Network proxy method based on QUIC protocol
By combining the QUIC and Trojan protocols, the problems of connection latency, high packet loss, and security of traditional network proxies in complex network environments are solved, achieving fast, stable, and secure data transmission.
Patent Information
- Application Number
- CN202511580814.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-10-31
- Publication Date
- 2026-02-06
AI Technical Summary
Existing traditional TCP or UDP-based network proxy methods exhibit problems such as high connection latency, poor packet loss resistance, easy connection interruption, and insufficient security in high-latency, high-packet-loss, or frequently switching network environments.
An encrypted transmission channel is established using the QUIC protocol, network requests are encapsulated using the Trojan protocol, and connections are managed through the QUIC Session class. Combined with a fully asynchronous communication architecture and forward error correction mechanism, fast handshake, multiplexing, and end-to-end encryption are achieved.
It significantly reduces connection establishment time, improves data transmission efficiency and stability, ensures communication continuity, provides strong data security, and is suitable for complex network environments.
Smart Images
Figure CN121486440A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of computer network technology, specifically to a network proxy method based on the QUIC protocol. Background Technology
[0002] Network proxy technology, as a common network communication middleware, is widely used in scenarios such as data forwarding, access control, privacy protection, and cross-border network acceleration. Currently, most mainstream network proxy solutions are implemented based on the traditional Transmission Control Protocol (TCP) or User Datagram Protocol (UDP). However, with the increasing complexity of network environments, especially under weak network conditions with high latency, high packet loss, or frequent handover, these proxy methods based on traditional protocols have exposed many limitations in performance and security.
[0003] Specifically, the existing technology mainly has the following problems:
[0004] 1. In high-latency networks (such as satellite communications and networks in remote areas), the TCP protocol requires 1–3 RTTs to complete the handshake, which significantly increases the connection establishment time;
[0005] 2. In high packet loss environments (such as public Wi-Fi or mobile networks), TCP head-of-line blocking causes the loss of a single packet to block the entire data stream, significantly reducing transmission efficiency;
[0006] 3. In networks with frequent switching, TCP connections rely on the four-tuple identifier. Any change in any parameter will cause the connection to be interrupted, affecting the continuity of communication.
[0007] 4. In special networks such as campus networks, traditional transmission protocols lack built-in encryption mechanisms, making data susceptible to parsing and interference from intermediate nodes, resulting in insufficient security and stability.
[0008] To address the above problems, this invention proposes a novel proxy method based on the QUIC protocol. QUIC is a modern transport protocol based on UDP, which features fast handshake (0-RTT / 1-RTT), multiplexing, native encryption, connection migration, and forward error correction, and can significantly improve the performance and user experience of proxy services under harsh network conditions. Summary of the Invention
[0009] The purpose of this invention is to provide a network proxy method based on the QUIC protocol. By establishing an encrypted channel based on QUIC and using the Trojan protocol to uniformly encapsulate and asynchronously transmit local network requests, this invention solves the problems of high connection latency, poor packet loss resistance, easy connection interruption, and insufficient security of traditional proxy technologies in complex network environments.
[0010] This invention is achieved through the following technical solution:
[0011] This invention relates to a network proxy method based on the QUIC protocol, comprising the following steps:
[0012] Establish an encrypted transmission channel based on the QUIC protocol between the client and the proxy server.
[0013] Intercept the client's local network requests and redirect the network requests to the local proxy service's listening port.
[0014] The local proxy service performs protocol encapsulation processing on the network request to generate a proxy protocol data packet. The protocol encapsulation processing is based on the Trojan proxy protocol, uses a static password for authentication, and fills in the target address and port in the header for TCP proxy requests, or fills in the address as zero for UDP proxy requests to implement FullConeNAT and appends a meta data packet header.
[0015] The encapsulated proxy protocol data packets are asynchronously transmitted to the remote proxy server through the QUIC encrypted transmission channel.
[0016] Furthermore, establishing an encrypted transmission channel based on the QUIC protocol specifically includes using the zero-round-trip time or one-round-trip time handshake mechanism of the QUIC protocol to establish an initial connection with the proxy server.
[0017] Furthermore, establishing an encrypted transmission channel based on the QUIC protocol further includes creating a corresponding QUIC connection for each independent TCP or UDP network connection, and creating an independent QUIC stream within that QUIC connection.
[0018] Furthermore, each QUIC connection is encapsulated and managed through the QUIC Session class. The QUIC Session class provides a unified connection management interface and automatically reclaims the QUIC connection resources it is bound to when the network connection is terminated.
