Data transmission method, device, equipment and medium based on dual one-way optical shutter system

Abstract

The embodiment of the present invention provides a data transmission method, device, equipment and medium based on a dual one-way optical gate system, the method comprising: when the first external network side host receives the transmission control protocol TCP session data, the TCP session data is extracted to obtain metadata in the TCP session data; the first external network side host sends the metadata to the first internal network side host through the first optical gate based on the pre-created first session; the first external network side host receives the confirmation number sent by the first internal network side host via the second external network side host and the second internal network side host, the confirmation number is used to indicate that the transmission control protocol TCP session data has been received by the first internal network side host. The embodiment of the present invention realizes reliable data transmission in a dual one-way optical gate environment.

Description

Technical Field

[0001] The present invention relates to the technical field of cross-domain data exchange, and in particular to a data transmission method, device, equipment and medium based on a dual one-way optical gate system. Background Art

[0002] The one-way optical gate data import device (also known as the one-way optical gate) is deployed between two different security domains. It constructs a unique channel for one-way data transmission through optical transmission to realize one-way data import. Only data allowed by the security policy can pass through. At the same time, there is no transmission and feedback of task data in the opposite direction. It is a special product to ensure secure data exchange between networks with different security levels. It can fully meet the needs of users such as government confidential networks, military industry, and electricity for one-way import of data across networks in scenarios with high security isolation requirements.

[0003] Currently, there are data transmission technologies such as User Datagram Protocol-based Data Transfer Protocol (UDT), Reliable User Datagram Protocol (RUDP) and Quick User Datagram Protocol Internet Connection (QUIC).

[0004] However, the above data transmission technologies all require a bidirectional switching link support (such as a network gate environment), and the dual one-way optical gate environment can only provide two one-way unreliable connections through two one-way optical gates in opposite directions. Therefore, the above technologies cannot be directly used in the dual one-way optical gate environment. The problem of reliable data transmission in the dual one-way optical gate environment needs to be solved urgently. Summary of the invention

[0005] In view of the problems in the prior art, embodiments of the present invention provide a data transmission method, device, equipment and medium based on a dual one-way optical shutter system.

[0006] Specifically, the embodiment of the present invention provides the following technical solutions:

[0007] In a first aspect, an embodiment of the present invention provides a data transmission method based on a dual one-way optical gate system, wherein the dual one-way optical gate system includes a first external network side host, a first internal network side host, a first optical gate for controlling the first external network side host to transmit data unidirectionally to the first internal network side host, a second external network side host, a second internal network side host, and a second optical gate for controlling the second external network side host to transmit data unidirectionally to the second internal network side host, wherein the method includes:

[0008] When receiving the transmission control protocol TCP session data, the first external network side host extracts the TCP session data to obtain metadata in the TCP session data;

[0009] The first external network-side host sends the metadata to the first internal network-side host through the first optical gate based on the pre-created first session;

[0010] The first external network-side host receives a confirmation number sent by the first internal network-side host via the second external network-side host and the second internal network-side host, wherein the confirmation number is used to indicate that the session data of the transmission control protocol TCP has been received by the first internal network-side host.

[0011] Furthermore, the first external network-side host sends the metadata to the first internal network-side host through the first optical gate based on the pre-created first session, including:

[0012] The first external network side host generates a session data packet based on the metadata, and sends the session data packet to the first internal network side host through the first optical gate via a pre-created first session; the session data packet includes the metadata and a sequence number, and the sequence number is a sequence number of the metadata;

[0013] The first external network-side host receives a confirmation number sent by the first internal network-side host via the second external network-side host and the second internal network-side host, including:

[0014] The first external network host receives a confirmation number set sent by the first internal network host via the second external network host and the second internal network host; the confirmation number set includes a confirmation number corresponding to the session data packet, and the confirmation number is used to indicate that the corresponding session data packet has been received by the first internal network host.

[0015] Further, the first external network side host generates a session data packet based on the metadata, and sends the session data packet to the first internal network side host through the first optical gate through a pre-created first session, including:

[0016] The first external network-side host generates a session data packet of the first session based on the metadata, and stores the session data packet in a first queue; the first queue is a queue including at least one session data packet to be sent;

[0017] The first external network host is triggered by a first timer, and sends the session data in the first queue to the first internal network host in batches through the first optical gate packets through a pre-created first session, and moves the batch-sent session data packets from the first queue to a second queue; the second queue is a queue including at least one sent and unconfirmed session data packet;

[0018] After the first external network-side host receives the confirmation number set sent by the first internal network-side host via the second external network-side host and the second internal network-side host, the method further includes:

[0019] The first external network host matches the confirmation number in the confirmation number set with the serial number of the session data packet in the second queue, and moves the session data packet corresponding to the serial number matching the confirmation number in the second queue to the third queue; the third queue is a queue including at least one sent and confirmed session data packet.

[0020] Furthermore, the method further comprises:

[0021] When the first external network-side host does not include a confirmation number matching the sequence number of the target session data packet in the second queue in the confirmation number set, and the confirmation number set includes a confirmation number matching the sequence number of the next session data packet after the target session data packet in the second queue, detecting whether the next confirmation number set of the confirmation number set includes a confirmation number matching the sequence number of the target session data packet;

[0022] When the first external network-side host does not include a confirmation number matching the sequence number of the target session data packet in N consecutive rounds of confirmation number sets, the first external network-side host retransmits the target session data packet to the first internal network-side host.

[0023] Furthermore, the method further comprises:

[0024] When the first external network host retransmits the target session data packet to the first internal network host and there is no timed-out and unconfirmed session data packet in the second queue, the current congestion threshold ssthresh is determined based on the length of the second queue using formula (1):

[0025]

[0026] Wherein, nxt represents the sequence number of the last session data packet in the second queue, una represents the sequence number of the first session data packet in the second queue, and nxt-una represents the length of the second queue;

[0027] The first external network-side host determines the current congestion window cwnd based on the current congestion threshold ssthresh using formula (2):

[0028] cwnd = ssthresh + 3 (2);

[0029] The first external network-side host executes a TCP congestion avoidance algorithm when the current congestion window is greater than the current congestion threshold.

[0030] Furthermore, the method further comprises:

[0031] When the first external network host retransmits the target session data packet to the first internal network host and there are timed-out and unconfirmed session data packets in the second queue, the current congestion threshold ssthresh is determined based on the current congestion window cwnd using formula (3):

[0032]

[0033] Furthermore, before the first external network host generates a session data packet based on the metadata and sends the session data packet to the first internal network host through the first optical gate via a pre-created first session, the method further includes:

[0034] When receiving the TCP establishment request, the first external network side host converts the TCP establishment request into a first establishment request based on the lightweight user datagram protocol UDPLite protocol, and sends the first establishment request to the first internal network side host through the UDPLite protocol, where the first establishment request is used to request to establish the first session;

[0035] The first external network-side host receives a first establishment response based on the UDPLite protocol sent by the first internal network-side host via the second external network-side host and the second internal network-side host, wherein the first establishment response includes a session number of the first session;

[0036] The first external network-side host sends a second establishment response based on the UDPLite protocol to the first internal network-side host based on the first establishment response, where the second establishment response includes the session number of the first session.

