A cloud desktop communication method and system based on a relay server

Abstract

The application provides a cloud desktop communication method and system based on a relay server, and the method comprises the following steps: a client sends a first IP data packet to the relay server through a public network; the first IP data packet comprises a first IP packet header and a first data part; the first data part comprises an intranet IP address of a cloud desktop; the relay server receives the first IP data packet, modifies a destination address in the first IP packet header into the intranet IP address of the cloud desktop, and sends the modified first IP data packet to the corresponding cloud desktop. The relay server directly modifies the destination address of the IP data packet to realize data forwarding, thereby saving public network addresses, reducing network delay, and improving network transmission speed.

Description

Technical Field

[0001] This invention relates to the field of cloud desktop technology, and in particular to a cloud desktop communication method and system based on a relay server. Background Technology

[0002] Cloud desktops are an application of cloud computing technology. They utilize virtualization technology to install virtualization software on servers located in data center server rooms, creating multiple virtual machines with relatively independent CPU and memory resources. Currently, with the rapid development of cloud desktop technology and improved security, more and more enterprises are using cloud desktops for remote work. Network transmission is a crucial component of cloud desktops; therefore, how to achieve faster and smoother network transmission has become an issue that cannot be ignored.

[0003] The ideal model for traditional industries is point-to-point transmission, where the network of the computing node's server room directly connects to the user's (client's) private network without any intermediaries. However, due to the unique environment of the current internet (the scarcity of public IP resources and network security challenges), the security levels of routers used by typical enterprises or individuals are relatively high, which may cause general point-to-point transmission links to fail.

[0004] For the reasons mentioned above, many cloud desktop service providers use rate limiting and relay methods to support network transmission. However, most current relay solutions are based on IPTable. IPTable needs to receive data packets before forwarding them, which involves data copying and other operations, increasing network transmission time costs by 30%-80%, thus increasing network latency for cloud desktops. In addition, the concurrency and stability of IPTable are not very good, making it difficult to meet the application needs of large-scale cloud desktops. Summary of the Invention

[0005] To address the aforementioned technical problems, this invention provides a cloud desktop communication method and system based on a relay server. The relay server achieves data forwarding by directly modifying the destination address of IP data packets, thereby saving public network addresses, reducing network latency, and improving network transmission speed.

[0006] The present invention adopts the following technical solution:

[0007] On the one hand, a cloud desktop communication method based on a relay server includes:

[0008] S101, the client sends a first IP data packet to the relay server via the public network; the first IP data packet includes a first IP header and a first data portion; the first data portion includes the internal network IP address of the cloud desktop;

[0009] S102, the transit server receives the first IP data packet, modifies the destination address in the first IP packet header into the intranet IP address of the cloud desktop, and sends the modified first IP data packet to the corresponding cloud desktop.

[0010] Preferably, after S102, the method further comprises:

[0011] S103, the cloud desktop sends a second IP data packet to the transit server through the intranet; the second IP data packet comprises a second IP packet header and a second data part; the second data part comprises the public IP address of the client;

[0012] S104, the transit server receives the second IP data packet, modifies the destination address in the second IP packet header into the public IP address of the client, and sends the modified second IP data packet to the corresponding client.

[0013] Preferably, in S102, before the transit server modifies the destination address in the first IP packet header into the intranet IP address of the cloud desktop, the method further comprises:

[0014] determining whether the intranet IP address of the cloud desktop is within the preset range of intranet IP addresses of the cloud desktop or whether the intranet IP address of the cloud desktop belongs to one of the preset intranet IP addresses of the cloud desktop, and if so, modifying the destination address in the first IP packet header into the intranet IP address of the cloud desktop; if not, discarding the first IP data packet or prompting an error.