[0019] Furthermore, intercepting and redirecting network requests involves using Windows filtering platform or layered service provider technology to transparently redirect network traffic to a local port listened to by the ASIO library.
[0020] Furthermore, data processing and transmission are implemented based on a fully asynchronous communication architecture, including using the ASIO library to asynchronously process the reception and transmission of local data, using the MSQUIC library to asynchronously process the remote transmission of QUIC protocol data, and using an event callback mechanism to achieve bidirectional asynchronous data transfer between ASIO and MSQUIC.
[0021] Furthermore, the built-in encryption of the QUIC protocol is implemented based on the TLS 1.3 standard.
[0022] Furthermore, the method supports connection migration functionality. When the client's network environment changes, resulting in a change in IP address, the connection identifier of the QUIC protocol is used to maintain the encrypted transmission channel from opening.
[0023] Furthermore, when transmitting data via the QUIC protocol, a forward error correction mechanism is enabled to improve transmission robustness in high packet loss environments.
[0024] The present invention has the following beneficial effects:
[0025] 1. This invention establishes an initial connection with a proxy server by utilizing the 0-RTT or 1-RTT handshake mechanism of the QUIC protocol. Compared with the number of RTTs required by traditional TCP proxies, it significantly reduces the connection establishment time, making it particularly suitable for high-latency network environments and enabling users to initiate requests and obtain responses more quickly.
[0026] 2. This invention creates a corresponding QUIC connection and an independent QUIC stream for each independent TCP or UDP network connection, and utilizes the multiplexing feature of the QUIC protocol to avoid the problem of the entire connection being blocked due to the loss of a single data packet. This significantly improves data transmission throughput and overall efficiency in high packet loss networks. By supporting the connection migration function of the QUIC protocol, when the client's network environment changes and the IP address changes, the encrypted transmission channel can be maintained without interruption using the connection identifier, ensuring the continuity and stability of the proxy session and improving the user experience in mobile scenarios.
[0027] 3. By adopting a fully asynchronous communication architecture and encapsulating and managing each connection through the QUICSession class, this invention achieves efficient utilization and automatic recycling of system resources, ensuring the high performance and stability of the proxy service in high-concurrency scenarios, while reducing the risk of resource leakage.
[0028] 4. This invention provides strong confidentiality and integrity protection for all proxy data through end-to-end encryption based on the TLS 1.3 standard built into the QUIC protocol. It effectively prevents data from being eavesdropped, tampered with, or hijacked by intermediate nodes during transmission. It is especially suitable for public network environments with poor security, such as campus networks. By enabling forward error correction mechanism in QUIC protocol transmission, some lost data packets can be recovered without waiting for retransmission, thereby further improving the transmission success rate and robustness in high packet loss environments.
[0029] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description
[0030] Figure 1Here is a flowchart of the network proxy method workflow;
[0031] Figure 2 This is a protocol encapsulation diagram of the present invention;
[0032] Figure 3 This is a diagram illustrating the asynchronous processing of the present invention;
[0033] Figure 4 This is a flowchart of the connection migration process of the present invention. Detailed Implementation
[0034] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0035] Please see Figure 1-4 This invention provides a technical solution: a network proxy method based on the QUIC protocol, comprising the following steps:
[0036] Establish an encrypted transmission channel based on the QUIC protocol between the client and the proxy server. Specifically, establishing an encrypted transmission channel based on the QUIC protocol includes using the zero round-trip time or one round-trip time handshake mechanism of the QUIC protocol to establish an initial connection with the proxy server.
[0037] During the initial startup of the proxy client, the MSQUIC library is dynamically loaded as the implementation of the QUIC protocol stack, and the OpenSSL library is linked to provide TLS 1.3 encryption support. The client is configured with the address and authentication information of the remote proxy server. When a proxy channel needs to be established, the client initiates a QUIC connection asynchronously through the API provided by the MSQUIC library. During this process, the characteristics of QUIC are fully utilized, and 0-RTT (zero round-trip time) or 1-RTT (one round-trip time) handshake mode is used as much as possible to minimize connection establishment latency. Successfully established QUIC connections automatically have TLS 1.3 level end-to-end encryption.
[0038] The MSQUIC library is dynamically loaded when the client starts, and OpenSSL is linked to support TLS 1.3.
[0039] During the QUIC connection establishment process, a 0-RTT handshake is attempted first, and if it fails, it is downgraded to a 1-RTT handshake.
[0040] QUIC connection parameter configuration includes: maximum flow rate, congestion control algorithm (such as CUBIC), FEC switch, etc.