[0037] Furthermore, the method further comprises:

[0038] When the first external network host receives the TCP close request, it generates a session termination message and stores the session termination message at the end of the queue in the first queue; the session termination message is used to release the first session;

[0039] When the first queue does not include any unsent session data packets, the first external network host sends a first closing request to the first internal network host and performs delayed deletion processing on the first session; the first closing request includes the session termination message;

[0040] The first external-network-side host receives a first closing response sent by the first internal-network-side host via the second external-network-side host and the second internal-network-side host, where the first closing response includes a session number of the first session.

[0041] Furthermore, the method further comprises:

[0042] The first external network side host receives a second closing request sent by the first internal network side host via the second external network side host and the second internal network side host, and releases the first session; the second closing request is used to indicate that the first session has expired;

[0043] The first external network-side host sends a second closing response to the first internal network-side host based on the second closing request, where the second closing response includes the session number of the first session.

[0044] Furthermore, the method further comprises at least one of the following:

[0045] When the session has been created or the session has been released, the first external network host is in an initialization state;

[0046] After the first external network side host sends the first establishment request and does not receive the first establishment response, the first external network side host enters a first semi-connected state, in which the first external network side host waits to receive the first establishment response and suspends receiving other data except the first establishment response;

[0047] When the first external network side host sends the second establishment response, the first external network side host enters a session establishment state;

[0048] In the case where the first external network side host has sent the first closing request, the first external network side host enters a first semi-closed state, and in the first semi-closed state, the first external network side host supports sending data cached by the first external network side host, suspends receiving data, and performs delayed deletion processing on the session;

[0049] When the first external network side host is in a first semi-closed state and the first queue does not include session data packets, the first external network side host enters a first closed waiting state;

[0050] When the first external network side host receives the second closing request, the first external network side host enters a second semi-closed state, and in the second semi-closed state, the first external network side host supports sending data cached by the first external network side host, suspends receiving data, and performs delayed deletion processing on the session;

[0051] When the first external network side host is in the second semi-closed state and the first queue does not include session data packets, the first external network side host enters the second closed waiting state and performs delayed deletion processing on the session.

[0052] Furthermore, the second establishment response also includes a session data packet of the first session.

[0053] Furthermore, the first external network-side host sends the metadata to the first internal network-side host through the first optical gate based on the pre-created first session, including:

[0054] The first external network-side host generates a session data packet based on the UDPLite protocol based on the metadata, and sends the session data packet to the first internal network-side host through the first optical gate via a pre-created first session.

[0055] In a second aspect, an embodiment of the present invention provides a data transmission method based on a dual one-way optical gate system, wherein the dual one-way optical gate system includes a first external network side host, a first internal network side host, a first optical gate for controlling the first external network side host to transmit data unidirectionally to the first internal network side host, a second external network side host, a second internal network side host, and a second optical gate for controlling the second external network side host to transmit data unidirectionally to the second internal network side host, wherein the method includes:

[0056] The first intranet-side host receives metadata sent by the first extranet-side host through the first optical gate based on the pre-created first session;

[0057] The first intranet-side host sends a confirmation number corresponding to the metadata to the first external-side host via the second external-side host and the second intranet-side host; the confirmation number is used to indicate that the corresponding metadata has been received by the first intranet-side host.

[0058] Furthermore, the first intranet-side host receives metadata sent by the first extranet-side host through the first optical gate based on the pre-created first session, including:

[0059] The first intranet-side host receives, through a pre-created first session, a session data packet corresponding to the metadata sent by the first extranet-side host through the first optical gate; the session data packet includes the metadata and a sequence number, and the sequence number is a sequence number of the metadata;

[0060] The method further comprises:

[0061] The first intranet-side host constructs a confirmation number set for the session data packet; the confirmation number set includes a confirmation number corresponding to the session data packet, and the confirmation number is used to indicate that the corresponding session data packet has been received by the first intranet-side host;

[0062] The first intranet-side host sends the confirmation number corresponding to the metadata to the first external-side host via the second external-side host and the second intranet-side host, including:

[0063] The first intranet-side host sends the confirmation number set to the first extranet-side host via the second extranet-side host and the second intranet-side host.

[0064] Furthermore, the first intranet-side host receives, through a pre-created first session, a session data packet corresponding to the metadata sent by the first extranet-side host through the first optical gate, including:

[0065] The first intranet-side host receives the session data packets sent in batches by the first extranet-side host through the first optical gate through the pre-created first session, and stores the batch-sent session data packets in a fourth queue; the fourth queue is a queue including at least one received and unconfirmed session data packet;

[0066] The first intranet-side host constructs a confirmation number set for the session data group, including:

[0067] The first intranet-side host constructs a confirmation number set for at least one session data packet in the fourth queue; the confirmation number set includes a confirmation number corresponding to at least one session data packet;

[0068] The first intranet-side host sends the confirmation number set to the first external-side host via the second external-side host and the second intranet-side host, including:

[0069] The first intranet-side host is triggered by a second timer to send the set of confirmation numbers in batches to the first extranet-side host via the second extranet-side host and the second intranet-side host;

[0070] The method further comprises:

[0071] The first intranet-side host moves the confirmed session data packet from the fourth queue to the fifth queue; the fifth queue is a queue including at least one received and confirmed session data packet.

[0072] Furthermore, before the first intranet-side host receives, through the pre-created first session, a session data packet corresponding to the metadata sent by the first extranet-side host through the first optical gate, the method further includes:

[0073] The first intranet-side host receives a first establishment request from the first extranet-side host through a lightweight user datagram protocol UDPLite protocol, where the first establishment request is used to request to establish the first session, and the first establishment request is generated based on the UDPLite protocol;

[0074] The first intranet-side host allocates a session number of the first session based on the first establishment request;

[0075] The first intranet-side host sends a first establishment response based on the UDPLite protocol to the first external-side host via the second external-side host and the second intranet-side host, wherein the first establishment response includes a session number of the first session;

[0076] The first intranet-side host receives a second establishment response based on the UDPLite protocol from the first extranet-side host, where the second establishment response includes a session number of the first session.

[0077] Furthermore, the method further comprises:

[0078] The first intranet-side host receives a first closing request from the first extranet-side host, and performs delayed deletion processing on the first session; the first closing request includes a session termination message, and the session termination message is used to release the first session;

[0079] When the first intranet-side host does not include any unsent session data packets in the fifth queue, the first intranet-side host sends a first closing response to the first external-side host via the second external-side host and the second intranet-side host, wherein the first closing response includes the session number of the first session.

[0080] Furthermore, the method further comprises:

[0081] The first intranet-side host sends a second closing request to the first external-side host via the second external-side host and the second intranet-side host, and releases the first session; the second closing request is used to indicate that the first session has expired;

[0082] The first intranet-side host receives a second closing response from the first extranet-side host, where the second closing response includes a session number of the first session.