[0015] Preferably, before S101, the method further comprises:

[0016] the client sends a third IP data packet of a connection request for the cloud desktop to the signaling server through the public network;

[0017] the signaling server receives the third IP data packet and sends a fourth IP data packet comprising the public IP address of the client to the cloud desktop through the intranet;

[0018] the cloud desktop receives the fourth IP data packet, and sends a fifth IP data packet comprising the intranet IP address of the cloud desktop and the public IP address of the transit server to the signaling server through the intranet;

[0019] the signaling server receives the fifth IP data packet and sends it to the client through the extranet.

[0020] Preferably, the transit server is a Linux server provided with a public IP address, and the transit server and at least one cloud desktop form a cluster network.

[0021] Preferably, the kernel of the relay server is provided with a probe, and when an IP data packet reaches the kernel, the probe callback is triggered to modify the destination address of the IP data packet.

[0022] Preferably, the first data part further comprises a cloud desktop MAC address and a cloud desktop port, and the cloud desktop MAC address, the intranet IP address of the cloud desktop and the cloud desktop port are sequentially arranged.

[0023] In another aspect, a cloud desktop communication system based on a relay server comprises a client, a relay server and at least one cloud desktop, wherein the relay server is connected to the client and the cloud desktop respectively.

[0024] The client is configured to send a first IP data packet to the relay server through a public network, wherein the first IP data packet comprises a first IP packet header and a first data part, and the first data part comprises an intranet IP address of the cloud desktop.

[0025] The relay server is configured to receive the first IP data packet, modify the destination address in the first IP packet header into the intranet IP address of the cloud desktop, and send the modified first IP data packet to the corresponding cloud desktop.

[0026] Preferably, the cloud desktop is configured to send a second IP data packet to the relay server through an intranet, wherein the second IP data packet comprises a second IP packet header and a second data part, and the second data part comprises a public IP address of the client.

[0027] The relay server is further configured to receive the second IP data packet, modify the destination address in the second IP packet header into the public IP address of the client, and send the modified second IP data packet to the corresponding client.

[0028] Preferably, the cloud desktop communication system based on the relay server further comprises a signaling server connected to the client and the cloud desktop respectively, wherein the client sends a third IP data packet of a connection cloud desktop request to the signaling server through a public network, the signaling server receives the third IP data packet and sends a fourth IP data packet comprising the public IP address of the client to the cloud desktop through an intranet, the cloud desktop receives the fourth IP data packet and sends a fifth IP data packet comprising the intranet IP address of the cloud desktop and the public IP address of the relay server to the signaling server through the intranet, and the signaling server receives the fifth IP data packet and sends it to the client through an extranet.

[0029] The present application has the following advantages:

[0030] (1) When the relay server of the present invention receives the data packet sent by the client or cloud desktop, it directly modifies the destination address of the IP data packet to achieve data forwarding, that is, no new connection is generated. Therefore, it can reduce network latency, improve network transmission speed, and will not cause additional performance loss to the relay server.

[0031] (2) The kernel of the relay server of the present invention is equipped with a probe. When an IP data packet arrives at the kernel, the probe callback is triggered to modify the destination address of the IP data packet. Through the probe technology, the IP data packet is modified at the kernel layer without entering the application layer, which reduces the overhead of system calls.

[0032] (3) The relay server of the present invention forms a cluster network with the cloud desktop, that is, it transmits with the cloud desktop inside the cluster through the intranet. Therefore, it can forward with extremely low network transmission time and cost, and the loss is controllable. In addition, since the relay server and the cloud desktop communicate through the intranet, only the relay server needs a public IP address, thus saving public IP addresses.

[0033] (4) Before using the relay server for relaying, the present invention will first interact with the client through the signaling server to exchange IP addresses and ports, so that the relay server can close all ports to the outside world and only open specific ports when accessed by IP data packets from specific sources. Therefore, it fundamentally blocks attacks from unauthenticated external networks, ensures the security of the relay server, and avoids users having to bear additional security risks when using cloud desktops.

