfully established, the front-end agent will notify the back-end agent that "data transmission connection is established successfully". After receiving the connection request from the front-end agent, the back-end agent establishes a connection with the card reader server. After the connection between the back-end agent and the card reader server is established, the back-end agent begins to prepare to receive data. The card reader sends data to the front-end agent through the established connection. After receiving the data, the front-end agent forwards it to the back-end agent. The back-end agent forwards the data to the card reader server. After the card reader server processes the data, it may also return response data through the same path. After the data transmission is completed, the card reader, front-end agent, back-end agent and card reader server disconnect their respective connections in turn. This process ensures that after each data interaction, system resources can be released in time to prepare for the next interaction.

[0062] In the embodiment of the present application, the first proxy module can encapsulate the first data (original card reading instruction or data stream) based on the TCP protocol on the terminal side and convert it into the second data based on the HTTP protocol. This process not only ensures the security of data transmission in the public network, but also realizes the hiding of TCP data stream to avoid malicious detection or interception. By analyzing the real-time load conditions and QoS (quality of service) indicators of multiple private network servers, the distribution management module can intelligently select the optimal target server to ensure the efficiency and smoothness of data processing. The target second proxy module can quickly parse the first data from the second data based on HTTP to ensure the timely processing of the original TCP data. It also reflects the efficiency and accuracy of the proxy module in data processing. After processing the business logic, the target second proxy module is responsible for encapsulating the third data based on TCP fed back by the target server into the fourth data based on HTTP. This process once again utilizes the characteristics of the HTTP protocol to achieve the safe return of the response data. The first proxy module can accurately parse the fourth data based on HTTP returned from the target server, restore the third data based on TCP, and then transmit these data to the terminal to complete the last step of data delivery, thereby solving the technical problem that when the enterprise closes some public network ports for network security, services that rely on public network TCP direct connection, such as cloud card reading, cannot operate normally.

[0063] Example 2

[0064] According to an embodiment of the present application, a method for processing TCP data across public and private networks is provided, which is applied to the TCP data processing system across public and private networks in Example 1. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0065] Figure 4 This is a flow chart of a method for processing TCP data across public and private networks provided in accordance with an embodiment of the present application, such as Figure 4 As shown, the method includes the following steps:

[0066] Step S402: calling a first proxy module on the terminal side to obtain first TCP-based data to be transmitted by the terminal, and encapsulating the first data into second HTTP-based data;

[0067] Step S404: calling the distribution management module to determine a target server from multiple servers based on a load balancing strategy, transmitting the second data to a target second proxy module on the target server side, and binding the terminal and the target server based on a hash consistency algorithm during the session duration;

[0068] Step S406: calling the target second proxy module to parse the first data from the second data, transmitting the first data to the target server, and encapsulating the TCP-based third data fed back by the target server into HTTP-based fourth data, and transmitting the fourth data to the first proxy module;

[0069] Step S408: calling the first proxy module to parse the fourth data to obtain the third data, and transmitting the third data to the terminal.

[0070] The following describes the steps of the TCP data processing method across public and private networks in conjunction with a specific implementation process.

[0071] The first proxy module on the terminal side is called to obtain first TCP-based data to be transmitted by the terminal, and the first data is encapsulated into second HTTP-based data.

[0072] For example, when the smart acceptance assistant APP (terminal) performs a card reading operation, it passes the generated first data based on the TCP protocol (original card reading instructions or data stream) to the integrated first agent module, wherein the APP establishes a TCP connection with the first agent module through the local Socket API, and sends the instructions or data issued by the card reader to the agent module as a binary stream. After receiving the first data, the first agent module encapsulates it into second data based on HTTP for secure transmission over the public network. The agent module uses a custom data encapsulation protocol, including a header identifier (such as ###START###), a payload length, and a Base64-encoded original data stream. The encapsulated data is sent through the HTTP request body to ensure the concealment and security of the data during transmission over the public network.

[0073] calling a distribution management module to determine a target server from a plurality of servers based on a load balancing strategy, transmitting the second data to a target second proxy module on the target server side, and binding the terminal and the target server based on a hash consistency algorithm during the session duration;

[0074] For example, the first proxy module transmits the encapsulated second data to the distribution management module of the management platform, and requests the data to be forwarded to the private network server, wherein the proxy module initiates an HTTP POST request to the distribution management module, which contains the second data and the terminal identifier (such as IP address or user ID) to assist in selecting the target server. The distribution management module analyzes the real-time load conditions and QoS indicators of multiple servers based on the preset load balancing strategy, and selects the optimal target server, wherein the Nginx reverse proxy unit selects the service node with the lightest current load and the best QoS from multiple cloud card reading servers through a dynamic weight algorithm as the target server for processing terminal requests. During the session, the distribution management module uses a hash consistency algorithm to bind the terminal and the target server to ensure session stickiness, wherein a hash key is generated according to the terminal identifier, and is mapped to a virtual hash ring through a preset hash function, and the node closest to the hash key is found. The server corresponding to the node is the target server. This mechanism ensures that terminal requests are always directed to the same server, improving the continuity and efficiency of data processing.