[0083] Furthermore, the method further comprises at least one of the following:

[0084] When the session has been created or the session has been released, the first intranet-side host is in an initialization state;

[0085] When the first intranet-side host is in a listening state, the first intranet-side host listens to the first establishment request;

[0086] When the first intranet-side host receives the first establishment request, the first intranet-side host enters a second semi-connected state, and the first intranet-side host waits to send the first establishment response in the second semi-connected state;

[0087] When the first intranet-side host receives the second establishment response, the first intranet-side host enters a session establishment state;

[0088] When the first intranet-side host receives the first closing request, the first intranet-side host enters a second semi-closed state, and in the second semi-closed state, the first intranet-side host supports sending data cached by the first intranet-side host, suspends receiving data, and performs delayed deletion processing on the session;

[0089] When the first intranet-side host is in the second semi-closed state and the fifth queue does not include the session data packet, the first intranet-side host enters the second closed waiting state and performs delayed deletion processing on the session;

[0090] In the case where the first intranet-side host has sent the second closing request, the first intranet-side host enters a first semi-closed state, and in the first semi-closed state, the first intranet-side host supports sending data cached by the first intranet-side host, suspends receiving data, and performs delayed deletion processing on the session;

[0091] When the first intranet-side host is in a first semi-closed state and the fifth queue does not include session data packets, the first intranet-side host enters a first closed waiting state.

[0092] Furthermore, the second establishment response also includes a session data packet of the first session.

[0093] Furthermore, the first intranet-side host receives metadata sent by the first extranet-side host through the first optical gate based on the pre-created first session, including:

[0094] The first intranet-side host receives, through a pre-created first session, a session data packet based on the UDPLite protocol corresponding to the metadata sent by the first extranet-side host through the first optical gate.

[0095] In a third aspect, an embodiment of the present invention further provides a data transmission device based on a dual one-way optical gate system, wherein the dual one-way optical gate system includes a first external network side host, a first internal network side host, a first optical gate for controlling the first external network side host to transmit data to the first internal network side host in one direction, a second external network side host, a second internal network side host, and a second optical gate for controlling the second external network side host to transmit data to the second internal network side host in one direction, wherein the device includes:

[0096] A first receiving module is used to extract the transmission control protocol TCP session data when the TCP session data is received, so as to obtain metadata in the TCP session data;

[0097] A first sending module, configured to send the metadata to the first intranet-side host through the first optical gate based on a pre-created first session;

[0098] The second receiving module is used to receive a confirmation number sent by the first intranet-side host via the second external-side host and the second intranet-side host, wherein the confirmation number is used to indicate that the session data of the transmission control protocol TCP has been received by the first intranet-side host.

[0099] In a fourth aspect, an embodiment of the present invention further provides a data transmission device based on a dual one-way optical gate system, wherein the dual one-way optical gate system includes a first external network side host, a first internal network side host, a first optical gate for controlling the first external network side host to transmit data to the first internal network side host in one direction, a second external network side host, a second internal network side host, and a second optical gate for controlling the second external network side host to transmit data to the second internal network side host in one direction, wherein the device includes:

[0100] A third receiving module, configured to receive metadata sent by the first external network-side host through the first optical gate based on the pre-created first session;

[0101] The second sending module is used to send the confirmation number corresponding to the metadata to the first external network side host via the second external network side host and the second internal network side host; the confirmation number is used to indicate that the corresponding metadata has been received by the first internal network side host.

[0102] In a fifth aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method for data transmission based on a dual one-way optical gate system as described in the first aspect is implemented, or the method for data transmission based on a dual one-way optical gate system as described in the second aspect is implemented.

[0103] In the sixth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the data transmission method based on a dual one-way optical gate system as described in the first aspect, or implements the data transmission method based on a dual one-way optical gate system as described in the second aspect.

[0104] In the seventh aspect, an embodiment of the present invention further provides a computer program product having executable instructions stored thereon, which, when executed by a processor, enables the processor to implement the data transmission method based on the dual one-way optical gate system described in the first aspect, or to implement the data transmission method based on the dual one-way optical gate system described in the second aspect.

[0105] The embodiments of the present invention provide a data transmission method, apparatus, device and medium based on a dual one-way optical gate system. When a first external network side host receives TCP session data, it can extract metadata from the TCP session data, and send the metadata to the first internal network side host through the first optical gate based on a pre-created first session, and receive a confirmation number sent by the first internal network side host via the second external network side host and the second internal network side host to indicate that the TCP session data corresponding to the metadata has been received by the first internal network side host, thereby realizing reliable data transmission in a dual one-way optical gate environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0106] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0107] Figure 1 It is one of the structural schematic diagrams of the double one-way optical shutter system in the data transmission method based on the double one-way optical shutter system provided by the embodiment of the present invention;

[0108] Figure 2 This is one of the flow charts of the data transmission method based on the dual one-way optical gate system provided by an embodiment of the present invention;

[0109] Figure 3It is one of the signaling interaction diagrams of the data transmission method based on the dual one-way optical gate system provided by the embodiment of the present invention;

[0110] Figure 4 This is a second flow chart of a data transmission method based on a dual one-way optical shutter system provided by an embodiment of the present invention;

[0111] Figure 5 It is a schematic diagram of the change of the congestion window of a session over time in the data transmission method based on the dual one-way optical gate system provided by an embodiment of the present invention;

[0112] Figure 6 This is the second signaling interaction diagram of the data transmission method based on the dual one-way optical gate system provided by the embodiment of the present invention;

[0113] Figure 7 It is a state transition diagram of a dual one-way optical shutter system in a data transmission method based on a dual one-way optical shutter system provided by an embodiment of the present invention;

[0114] Figure 8 This is a third flow chart of a data transmission method based on a dual one-way optical shutter system provided by an embodiment of the present invention;

[0115] Fig. 9 This is the second structural schematic diagram of the double one-way optical shutter system in the data transmission method based on the double one-way optical shutter system provided by the embodiment of the present invention;

[0116] Fig.10 It is a flow chart of the distribution access module processing in the data transmission method based on the dual one-way optical gate system provided by an embodiment of the present invention;

[0117] Fig.11 It is a schematic diagram of a unified event processing flow in a data transmission method based on a dual one-way optical gate system provided by an embodiment of the present invention;

[0118] Fig.12 It is one of the schematic diagrams of the sliding window mechanism in the data transmission method based on the dual one-way optical gate system provided by an embodiment of the present invention;

[0119] Fig.13 This is a second schematic diagram of a sliding window mechanism in a data transmission method based on a dual one-way optical gate system provided in an embodiment of the present invention;

[0120] Fig.14 It is a schematic diagram of the flow of message sorter processing in the data transmission method based on the dual one-way optical gate system provided by an embodiment of the present invention;

[0121] Fig.15 It is a schematic diagram of the process of UDPLite access layer processing in the data transmission method based on the dual unidirectional optical gate system provided by an embodiment of the present invention;

[0122] Fig.16 This is one of the structural schematic diagrams of a data transmission device based on a dual one-way optical shutter system provided by an embodiment of the present invention;

[0123] Fig.17 This is the second structural schematic diagram of the data transmission device based on the dual one-way optical shutter system provided by an embodiment of the present invention;

[0124] Fig.18 It is a schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0125] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0126] The following describes the data transmission method, device, equipment and medium based on the dual one-way optical shutter system of the present invention in conjunction with the accompanying drawings.