[0034] (5) This invention is easy to operate and maintain, saving enterprises a lot of error costs.

[0035] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Attached Figure Description

[0036] Figure 1 The flowchart of the cloud desktop communication method based on a relay server according to an embodiment of the present invention is as follows. Figure 1 (Initiated by the client);

[0037] Figure 2 This is a schematic diagram of an IP data packet according to an embodiment of the present invention; wherein, (a) represents the IP packet header and (b) represents the data portion;

[0038] Figure 3 The flowchart of the cloud desktop communication method based on a relay server according to an embodiment of the present invention is as follows.Figure 2 (client initiates and cloud desktop responds);

[0039] Figure 4 A complete flowchart of the cloud desktop communication method based on a relay server of an embodiment of the present application (including the IP address interaction part);

[0040] Figure 5 A test result diagram of an embodiment of the present application;

[0041] Figure 6 A structural diagram of a cloud desktop communication system based on a relay server of an embodiment of the present application Figure 1 (not including a signaling server);

[0042] Figure 7 A structural diagram of a cloud desktop communication system based on a relay server of an embodiment of the present application Figure 2 (including a signaling server). DETAILED DESCRIPTION

[0043] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application; obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments of the present application, and all other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present application without creative labor fall within the scope of protection of the present application.

[0044] In the description of the present application, it should be noted that the terms “comprise”, “contain” or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or includes elements inherent to such process, method, article or device. Without more limitations, the element defined by the statement “comprises a…” does not exclude the presence of another identical element in the process, method, article or device comprising the element.

[0045] In the description of the present application, it should be noted that, unless otherwise explicitly specified and limited, the step identifiers S101, S102, S103, etc. are only used for convenient description, and do not represent the execution sequence, and the corresponding execution sequence can be adjusted as needed.

[0046] Referring to Figure 1 , the cloud desktop communication method based on a relay server of the present application comprises:

[0047] S101, the client sends a first IP data packet to the relay server via the public network; the first IP data packet includes a first IP header and a first data portion; the first data portion includes the internal network IP address of the cloud desktop;

[0048] S102, the relay server receives the first IP data packet, modifies the destination address in the header of the first IP data packet to the internal IP address of the cloud desktop, and sends the modified first IP data packet to the corresponding cloud desktop.

[0049] For details, see the format of the first IP header. Figure 2 As shown in (a), including the source address and destination address, the format of the first data portion is shown in [reference]. Figure 2 As shown in (b), this includes the MAC address of the cloud desktop, the IP address (internal network IP address) of the cloud desktop, and the port of the cloud desktop. In S101, in the first IP data packet sent from the public network to the relay server, the source address in the first IP packet header is the client's IP address (public network address), and the destination address in the first IP packet header is the relay server's IP address (public network address). In S102, the relay server modifies the destination address in the first IP packet header to the internal network IP address of the cloud desktop, and at the same time modifies the IP address field of the cloud desktop in the first data portion to the IP address of the relay server. That is, the relay server swaps the IP address of the relay server and the IP address of the cloud desktop, and directly transmits the swapped first IP data packet to the router. The router sends the first IP data packet to the designated cloud desktop according to the destination address of the first IP data packet.

[0050] When a relay server receives a data packet from a client or cloud desktop, it directly modifies the destination address of the IP data packet to achieve data forwarding. This means that no new connection is created, which reduces network latency, improves network transmission speed, and does not cause additional performance loss to the relay server.

[0051] In this embodiment, the relay server is a highly secure and protected Linux server with a public IP address, and the relay server forms a cluster network with at least one cloud desktop.

[0052] Specifically, the number of cloud desktops that form a cluster network with a relay server depends on the upper limit of traffic. For example, if the network bandwidth is 10G, then theoretically a relay server can support 10000 / 20 = 500 cloud desktops with a bandwidth of 20M. In normal circumstances, redundancy design is implemented, so the actual number of cloud desktops is lower than the theoretical value.