[0075] calling the target second proxy module to parse the first data from the second data, transmitting the first data to the target server, encapsulating the TCP-based third data fed back by the target server into HTTP-based fourth data, and transmitting the fourth data to the first proxy module;

[0076] For example, after receiving the second data, the target second proxy module parses the first data using a predefined protocol and restores it to the original TCP data stream. The proxy module examines the header identifier and payload length field in the HTTP request, extracts the Base64-encoded binary stream, and decodes it to restore it to TCP data. The target server (cloud card reader server) receives and processes the first data, performs a database access action, and then feeds TCP-based third data back to the target second proxy module. The cloud card reader server's business logic layer parses the TCP data, performs the corresponding card reading operation or database query, generates response data (third data) containing the operation result, and returns it to the target second proxy module using a TCP socket. The target second proxy module encodes the third data into a second binary data stream, then encapsulates it into HTTP-based fourth data, and transmits it back to the first proxy module via an encrypted HTTP link. The proxy module converts the third data into a binary stream, encapsulates it using an HTTP payload format similar to that described in step S102, including the header identifier, payload length, and encoded data stream, and finally sends it to the first proxy module via an HTTP response.

[0077] The first proxy module is called to parse the third data from the fourth data, and transmit the third data to the terminal.

[0078] For example, after receiving the fourth data, the first proxy module parses the third data and transmits it to the terminal (card reader). The proxy module checks the header identifier in the HTTP response body, extracts the payload length and binary data stream, uses Base64 decoding and predefined protocol parsing to restore it to TCP response data, and then transmits the data to the card reader or app through the local TCP port. The card reader or app parses the TCP response data and performs the corresponding card reading result display or business logic processing. The terminal uses the TCP socket API to receive the third data, calls the corresponding parsing function or service based on the data type, and presents the card reading result to the user or further processes it, such as saving a record or updating the user status.

[0079] It should be noted that each module in the TCP data processing device across public and private networks in the embodiment of the present application corresponds one-to-one to each implementation step of the TCP data processing method across public and private networks in Example 1. Since a detailed description has been given in Example 1, some details not reflected in this embodiment can be referred to Example 1 and will not be elaborated here.

[0080] Example 3

[0081] According to an embodiment of the present application, a computer program product is also provided, which includes a computer program, wherein when the computer program is executed by a processor, it implements the TCP data processing method across public and private networks in Example 2.

[0082] According to an embodiment of the present application, a non-volatile storage medium is also provided, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the TCP data processing method across public and private networks in Example 2 by running the computer program.

[0083] According to an embodiment of the present application, a processor is further provided, which is used to run a computer program, wherein the computer program executes the TCP data processing method across public and private networks in Example 2 when running.

[0084] According to an embodiment of the present application, an electronic device is also provided, which includes: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the TCP data processing method across public and private networks in Example 2 through the computer program.

[0085] Specifically, the computer program executes the following steps when it is running: calling the first proxy module on the terminal side to obtain the first TCP-based data to be transmitted by the terminal, and encapsulating the first data into second HTTP-based data; calling the distribution management module to determine the target server from multiple servers based on the load balancing strategy, transmitting the second data to the target second proxy module on the target server side, and binding the terminal and the target server based on the hash consistency algorithm during the session; calling the target second proxy module to parse the first data from the second data, transmitting the first data to the target server, and encapsulating the third TCP-based data fed back by the target server into fourth HTTP-based data, and transmitting the fourth data to the first proxy module; calling the first proxy module to parse the third data from the fourth data, and transmitting the third data to the terminal.

[0086] As an optional implementation, the electronic device may be in the form of a mobile terminal, a computer terminal or a similar computing device. Figure 5 The hardware structure block diagram of an electronic device for implementing a TCP data processing method across public and private networks is shown. Figure 5 As shown, the electronic device 50 may include one or more (502a, 502b, ..., 502n are shown in the figure) processors 502 (the processor 502 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 504 for storing data, and a transmission device 506 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It will be understood by those skilled in the art that Figure 5 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 5 More or fewer components than shown, or with Figure 5 Different configurations shown.

[0087] It should be noted that the one or more processors 502 and / or other data processing circuits described above may generally be referred to herein as "data processing circuitry". The data processing circuitry may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuitry may be a single independent processing module, or may be incorporated in whole or in part into any of the other components of the electronic device 50. As described in the embodiments of the present application, the data processing circuitry serves as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0088] The memory 504 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the TCP data processing method across public and private networks in the embodiment of the present application. The processor 502 executes various functional applications and data processing by running the software programs and modules stored in the memory 504, that is, implementing the vulnerability detection method of the above-mentioned application. The memory 504 may include a high-speed random access memory and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 504 may further include a memory remotely located relative to the processor 502, and these remote memories may be connected to the electronic device 50 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0089] The transmission device 506 is used to receive or send data via a network. Specific examples of the aforementioned network may include a wireless network provided by the communications provider of the electronic device 50. In one embodiment, the transmission device 506 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, the transmission device 506 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0090] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the electronic device 50 .

[0091] The serial numbers of the above embodiments are for description only and do not represent the advantages or disadvantages of the embodiments.