[0127] In order to facilitate a clearer understanding of the embodiments of the present invention, some relevant technical knowledge is first introduced as follows.

[0128] 1. Front-end and back-end data exchange platform (Digital Switch Engineering (DSE) front-end or back-end): The data security exchange platform is a cross-network and cross-domain data security exchange solution that combines the security isolation characteristics of network gate products in cross-network and cross-domain scenarios through business data extraction or loading, data security detection and other capabilities;

[0129] 2. UDPLite (Lightweight User Datagram Protocol): UDPLite is based on UDP, but different from UDP. It allows the calculation of the corresponding checksum for verification protection of datagrams of any length. The "message length" field in the UDP datagram header is used to control the length of the data packet for which the checksum needs to be calculated, thereby allowing the data part not covered by the checksum to be transmitted lossily.

[0130] 3. Double Oneway Reliable Transfer (DORT): an abbreviation for the technical solution of distributing access modules on a one-way optical gate in an embodiment of the present invention.

[0131] The embodiments of the present invention can be applied to a new generation of optical switches to obtain higher performance advantages in terms of delay, throughput, and concurrency indicators. In addition, when used in conjunction with front-end and back-end, it can solve the problem of insufficient performance in a 10 Gigabit business environment. Specifically, in addition to solving the problem of data reliability, it can also optimize session validity, session concurrency, transmission throughput performance, session creation performance, etc.

[0132] Figure 1 FIG. 1 is one of the structural schematic diagrams of the dual one-way optical shutter system in the data transmission method based on the dual one-way optical shutter system provided in an embodiment of the present invention, such as Figure 1 As shown, the dual one-way shutter system 100 includes:

[0133] A first external host 101, a first internal host 102, a first optical gate 103 for controlling unidirectional data transmission from the first external host 101 to the first internal host 102, a second external host 104, a second internal host 105, and a second optical gate 106 for controlling unidirectional data transmission from the second external host 104 to the second internal host 105.

[0134] Figure 2 FIG. 1 is a flow chart of a data transmission method based on a dual one-way optical shutter system provided by an embodiment of the present invention. Figure 2 As shown, the data transmission method based on the dual one-way optical gate system can be applied to the first external network side host, and the method includes the following steps:

[0135] Step 201: When receiving TCP session data, the first external network-side host extracts the TCP session data to obtain metadata in the TCP session data;

[0136] Step 202: The first external network host sends the metadata to the first internal network host through the first optical gate based on the pre-created first session;

[0137] Step 203: The first external host receives a confirmation number sent by the first internal host via the second external host and the second internal host, where the confirmation number is used to indicate that the TCP session data has been received by the first internal host.

[0138] Specifically, existing data transmission technologies such as UDT, RUDP and QUIC all require a bidirectional exchange link support (such as a network gate environment). For example, the UDT connection is established on a bidirectional unreliable UDP connection, providing a connection-oriented bidirectional reliable data connection, and ensuring effective bandwidth utilization and reliable transmission through congestion control and timeout retransmission mechanisms;

[0139] However, a dual one-way optical gate environment can only provide two one-way unreliable connections through two one-way optical gates in opposite directions. Therefore, the above technology cannot be directly used in a dual one-way optical gate environment. The problem of reliable data transmission in a dual one-way optical gate environment needs to be solved urgently.

[0140] In view of the above problems, the embodiments of the present invention can adapt to the physical characteristics of the unidirectional transmission of the one-way optical gate "diode", and physically deploy two optical gates in opposite directions, one of which is used for data import and the other as signaling confirmation. In this way, the dual optical gate environment can provide data transmission in two directions, and can support related user services of the Transmission Control Protocol (TCP) externally, such as database access, email access, web page access, etc.

[0141] In an embodiment of the present invention, a deployment scenario of a dual one-way optical shutter is provided, such as Figure 1 As shown, the first optical gate 103 is arranged between the first external network side host 101 and the first internal network side host 102, and the first optical gate 103 is used to control the unidirectional data transmission from the first external network side host 101 to the first internal network side host 102; the second optical gate 106 is arranged between the second external network side host 104 and the second internal network side host 105, and the second optical gate 106 is used to control the unidirectional data transmission from the second external network side host 104 to the second internal network side host 105.

[0142] It should be noted that the first external network side host 101 can be understood as the optical gate external network, the first internal network side host 102 can be understood as the optical gate internal network, the first external network side host 101, the first optical gate 103 and the first internal network side host 102 can be understood as a set of optical gates, for example, optical gate A; similarly, the second external network side host 104 can be understood as the optical gate external network, the second internal network side host 105 can be understood as the optical gate internal network, the second external network side host 104, the second optical gate 106 and the second internal network side host 105 can be understood as another set of optical gates, for example, optical gate B.

[0143] Alternatively, if Figure 1 As shown, the dual one-way optical gate system 100 may further include: a service client 107, a DSE front-end 108, a DSE back-end 109 and a demilitarized zone (DMZ) server 110; the definition of each deployed device is described below.

[0144] 1) Business client 107: a role for the business party to initiate business requests. Business requests are requests based on TCP, including but not limited to Hyper Text Transfer Protocol (HTTP) requests, File Transfer Protocol (FTP) access, MySQL (My Structured Query Language) queries, and Simple Mail Transfer Protocol (SMTP) email access;

[0145] 2) DMZ server 110: located in the isolation zone, providing business services, including but not limited to Web server, FTP server, MySQL server, SMTP server;

[0146] 3) DSE front-end 108: provides service request access function to the front (service client), and interacts with the optical gate through the private protocol TCP; wherein, the DSE front-end 108 and the first external network host 101 and the second internal network host 105 are directly connected and interconnected physically deployed;

[0147] 4) DSE backend machine 109: forwardly exchanges with the optical gate through the private protocol TCP, and backwardly interacts with the DMZ server 110; wherein, the DSE backend machine 109 and the first intranet-side host 102 and the second extranet-side host 104 are directly connected and physically deployed.

[0148] Based on the deployment scenario of the dual one-way optical gates, that is, based on the dual one-way optical gate system 100 , an embodiment of the present invention provides a data transmission method based on the dual one-way optical gate system.

[0149] Specifically, there are two unidirectional data transmission lines between the first external network side host and the first internal network side host:

[0150] Line 1: a line for the first external network-side host 101 to transmit data to the first internal network-side host 102 through the first optical switch 103;

[0151] Line 2: The line through which the first intranet host 102 transmits data to the first external host 101 via the second external host 104 and the second intranet host 105 in sequence, which can be understood as the line through which the first intranet host 102 transmits data to the first external host 101 through the second optical gate 106.