[0053] The relay server and the cloud desktop form a cluster network, that is, the relay server and the cloud desktop in the cluster transmit data through an internal network, so that the relay server can forward the data at a very low network transmission time and cost, and the loss is controllable. In addition, since the relay server and the cloud desktop communicate through the internal network, only the relay server needs a public network IP, so the public network address is saved

[0054] Further, the kernel of the Linux relay server is provided with a probe, and when an IP data packet arrives at the kernel, the probe callback is triggered to modify the destination address of the IP data packet.

[0055] Specifically, the Linux kernel provides an XDP framework. XDP stands for eXpress Data Path. XDP is an eBPF hook in the Linux network processing flow, which can mount an eBPF program and process network packets when they arrive at the network card driver layer.

[0056] The relay server modifies the destination address of the IP data packet through the probe callback triggered by the probe when the IP data packet arrives at the kernel, so that the IP data packet is modified in the kernel layer without entering the application layer, thereby reducing the overhead of system calls.

[0057] Further, before the S102, the relay server modifies the destination address in the first IP packet header to the internal network IP address of the cloud desktop, further comprising:

[0058] determining whether the internal network IP address of the cloud desktop is within a preset range of internal network IP addresses of the cloud desktop or whether the internal network IP address of the cloud desktop belongs to one of the preset internal network IP addresses of the cloud desktop, and if so, modifying the destination address in the first IP packet header to the internal network IP address of the cloud desktop; and if not, discarding the first IP data packet or prompting an error.

[0059] Specifically, as shown in (b) of Figure 3 The present embodiment detects the IP addresses of the 6th to 9th bytes to ensure that they are trusted IP addresses before performing corresponding data processing.

[0060] As shown in Figure 4 In response to the first IP data packet of the client, the S102 further comprises:

[0061] S103, the cloud desktop sends a second IP data packet to the relay server through an internal network; the second IP data packet comprises a second IP packet header and a second data part; the second data part comprises a public network IP address of the client.

[0062] S104, the transit server receives the second IP data packet, modifies the destination address in the second IP packet header into the public network IP address of the client, and sends the modified second IP data packet to the corresponding client.

[0063] As above, in S104, the transit server modifies the destination address in the second IP packet header into the public network IP address of the client, and modifies the public network IP address field of the client in the second data part into the IP address of the transit server, that is, the transit server reverses the IP address of the transit server and the IP address of the client, and sends the reversed second IP data packet to the corresponding client.

[0064] Referring to Figure 5 In the embodiment, S101 further includes:

[0065] The client sends a third IP data packet for connecting the cloud desktop to the signaling server through the public network;

[0066] The signaling server receives the third IP data packet, and sends a fourth IP data packet including the public network IP address of the client to the cloud desktop through the internal network;

[0067] The cloud desktop receives the fourth IP data packet, and sends a fifth IP data packet including the internal network IP address of the cloud desktop and the public network IP address of the transit server to the signaling server through the internal network;

[0068] The signaling server receives the fifth IP data packet, and sends it to the client through the external network.

[0069] Correspondingly, the signaling server has a public network address, and forms a cluster network with the transit server and the cloud desktop.

[0070] The interaction of IP addresses (transmitting the IP address of the client to the cloud desktop, and transmitting the IP address of the cloud desktop and the IP address of the transit server to the client) is performed by a special signaling server, which can ensure the security of the transit server, and can avoid the user from bearing additional security risks when using the cloud desktop. On the one hand, the signaling server can select a suitable cloud desktop according to the use of the cloud desktop in the cluster network, and on the other hand, the cloud desktop or the central system of the cloud desktop can instruct or request the transit server to open a specific port through interaction with the transit server, and the specific port is only allowed to pass through a specific source network packet, which ensures the security of the transit server.