[0041] The system intercepts local network requests from clients and redirects these requests to the local proxy service listening port. This interception and redirection is achieved through Windows filtering platform or layered service provider technology, transparently redirecting network traffic to the local port listened to by the ASIO library. Data processing and transmission are implemented based on a fully asynchronous communication architecture, including asynchronously processing the reception and transmission of local data using the ASIO library, asynchronously processing remote transmission of QUIC protocol data using the MSQUIC library, and realizing bidirectional asynchronous data transfer between ASIO and MSQUIC through an event callback mechanism.
[0042] The client software precisely installs filtering rules in the kernel network stack by calling a series of APIs of the Windows Filtering Platform (WFP). For example, an "outbound blocking" filter can be set, but its conditions are set as follows: when the target IP is not a local area network address and is not the proxy server's own IP, a redirection action is triggered, redirecting the data packet to port 10808 of the local loopback address (127.0.0.1). This port is asynchronously listened to by a local proxy service built based on the ASIO (Asynchronous I / O) library. This process is completely transparent to the application and does not require any modification to the application's configuration.
[0043] The protocol encapsulation process is performed to generate a proxy protocol data packet. The protocol encapsulation process is based on the Trojan proxy protocol, uses a static password for authentication, and fills in the target address and port in the header for TCP proxy requests, or fills in the address as zero for UDP proxy requests to implement FullConeNAT and attaches a meta data packet header. Each QUIC connection is encapsulated and managed through the QUICSession class. The QUICSession class provides a unified connection management interface and automatically reclaims the QUIC connection resources it is bound to when the network connection is terminated.
[0044] The ASIO service asynchronously accepts new TCP connections or receives UDP datagrams on port 10808. For each accepted TCP connection or received UDP datagram, the encapsulation process begins:
[0045] Calculate the hash value (such as SHA224) of the static password to generate a fixed-length authentication message.
[0046] Determine the request type: TCP request: Construct a Trojan protocol frame. The frame header contains: a 1-byte protocol version number, a 1-byte instruction type (0x01 represents a TCP connection), a 2-byte destination port (network byte order), a 4-byte or 16-byte destination IPv4 or IPv6 address, followed by the generated authentication information, and finally the raw TCP payload data.
[0047] UDP Request: Constructs a special Trojan protocol frame. The frame header contains: a 1-byte protocol version number, a 1-byte instruction type (0x03 represents UDP association), a 2-byte destination port (set to 0), a 4-byte or 16-byte destination IP address (set to 0), followed by authentication information. Immediately after the authentication information and before the application data, a UDP association request metadata header is inserted, containing the destination address and port. The original UDP data is appended as the payload.
[0048] The assembled complete Trojan protocol data packet is placed into the send buffer and awaits transmission.
[0049] To achieve precise mapping and asynchronous transmission of QUIC connections and streams, the encapsulated proxy protocol data packets are asynchronously transmitted to a remote proxy server through the QUIC encrypted transmission channel. Establishing an encrypted transmission channel based on the QUIC protocol further includes creating a corresponding QUIC connection for each independent TCP or UDP network connection and creating an independent QUIC stream within that QUIC connection. The built-in encryption of the QUIC protocol is implemented based on the TLS 1.3 standard.
[0050] For each local session (a TCP connection or a UDP 5-tuple) processed during protocol encapsulation, the proxy core instantiates a QUICSession object, which performs the following operations:
[0051] Check if there is a reusable QUIC connection to the proxy server. To ensure isolation, it is preferable to create a new independent QUIC connection for each session and initiate the connection asynchronously via the MSQUICAPI.
[0052] Once a QUIC connection is successfully established, a new, independent QUIC stream is immediately created on that connection.
[0053] The Trojan protocol data packet, which has been encapsulated during the protocol encapsulation process, is sent out asynchronously through this dedicated QUIC stream. At the same time, the system listens for incoming data on this QUIC stream. When data is received from the server, the QUICSession object receives a callback, which then parses the data (if it is UDP, it needs to handle the splitting and reassembly of multiple data packets on the same stream), strips off the Trojan protocol header, and extracts the original application data.
[0054] The ASIO library allows you to asynchronously write raw application data back to the corresponding local TCP connection or UDP socket.
[0055] Implementing lifecycle management for connections and resources, the QUICSession object plays the role of a manager throughout the entire session lifecycle:
[0056] It monitors the status of the local ASIO connection. When ASIO notifies that the local connection has been closed (by receiving EOF or an error), QUICSession immediately begins the cleanup process: first, it closes the corresponding QUIC stream, and then decides whether to close the QUIC connection (if it is the last stream) depending on the situation.