[0152] In the embodiment of the present invention, when the first external network side host 101 receives the TCP session data, it extracts the TCP session data to obtain metadata in the TCP session data, and based on the pre-created first session, sends the metadata to the first internal network side host 102 through the first optical gate 103, that is, the first external network side host 101 uses the above-mentioned line 1 to send the metadata to the first internal network side host 102;

[0153] The first external network side host 101 then receives the confirmation number sent by the first internal network side host 102 via the second external network side host 104 and the second internal network side host 105, that is, the first external network side host 101 uses the above-mentioned line 2 to receive the confirmation number from the first internal network side host 102, to indicate that the TCP session data corresponding to the sent metadata has been received by the first internal network side host 102, thereby realizing reliable data transmission in a dual one-way optical gate environment.

[0154] The embodiment of the present invention provides a data transmission method based on a dual one-way optical gate system. When the first external network side host receives TCP session data, it can extract metadata in the TCP session data, and send the metadata to the first internal network side host through the first optical gate based on the pre-created first session, and receive a confirmation number sent by the first internal network side host via the second external network side host and the second internal network side host to indicate that the TCP session data corresponding to the metadata has been received by the first internal network side host, thereby realizing reliable data transmission in a dual one-way optical gate environment.

[0155] Optionally, an embodiment of the present invention provides a method for establishing a first session through a three-way handshake to perform reliable data transmission.

[0156] The first external network-side host generates a session data packet based on the metadata, and before sending the session data packet to the first internal network-side host through the first optical gate through the pre-created first session, the first external network-side host may, upon receiving a TCP establishment request, convert the TCP establishment request into a first establishment request based on a lightweight user datagram protocol (UDPLite) protocol, and send the first establishment request to the first internal network-side host through the UDPLite protocol, wherein the first establishment request is used to request to establish the first session;

[0157] The first external network-side host receives a first establishment response based on the UDPLite protocol sent by the first internal network-side host via the second external network-side host and the second internal network-side host, wherein the first establishment response includes a session number of the first session;

[0158] The first external network-side host sends a second establishment response based on the UDPLite protocol to the first internal network-side host based on the first establishment response, where the second establishment response includes the session number of the first session.

[0159] Specifically, upon receiving the TCP establishment request, the first external network side host sends a first establishment request to the first internal network side host to request establishment of a first session for carrying data for two-way unidirectional transmission between the first external network side host and the first internal network side host;

[0160] After the first external network side host sends the first establishment request to the first internal network side host, the first internal network side host can receive the first establishment request, and allocate a session number of the first session based on the first establishment request, and then carry the session number of the first session in the first establishment response, and send the first establishment response to the first external network side host via the second external network side host and the second internal network side host. After receiving the first establishment response, the first external network side host can send a second establishment response including the session number of the first session to the first internal network side host based on the first establishment response to establish the first session.

[0161] In one embodiment, Figure 3 is one of the signaling interaction diagrams of the data transmission method based on the dual one-way optical gate system provided by the embodiment of the present invention, such as Figure 3 As shown, the data transmission method based on the dual one-way optical gate system includes:

[0162] Step 301: The DSE front-end initiates a TCP creation request to the first external network host.

[0163] Specifically, after receiving a service request from a service client, the DSE front-end can authorize the access module to initiate a TCP new request as a TCP client;

[0164] Step 302: The first external network host receives the TCP new connection request and completes the TCP handshake, thereby completing the TCP new connection.

[0165] Specifically, the first external network side host receives the TCP creation request, processes the TCP handshake and creates a TCP session and a DORT session;

[0166] Step 303: The first external network host initiates a DORT::SYN new request to the first internal network host.

[0167] Specifically, the first external network host initiates a first establishment request, such as a DORT new establishment request. A DORT::SYN message is designed as a DORT new establishment request. The DORT::SYN message may include a random number cookie and a timestamp ts, and then is sent to the first internal network host through the UDPLite protocol. At this time, since the DORT session does not completely handshake successfully, the DORT session is in a semi-connected queue (SYN-Queue) and is maintained in the form of a cookie.

[0168] Step 304: The first intranet host receives the DORT::SYN new creation request and responds to the first extranet host with DORT::ACK1;

[0169] Specifically, the first intranet host receives the DORT new creation request, allocates a unique session number Dort-id as the session number of the first session, fills it into the first establishment response, for example, fills it into the DORT::ACK1 message, and then replies to the first external host from another optical switch through the UDPLite protocol. At this time, the DORT session also exists in the SYN-Queue, using Dort-id as the index;

[0170] Step 305: The first external network host sends DORT::ACK2 to the first internal network host, completing the DORT three-way handshake.

[0171] Specifically, after receiving the DORT::ACK1 message, the first external host can index the DORT session from the SYN-Queue, move the DORT session to the full connection queue (Establish-Queue), use the Dort-id as the index, and send a second establishment response, such as sending a DORT::ACK2 message to the first internal host. At this time, the DORT handshake is completed between the first external host and the first internal host.

[0172] In addition, the DORT session handshake will determine the initial value RTTinit of the round-trip delay between the two optical gates (optical gate A and optical gate B), and then weighted average it to SRTT as the threshold timeout retransmission mechanism (RetransmissionTimeout, RTO) for timeout retransmission, so as to preliminarily measure the network delay range of the two optical gates cascaded up and down.

[0173] Optionally, the second establishment response may also include a session data packet of the first session.

[0174] Specifically, the embodiment of the present invention further designs a Fast-Open process for the scenario of short connection high-speed creation, that is, the second establishment response of the third DORT handshake, such as the DORT::ACK2 message, can be merged with the session data packet of the first session (the first DORT::PSH data packet) and sent together to the first intranet-side host;

[0175] Optionally, if there is data in the buffer, DORT::ACK2 is allowed to carry business metadata and be sent to the first intranet-side host.

[0176] Step 306: The first intranet host initiates a new TCP connection to the DSE backend machine;

[0177] Specifically, after receiving DORT::ACK2, the first intranet-side host moves the DORT session from the SYN-Queue column to the Establish-Queue column to complete the DORT handshake; and initiates a new TCP connection to the DSE backend;

[0178] Step 307: The DSE backend receives the new TCP connection and completes the TCP handshake.

[0179] Specifically, the DSE post-machine authorization access module can subsequently process the service handshake, thus completing the entire process of creating a new service request.

[0180] Optionally, the embodiment of the present invention mainly redesigns the DORT handshake process and modifies it into a three-way handshake to ensure reliable processing. The reliability design in the DORT handshake process is as follows:

[0181] 1) DORT::SYN transmission process is lost: Check in the fast-timer periodicity. If DORT::ACK1 is not received within the timeout threshold RTO (usually 300ms to 1000ms), retransmit. If 10 retries are not successful, the DORT session is set as abnormal and released.

[0182] 2) DORT::ACK1 transmission process is lost: the processing flow is the same as 1). In addition, a least recently used (LRU) elimination mechanism is designed in the SYN-Queue. It is checked in the slow-timer period. If the time left in the semi-connected queue is too long and the DORT three-way handshake is not completed within the specified time, the response session termination signaling (DORT::RST) message is set as abnormal and released.