[0071] Specifically, since the transit server is a node exposed to the public network, if the access port is not closed and managed, it is easy to be exploited by Internet criminals and interfered. It may affect business efficiency, or even directly cause business paralysis. Therefore, the application initiates a business process from inside to outside. That is, the cloud desktop in the intranet instructs the transit server to open a specific port, and the transit server controls the specific port to only allow specific source network packets, thereby fundamentally blocking unauthenticated network attacks from the outside, thereby ensuring the security of the transit server.

[0072] Referring to Figure 5 Fig. 1 shows the use of two computers to directly test the comparison of test data. Specifically, one computer B is used as a transit server, and the other computer A is used as a client and a cloud desktop communication node. That is, the data packet of computer A is sent to computer B, which is a transit node, and then the destination address in the IP packet header is modified and retransmitted to computer A to complete a transmission loop. Direct connection of the two computers can exclude network environment interference and test only the performance of the transit function to highlight the low latency feature of the application.

[0073] Figure 5 In the table, the first column "local test" means that the data packet is sent only within the local machine and does not go out of the local machine. The performance of the network framework software is calculated. The first column "IPTable" refers to the communication method of the prior art, and the first column "XDP" refers to the communication method of the application. The communication method of the prior art IPTable and the communication method of the application XDP are out of the local A and transmitted back by the transit node (computer B). In addition, the numbers in the brackets in the first column represent the number of network packets per unit time (one second), such as "local test (100)", which means that computer A sends 100 network packets per second.

[0074] From Figure 6 It can be seen that the transit method of the application has a highest 30% to 50% improvement compared with the prior art transit method.

[0075] Referring to Figure 7 Fig. 1 shows the architecture of the cloud desktop communication method based on the transit server applied to the embodiment of the application. Specifically, a cloud desktop communication system based on a transit server includes a client 50, a transit server 51, and at least one cloud desktop 52. The transit server 51 is connected to the client 50 and the cloud desktop 52 respectively.

[0076] The client 50 is configured to send a first IP data packet to the transit server 51 through a public network. The first IP data packet includes a first IP packet header and a first data part. The first data part includes an intranet IP address of the cloud desktop 52.

[0077] The transit server 51 is configured to receive the first IP data packet, modify the destination address in the first IP packet header into the intranet IP address of the cloud desktop 52, and send the modified first IP data packet to the corresponding cloud desktop 52.

[0078] Further, the cloud desktop 52 is configured to send a second IP data packet to the transit server 51 through the intranet; the second IP data packet comprises a second IP packet header and a second data part; the second data part comprises the public IP address of the client 50.

[0079] The transit server 51 is further configured to receive the second IP data packet, modify the destination address in the second IP packet header into the public IP address of the client 50, and send the modified second IP data packet to the corresponding client 50.

[0080] Referring to ​ As shown in the figure, the cloud desktop 52 communication system based on the transit server 51 further comprises a signaling server 53, which is connected with the client 50 and the cloud desktop 52 respectively; the client 50 sends a third IP data packet of the request of connecting the cloud desktop 52 to the signaling server 53 through the public network; the signaling server 53 receives the third IP data packet, and sends a fourth IP data packet comprising the public IP address of the client 50 to the cloud desktop 52 through the intranet; the cloud desktop 52 receives the fourth IP data packet, and sends a fifth IP data packet comprising the intranet IP address of the cloud desktop 52 and the public IP address of the transit server 51 to the signaling server 53 through the intranet; the signaling server 53 receives the fifth IP data packet, and sends it to the client 50 through the public network.

[0081] The above merely describes the preferred embodiments of the present application; however, the protection scope of the present application is not limited to this. Any person skilled in the art, according to the technical solution and the improved concept of the present application, makes equivalent replacement or change within the technical range disclosed by the present application, which should be covered in the protection scope of the present application.