[0092] In the above embodiments of the present application, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0093] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0094] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected to achieve the purpose of the present embodiment according to actual needs.

[0095] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0096] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program code.

[0097] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A TCP data processing system across public and private networks, characterized in that: include: A terminal on the public network side, multiple servers on the private network side, and a management platform across public and private networks, wherein the management platform includes: a first agent module corresponding to the terminal, a distribution management module, and multiple second agent modules corresponding to the multiple servers, wherein: The first proxy module is configured to obtain first data based on the channel transmission protocol TCP to be transmitted by the terminal, encapsulate the first data into second data based on the hypertext transfer protocol HTTP, and transmit the second data to the distribution management module; The distribution management module is configured to determine a target server from a plurality of servers based on a load balancing strategy, transmit the second data to a target second proxy module corresponding to the target server, and bind the terminal and the target server based on a hash consistency algorithm during the session duration; The target second agent module is configured to parse the first data from the second data and transmit the first data to the target server; The target server is configured to respond to the first data, execute a database access action, and feed back third data based on TCP to the target second proxy module based on the access result; The target second proxy module is further configured to encapsulate the third data into fourth data based on HTTP, and transmit the fourth data to the first proxy module; The first agent module is configured to parse the fourth data to obtain the third data, and transmit the third data to the terminal.

2. The system according to claim 1, wherein: The management platform also includes: a security protection module, which includes: a web application firewall and a database activity monitoring unit; The web application firewall is configured to perform security detection on the second data based on a preset rule set to intercept network attacks before the first proxy module transmits the second data to the distribution management module, wherein the rule set is configured to detect at least one of the following types of network attacks: structured query language (SQL) attacks and cross-site scripting (XSS) attacks; The database activity monitoring unit is used to monitor the database access behavior of the target server in real time, detect abnormal access behavior based on a preset audit policy, and generate a security audit report.

3. The system according to claim 1, wherein: Data transmission between the first proxy module and the distribution management module, between the distribution management module and the target second proxy module, and between the target second proxy module and the first proxy module is carried out through a bidirectional encrypted HTTP link based on a long polling mechanism or a WebSocket mechanism.

4. The system according to claim 1, wherein: The first proxy module is configured to binary encode the first data to obtain a first binary data stream, and encapsulate the first binary data stream based on a preset HTTP payload format to obtain the second data, wherein the second data includes: a header identifier, a payload length, and the first binary data stream; The target second proxy module is used to binary encode the third data to obtain a second binary data stream, and encapsulate the second binary data stream based on the HTTP payload format to obtain the fourth data, wherein the fourth data includes: a header identifier, a payload length, and the second binary data stream.

5. The system according to claim 1, wherein: The distribution management module includes: an Nginx reverse proxy unit; The Nginx reverse proxy unit is used to obtain the load status and service quality QoS indicators of the multiple servers in real time, analyze the load status and QoS indicators of the multiple servers based on a preset load balancing strategy, and determine the target server from the multiple servers that has the best system performance when processing the second data.

6. The system according to claim 5, characterized in that The Nginx reverse proxy unit is further used to periodically detect newly connected servers in the system and allocate a corresponding second proxy module to the newly connected servers.

7. The system according to claim 1, wherein: The target second agent module is used to parse the multiple sets of third data fed back by the target server using a non-blocking input / output model in a data concurrency scenario.

8. The system according to claim 1, wherein: The distribution management module is used to obtain the terminal identification of the terminal and generate a hash key corresponding to the terminal based on the terminal identification; construct a virtual hash ring and map the multiple servers to the virtual hash ring based on a preset hash function, wherein each server corresponds to multiple nodes in the virtual hash ring; during the session, bind the hash key to the target node corresponding to the target server on the virtual hash ring.

9. The system according to claim 1, wherein: The target second proxy module is configured to periodically detect the communication status between the target second proxy module and the first proxy module using a heartbeat detection mechanism during the session; and automatically restore the communication connection between the target second proxy module and the first proxy module when it is detected that the target second proxy module is disconnected from the first proxy module.

10. The system according to claim 1, wherein: The terminal is a card reader, and the server is a cloud card reader server.

11. A method for processing TCP data across public and private networks, characterized in that: include: Calling a first proxy module on the terminal side to obtain first TCP-based data to be transmitted by the terminal, and encapsulating the first data into second HTTP-based data; calling a distribution management module to determine a target server from a plurality of servers based on a load balancing strategy, transmitting the second data to a target second proxy module on the target server side, and binding the terminal and the target server based on a hash consistency algorithm during the session duration; calling the target second proxy module to parse the first data from the second data, transmitting the first data to the target server, encapsulating the TCP-based third data fed back by the target server into HTTP-based fourth data, and transmitting the fourth data to the first proxy module; The first proxy module is called to parse the third data from the fourth data, and transmit the third data to the terminal.

12. A computer program product, characterized in that include: A computer program, wherein when the computer program is executed by a processor, the method for processing TCP data across public and private networks as claimed in claim 11 is implemented.

13. An electronic device, characterized in that: include: A memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the TCP data processing method across public and private networks according to claim 11 through the computer program.

Images