[0183] 3) DORT::ACK2 transmission process is lost: If the first external host has moved the DORT session to the Establish-Queue, then the fault tolerance process can send DORT::PSH data in one direction, that is, the design allows DORT::ACK2 to be lost. Since there is no retransmission mechanism for the ACK series of messages, although the first internal host cannot receive the DORT::ACK2 message temporarily, if it receives the DORT::PSH message, it is allowed to rescue the DORT session from the SYN-Queue to the Establish-Queue, and then send and receive data normally.

[0184] Optionally, the above data transmission method based on the dual unidirectional optical gate system can be applied to a session manager, which is mainly responsible for indexing DORT sessions, associating events of TCP sessions, and maintaining DORT session status.

[0185] Optionally, the first external network-side host may send the metadata to the first internal network-side host through the first optical gate based on the pre-created first session, for example:

[0186] The first external network side host generates a session data packet based on the metadata, and sends the session data packet to the first internal network side host through the first optical gate via a pre-created first session; the session data packet includes the metadata and a sequence number, and the sequence number is a sequence number of the metadata;

[0187] The implementation method of the first external network side host receiving the confirmation number sent by the first internal network side host via the second external network side host and the second internal network side host may include:

[0188] The first external network host receives a confirmation number set sent by the first internal network host via the second external network host and the second internal network host; the confirmation number set includes a confirmation number corresponding to the session data packet, and the confirmation number is used to indicate that the corresponding session data packet has been received by the first internal network host.

[0189] Optionally, the embodiment of the present invention further provides a specific implementation method for sending session data in batches.

[0190] The first external network side host generates a session data packet based on the metadata, and sends the session data packet to the first internal network side host through the first optical gate through the pre-created first session, which may be implemented by:

[0191] The first external network-side host generates a session data packet of the first session based on the metadata, and stores the session data packet in a first queue; the first queue is a queue including at least one session data packet to be sent;

[0192] The first external network host is triggered by a first timer, and sends the session data in the first queue to the first internal network host in batches through the first optical gate packets through a pre-created first session, and moves the batch-sent session data packets from the first queue to a second queue; the second queue is a queue including at least one sent and unconfirmed session data packet;

[0193] After the first external network side host receives the confirmation number set sent by the first internal network side host via the second external network side host and the second internal network side host, the first external network side host can match the confirmation number in the confirmation number set with the sequence number of the session data packet in the second queue, and move the session data packet corresponding to the sequence number matching the confirmation number in the second queue to a third queue; the third queue is a queue including at least one sent and confirmed session data packet.

[0194] Specifically, after the DORT session extracts the metadata (Payload) in TCP, it can be encapsulated into a custom message based on the UDPLite protocol, called a DORT data packet message; the embodiment of the present invention uses the Automatic Repeat-reQuest (ARQ) mechanism to achieve reliable data transmission, and defines DORT::PSH signaling for metadata+sequence number and DORT::SACK signaling for confirmation of sequence number set;

[0195] Figure 4 FIG. 2 is a flow chart of a data transmission method based on a dual one-way optical shutter system provided by an embodiment of the present invention. Figure 4 As shown, the data transmission method based on the dual unidirectional optical gate system can use four buffers in conjunction with DORT signaling to implement an ARQ reliable mechanism, and the method can also include the following steps:

[0196] Step 401, the DORT session extracts metadata from the data buffer of the TCP session, encapsulates it into a DORT::PSH data packet, and puts it into a queue to be sent (a first queue), for example, into a buffer to be sent;

[0197] Step 402: The first external network host is triggered by a first timer, and the DORT session sends DORT::PSH data packets in batches to the first internal network host.

[0198] Step 403: After the first external network host completes sending, the DORT::PSH data packet is moved to the sent but unconfirmed queue (second queue) to wait for a confirmation message;

[0199] Step 404: After receiving the DORT::PSH data packet, the first intranet-side host checks whether the sequence number sn is continuous, puts it into the received queue to be processed, that is, into the received and unconfirmed queue (the fourth queue); and marks the corresponding ACK confirmation number;

[0200] Step 405: The first intranet-side host is triggered by the second timer to batch encapsulate the marked ACK sets into DORT::SACK data packets, and feed them back through another optical switch (via the second external network-side host and the second intranet-side host);

[0201] Step 406: The first external network host obtains the ACK confirmation number from the sent unconfirmed queue (second queue), matches the sn sequence number, and removes the confirmed DORT::PSH data packet;

[0202] Step 407: The first intranet-side host performs the same steps as step 405. When marking ACK in batches, the DORT::PSH data packets are moved to the received and confirmed queue (fifth queue) to wait for the next TCP session to take away the data.

[0203] Optionally, when the first external network-side host does not include a confirmation number matching the sequence number of the target session data packet in the second queue in the confirmation number set, and the confirmation number set includes a confirmation number matching the sequence number of the next session data packet after the target session data packet in the second queue, detect whether the next confirmation number set of the confirmation number set includes a confirmation number matching the sequence number of the target session data packet;

[0204] When the first external network-side host does not include a confirmation number matching the sequence number of the target session data packet in N consecutive rounds of confirmation number sets, the first external network-side host retransmits the target session data packet to the first internal network-side host.

[0205] Specifically, in the scenario where a dual unidirectional optical gate system cooperates with front-end and rear-end machines, the front-end and rear-end machines and the optical gate are basically directly connected to the same network segment. The first two scenarios that need to be considered are: occasional network jitter packet loss scenario, and packet loss scenario caused by heavy business congestion.

[0206] A fast retransmission mechanism is added to the UDPLite-based DORT protocol: on the DORT::PSH data packet, in the sent unconfirmed queue (the second queue) of the sender, if the current PSH is not confirmed but the ACK corresponding to the next PSH is directly received, then the current PSH can be marked with a duplicate count (duplicate+=1), and it is detected whether the next confirmation number set of the confirmation number set includes a confirmation number that matches the sequence number of the target session data packet (current PSH); if the confirmation number set for N consecutive rounds does not include a confirmation number that matches the sequence number of the current PSH, the current PSH is retransmitted to the first intranet-side host; for example, if 3 or more consecutive rounds of DORT::SACK do not confirm the ACK corresponding to the current PSH (duplicate≥3), then the fast retransmission mechanism is triggered and the current PSH packet will be retransmitted.

[0207] Optionally, when the first external network host retransmits the target session data packet to the first internal network host and there is no timed-out and unconfirmed session data packet in the second queue, the current congestion threshold ssthresh is determined based on the length of the second queue using formula (1):

[0208]

[0209] Wherein, nxt represents the sequence number of the last session data packet in the second queue, una represents the sequence number of the first session data packet in the second queue, and nxt-una represents the length of the second queue;

[0210] The first external network-side host determines the current congestion window cwnd based on the current congestion threshold ssthresh using formula (2):

[0211] cwnd = ssthresh + 3 (2);

[0212] The first external network-side host executes a TCP congestion avoidance algorithm when the current congestion window is greater than the current congestion threshold.