Claims

1. A cloud desktop communication method based on a relay server, characterized in that, include: S101, the client sends the first IP data packet to the relay server via the public network; The first IP data packet includes a first IP header and a first data portion; the first data portion includes the internal network IP address of the cloud desktop; S102, the relay server receives the first IP data packet, modifies the destination address in the header of the first IP data packet to the internal IP address of the cloud desktop, and sends the modified first IP data packet to the corresponding cloud desktop; Before S101, the following is also included: The client sends a third-party IP datagram requesting a connection to the cloud desktop to the signaling server via the public network; The signaling server receives the third IP data packet and sends a fourth IP data packet, including the client's public IP address, to the cloud desktop via the intranet; The cloud desktop receives the fourth IP data packet and sends a fifth IP data packet, including the cloud desktop's internal IP address and the relay server's public IP address, to the signaling server via the intranet. The signaling server receives the fifth IP data packet and sends it to the client via the external network.

2. The cloud desktop communication method based on a relay server according to claim 1, characterized in that, Following S102, the following is also included: S103, the cloud desktop sends a second IP data packet to the relay server via the intranet; the second IP data packet includes a second IP header and a second data portion; the second data portion includes the client's public IP address; S104, the relay server receives the second IP data packet, modifies the destination address in the header of the second IP data packet to the public IP address of the client, and sends the modified second IP data packet to the corresponding client.

3. The cloud desktop communication method based on a relay server according to claim 1, characterized in that, In step S102, before the relay server modifies the destination address in the first IP packet header to the internal network IP address of the cloud desktop, the following steps are also included: Determine whether the cloud desktop's internal network IP address is within the range of preset cloud desktop internal network IP addresses or whether the cloud desktop's internal network IP address belongs to one of the preset cloud desktop internal network IP addresses. If yes, modify the destination address in the first IP packet header to the cloud desktop's internal network IP address; otherwise, discard the first IP data packet or display an error message.

4. The cloud desktop communication method based on a relay server according to claim 1, characterized in that, The relay server is a Linux server with a public IP address, and the relay server forms a cluster network with at least one cloud desktop.

5. The cloud desktop communication method based on a relay server according to claim 1, characterized in that, The kernel of the relay server is equipped with a probe. When an IP data packet arrives at the kernel, the probe callback is triggered to modify the destination address of the IP data packet.

6. The cloud desktop communication method based on a relay server according to claim 1, characterized in that, The first data section also includes the cloud desktop's MAC address and port, with the cloud desktop's MAC address, internal IP address, and port set sequentially.

7. A cloud desktop communication system based on a relay server, characterized in that, It includes a client, a relay server, a signaling server, and at least one cloud desktop; the relay server is connected to the client and the cloud desktop respectively; The client is used to send a first IP data packet to the relay server via the public network; The first IP data packet includes a first IP header and a first data portion; the first data portion includes the internal network IP address of the cloud desktop; The relay server is used to receive the first IP data packet, modify the destination address in the header of the first IP data packet to the internal IP address of the cloud desktop, and send the modified first IP data packet to the corresponding cloud desktop. The signaling server is connected to both the client and the cloud desktop; the client sends a third-party IP data packet requesting connection to the cloud desktop to the signaling server via the public network. The signaling server receives the third IP data packet and sends a fourth IP data packet, including the client's public IP address, to the cloud desktop via the intranet; The cloud desktop receives the fourth IP data packet and sends a fifth IP data packet, including the cloud desktop's internal IP address and the relay server's public IP address, to the signaling server via the intranet; the signaling server receives the fifth IP data packet and sends it to the client via the external network.

8. The cloud desktop communication system based on a relay server according to claim 7, characterized in that: The cloud desktop is used to send a second IP data packet to a relay server via the intranet; the second IP data packet includes a second IP header and a second data portion; the second data portion includes the client's public IP address; The relay server is also used to receive the second IP data packet, modify the destination address in the header of the second IP data packet to the public IP address of the client, and send the modified second IP data packet to the corresponding client.

Images