[0057] Similarly, if a QUIC connection or stream is unexpectedly disconnected due to network issues, QUICSession will notify ASIO to close the corresponding local connection.
[0058] During the cleanup process, QUICSession ensures that all related memory buffers, event handles, QUIC stream handles, and connection handles are properly released, and then removes itself from the management list to await garbage collection.
[0059] The method supports connection migration functionality. When the client's network environment changes, causing the IP address to change, the connection identifier of the QUIC protocol is used to maintain the encrypted transmission channel from opening. When transmitting data via the QUIC protocol, a forward error correction mechanism is enabled to improve transmission robustness in high packet loss environments.
[0060] like Figure 2 As shown, the protocol encapsulation diagram involves two main protocols:
[0061] Trojan proxy protocol:
[0062] TCP Encapsulation: Enter the target address and port.
[0063] UDP encapsulation: Address filled with zeros + metadata header.
[0064] Function: To uniformly handle TCP / UDP proxy, perform authentication and data encapsulation.
[0065] QUIC transport protocol:
[0066] Based on UDP: Provides reliable transmission.
[0067] Built-in TLS 1.3: end-to-end encryption.
[0068] Multiplexing: Avoids head-of-line congestion.
[0069] like Figure 3 As shown, asynchronous processing can handle multiple tasks simultaneously without waiting for one to complete before starting the next, greatly improving efficiency and performance. The principle of asynchronous processing is as follows:
[0070] Sending direction:
[0071] ASIO library: Asynchronously receives data from local applications.
[0072] QUIC library: Sends data asynchronously to a remote server.
[0073] Non-blocking: Processing can continue without waiting for a response.
[0074] Receiving direction:
[0075] QUIC library: Asynchronously receives remote data.
[0076] ASIO library: Asynchronously send back to the local application.
[0077] Event-driven: Processing is triggered via callback mechanisms.
[0078] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.
Claims
1. A network proxy method based on the QUIC protocol, characterized in that, Includes the following steps: Establish an encrypted transmission channel based on the QUIC protocol between the client and the proxy server; Intercept the client's local network requests and redirect the network requests to the local proxy service's listening port; The local proxy service performs protocol encapsulation processing on the network request to generate a proxy protocol data packet. The protocol encapsulation processing is based on the Trojan proxy protocol, uses a static password for authentication, and fills in the target address and port in the header for TCP proxy requests, or fills in the address as zero for UDP proxy requests to implement FullConeNAT and appends the meta data packet header. The encapsulated proxy protocol data packets are asynchronously transmitted to the remote proxy server through the QUIC encrypted transmission channel.
2. The network proxy method based on the QUIC protocol according to claim 1, characterized in that, Establishing an encrypted transmission channel based on the QUIC protocol specifically involves using the zero-round-trip time or one-round-trip time handshake mechanism of the QUIC protocol to establish an initial connection with the proxy server.
3. The network proxy method based on the QUIC protocol according to claim 1, characterized in that, Establishing an encrypted transmission channel based on the QUIC protocol further includes creating a corresponding QUIC connection for each independent TCP or UDP network connection, and creating an independent QUIC stream within that QUIC connection.
4. The network proxy method based on the QUIC protocol according to claim 3, characterized in that, Each QUIC connection is encapsulated and managed through the QUICSession class, which provides a unified connection management interface and automatically reclaims the QUIC connection resources it is bound to when the network connection is terminated.
5. A network proxy method based on the QUIC protocol according to claim 1, characterized in that, Intercepting and redirecting network requests is achieved by using Windows filtering platform or layered service provider technology to transparently redirect network traffic to a local port listened to by the ASIO library.
6. A network proxy method based on the QUIC protocol according to claim 1, characterized in that, Data processing and transmission are implemented based on a fully asynchronous communication architecture, including using the ASIO library to asynchronously process the reception and transmission of local data, using the MSQUIC library to asynchronously process the remote transmission of QUIC protocol data, and using an event callback mechanism to achieve bidirectional asynchronous data transfer between ASIO and MSQUIC.
7. A network proxy method based on the QUIC protocol according to claim 1, characterized in that, The built-in encryption of the QUIC protocol is implemented based on the TLS 1.3 standard.
8. A network proxy method based on the QUIC protocol according to claim 1, characterized in that, The method supports connection migration functionality. When the client's network environment changes, resulting in a change in the IP address, the connection identifier of the QUIC protocol is used to maintain the encrypted transmission channel from opening.
9. A network proxy method based on the QUIC protocol according to claim 1, characterized in that, When transmitting data via the QUIC protocol, a forward error correction mechanism is enabled to improve transmission robustness in high packet loss environments.