[0213] Optionally, the TCP congestion avoidance algorithm may be a congestion avoidance algorithm in the prior art, which is used to prevent excessive data from being injected into the network and to avoid overload of routers or links in the network.

[0214] Optionally, when the first external network host retransmits the target session data packet to the first internal network host and there are timed-out and unconfirmed session data packets in the second queue, the current congestion threshold ssthresh is determined based on the current congestion window cwnd using formula (3):

[0215]

[0216] The following is an example to illustrate the quick recovery mechanism.

[0217] 1) If only fast retransmission is triggered, it can be determined that the packet loss problem is not caused by network congestion, and retransmission will not cause new congestion problems. In this solution, ssthresh is set to half of the current sent unconfirmed window size, as shown in formula (1):

[0218]

[0219] Among them, nxt represents the last bit in the sent unconfirmed window, and una represents the first bit in the sent unconfirmed window, so nxt-una can represent the size of the sent unconfirmed window.

[0220] The congestion window cwnd can be set to start from ssthresh and directly enter the congestion avoidance process. For example, the existing TCP congestion avoidance algorithm is executed and cwnd is calculated as shown in formula (2):

[0221] cwnd=ssthresh+3 (2)

[0222] Among them, 3 is used to represent the reserved initial window size, which is an empirical value.

[0223] 2) If in addition to the fast retransmit flag, there is also a timeout flag, it is determined that the network is congested, and the service burst volume may increase sharply or the concurrency volume is large. In this case, ssthresh needs to be readjusted to half of the current cwnd, as shown in formula (3):

[0224]

[0225] Optionally, considering that in a network environment with dual unidirectional optical switches, there is a high probability that extreme congestion will not occur, so the minimum value of ssthresh can be limited in a gigabit network environment. min =128, the minimum value of ssthresh that can be limited in a 10G network environment min = 1024. This can effectively avoid local network jitters that may cause a significant drop in throughput.

[0226] Optionally, in a network environment with dual one-way optical switches, especially a Gigabit or 10 Gigabit network environment, both are high-speed network environments. Figure 5 is a schematic diagram of the change of the congestion window of a session over time in the data transmission method based on the dual unidirectional optical gate system provided by an embodiment of the present invention, such as Figure 5As shown, in this long-fast network environment, the embodiment of the present invention provides two scenarios of coping methods:

[0227] 1. When the network is saturated, there are multiple DORT sessions and a new DORT session is added:

[0228] Newly added sessions will seize existing bandwidth, causing congestion and packet loss. It is necessary to prevent all sessions from competing again and causing fluctuations in the overall throughput.

[0229] In the embodiment of the present invention, the cwnd of a new session is set to be small at the beginning, but it grows faster, and the growth rate is slowed down when it is close to the estimated ssthresh. If an existing session has packet loss, it enters the congestion avoidance process and is in a stable maintenance interval. Therefore, the overall session grows towards saturation in a fair manner and finally stabilizes in the optimal congestion window cwnd max Maintaining that, this scenario primarily considers the issue of “fairness” of growth.

[0230] 2. When the network is saturated, there are multiple DORT sessions, and the existing DORT session is exited:

[0231] At this point, the overall session is already in the optimal congestion window cwnd max The DORT session exit indicates that there is still plenty of room for overall bandwidth.

[0232] In the embodiment of the present invention, if the existing session is in a stable holding stage, but cwnd can still grow in a small scale and no packet loss occurs, it means that the detection maximum window cwnd can be gradually enlarged. prob-max This scenario can effectively detect abundant bandwidth resources if and only if the next stable optimal window is determined. This scenario mainly considers the "efficiency" of acquiring new resources.

[0233] Optionally, upon receiving the TCP close request, the first external network side host generates a session termination message, and stores the session termination message at the end of the queue in the first queue; the session termination message is used to release the first session;

[0234] When the first queue does not include any unsent session data packets, the first external network host sends a first closing request to the first internal network host and performs delayed deletion processing on the first session; the first closing request includes the session termination message;

[0235] The first external-network-side host receives a first closing response sent by the first internal-network-side host via the second external-network-side host and the second internal-network-side host, wherein the first closing response includes a session number of the first session.

[0236] It should be noted that closing a connection does not distinguish between the client or the server, but is divided into active initiator and passive closure;

[0237] Specifically, after receiving a service closing request from a service client, the DSE front-end can act as a TCP closing initiator and send a TCP closing request to the first external network side host. When the first external network side host receives the TCP closing request, it generates a session termination message and stores the session termination message at the end of the queue in the first queue. The session termination message is used to release the first session.

[0238] When the first external network side host does not include any unsent session data packets in the first queue, the first internal network side host may send a first closing request including a session termination message to the first internal network side host, and perform delayed deletion processing on the first session, and then receive a first closing response sent by the first internal network side host via the second external network side host and the second internal network side host, wherein the first closing response includes the session number of the first session.

[0239] In one embodiment, after receiving a service closing request from the DMZ server, the DSE backend machine may serve as a TCP closing initiator and send a TCP closing request to the first intranet-side host;

[0240] When the first intranet-side host receives the TCP close request, it generates a session termination message and stores the session termination message at the end of the queue in the fourth queue; the session termination message is used to release the first session;

[0241] When the first intranet-side host does not include any unsent session data packets in the fourth queue, the first intranet-side host sends a first closing request to the first external-side host via the second external-side host and the second intranet-side host, and performs delayed deletion processing on the first session; the first closing request includes a session termination message;

[0242] The first internal network-side host receives a first closing response sent by the first external network-side host, where the first closing response includes a session number of the first session.

[0243] Optionally, the first external network side host receives a second closing request sent by the first internal network side host via the second external network side host and the second internal network side host, and releases the first session; the second closing request is used to indicate that the first session has expired;

[0244] The first external network-side host sends a second closing response to the first internal network-side host based on the second closing request, where the second closing response includes the session number of the first session.

[0245] Specifically, when the DSE front-end acts as the party initiating the TCP close, after receiving the first close response, the first external network side host can receive a second close request sent by the first internal network side host via the second external network side host and the second internal network side host to indicate that the first session has expired, and release the first session. The first external network side host then sends a second close response including the session number of the first session to the first internal network side host based on the second close request.

[0246] In one embodiment, when the DSE backend serves as the party initiating TCP closing, the method may further include:

[0247] The first intranet-side host receives the second closing request sent by the first extranet-side host, and releases the first session; the second closing request is used to indicate that the first session has expired;

[0248] Based on the second closing request, the first intranet-side host sends a second closing response to the first external-side host via the second external-side host and the second intranet-side host, where the second closing response includes the session number of the first session.

[0249] For example, if the business client is the active initiator of closing the connection, the DMZ server is the passive closer of closing the connection; if the DMZ server is the active initiator of closing the connection, the business client is the passive closer of closing the connection.

[0250] The embodiment of the present invention mainly optimizes the short connection scenario. Figure 6 FIG. 2 is a second signaling interaction diagram of a data transmission method based on a dual one-way optical gate system provided in an embodiment of the present invention. Figure 6 As shown, the main steps are as follows:

[0251] Step 601: Initiate a TCP close request to DORT session A.

[0252] Specifically, when the front-end or back-end receives a service closing request, it takes the initiative to initiate a TCP closing request as the TCP closing initiator;

[0253] It should be noted that DORT session A refers to the DORT session on the host side corresponding to the party initiating the TCP closure; specifically, if the party initiating the TCP closure is the front-end machine, then DORT session A refers to the DORT session of the first external network side host; if the party initiating the TCP closure is the back-end machine, then DORT session A refers to the DORT session of the first internal network side host.

[0254] Step 602: After receiving the TCP close request, DORT session A stops receiving DORT messages and prepares a DORT::FIN request.

[0255] Specifically, after receiving the TCP close request sent by the front-end or back-end, DORT session A first stops receiving DORT messages, prepares a DORT::FIN termination message, and buffers the DORT::FIN termination message in a sending buffer queue, specifically at the end of the queue.

[0256] Step 603-1, DORT session A sends cached data;

[0257] Specifically, DORT session A checks whether there is any unsent DORT::PSH data in the send buffer queue, and if so, sends the buffered data first;

[0258] Step 603-2: After sending the cached data, DORT session A sends a DORT::FIN message to DORT session B as the first closing request;

[0259] It should be noted that DORT session B refers to the DORT session on the host side corresponding to the TCP closed party; specifically, if the TCP closed party is the front-end machine, then DORT session B refers to the DORT session of the first external network side host; if the TCP closed party is the back-end machine, then DORT session B refers to the DORT session of the first internal network side host.

[0260] Specifically, after DORT session A sends the cached data, it sends a DORT::FIN message. At this time, DORT session A enters the semi-closed queue (FIN-Queue). According to the LRU aging time algorithm, it will wait for a period of DORT::TIMEWAIT before the space is completely released.

[0261] Step 604: After receiving the DORT::FIN message, DORT session B performs a DORT::FACK reply confirmation;

[0262] Specifically, after receiving the DORT::FIN message, DORT session B performs a DORT::FACK reply confirmation, and then moves DORT session B from the Establish-Queue to the FIN-Queue, retaining it for a period of DORT::TIMEWAIT before completely releasing the space;

[0263] Step 605-1: DORT session B processes the unforwarded cached data into TCP data and sends it.

[0264] Step 605-2: DORT session B processes the unforwarded cached data into TCP data and sends it away, thus completing the TCP session closing.

[0265] It should be noted that DORT session B has been processing the unforwarded cached data into TCP data for sending until it receives the DORT::FIN message, stops receiving data, and processes the currently cached cached data into TCP data for sending. After the sending is completed, the TCP connection between DORT session B and the TCP closed party is closed.

[0266] Specifically, DORT session B needs to process the unforwarded cached data into TCP data and then close TCP. It will cooperate with the TCP session to register the closing event triggered by the low water level. When the cached data is sent, the event is triggered and TCP is closed. This can be applied to the business request scenario of short links and can effectively prevent business data from being discarded on intermediate devices.

[0267] Step 606: After completing the TCP buffer data processing, DORT session B sends a DORT::FIN message to DORT session A.

[0268] Specifically, after completing the TCP cache data processing, DORT session B initiates a DORT::FIN message in the reverse direction to inform the peer end that DORT session A has failed.

[0269] Step 607: After receiving the DORT::FIN message, DORT session A sends a DORT::FACK confirmation to DORT session B;

[0270] Specifically, after receiving the DORT::FIN message, DORT session A replies with a DORT::FACK confirmation;

[0271] Optionally, if a DORT session receives a DORT::FIN termination message and then a DORT::FACK message, it means that all business metadata has been forwarded and processed, and there is no need to wait for the delayed deletion of DORT::TIMEWAIT again. The DORT session can be released directly through a fast path, which is called the Fast-Close process. It can have an effective optimization effect in short connection scenarios similar to HTTP requests.

[0272] Step 608: The party initiating the TCP shutdown completes the TCP session shutdown.

[0273] Optionally, the above method may further include at least one of the following steps:

[0274] When the session has been created or the session has been released, the first external network host is in an initialization state;

[0275] After the first external network side host sends the first establishment request and does not receive the first establishment response, the first external network side host enters a first semi-connected state, in which the first external network side host waits to receive the first establishment response and suspends receiving other data except the first establishment response;

[0276] When the first external network side host sends the second establishment response, the first external network side host enters a session establishment state;

[0277] In the case where the first external network side host has sent the first closing request, the first external network side host enters a first semi-closed state, and in the first semi-closed state, the first external network side host supports sending data cached by the first external network side host, suspends receiving data, and performs delayed deletion processing on the session;

[0278] When the first external network side host is in a first semi-closed state and the first queue does not include session data packets, the first external network side host enters a first closed waiting state;

[0279] When the first external network side host receives the second closing request, the first external network side host enters a second semi-closed state, and in the second semi-closed state, the first external network side host supports sending data cached by the first external network side host, suspends receiving data, and performs delayed deletion processing on the session;

[0280] When the first external network side host is in the second semi-closed state and the first queue does not include session data packets, the first external network side host enters the second closed waiting state and performs delayed deletion processing on the session.

[0281] Specifically, Figure 7 : is a state transition diagram of a dual one-way optical shutter system in a data transmission method based on a dual one-way optical shutter system provided by an embodiment of the present invention, such as Figure 7 shown.

[0282] 1) DORT_CLOSE initialization state (initialization state): indicates that the session has just been created, or the last session has just been released;

[0283] 2) DORT_LISTEN starts the listening state (starts the listening state): it mainly appears on the first intranet side host (receiving end) and will start to the listening state to receive new DORT session handshakes; the session in this state is maintained in the semi-connected queue SYN-Queue;

[0284] 3) DORT_SYN_RCVD semi-connected state (second semi-connected state): mainly appears on the first intranet-side host (receiving end). According to the three-way handshake process, this state is entered after receiving the first DORT::SYN handshake request, and is also maintained in the SYN-Queue;

[0285] 4) DORT_SYN_SENT semi-connection state (first semi-connection state): mainly appears on the first external network host (sender), indicating that the DORT::ACK1 message has not been received after the DORT::SYN is sent, and is also maintained in the semi-connection queue SYN-Queue;

[0286] 5) DORT_ESTABLISH session establishment state (session establishment state): In this state, three DORT session handshakes are completed and data can be sent and received normally;

[0287] 6) DORT_CLOSE_WAIT state (second half closed state): indicates the state of passive closure after receiving the DORT::FIN message. At this time, the DORT session is moved to the FIN-Queue for delayed deletion;

[0288] 7) DORT_LAST_ACK state (second close wait state): converted from DORT_CLOSE_WAIT state, indicating that the data in the send buffer has been cleared, and the final DORT::FIN message is sent, and it also enters the FIN-Queue for delayed deletion processing;

[0289] 8) DORT_FIN_WAIT state (first half closed state): indicates that the active closing party appears and enters the FIN-Queue for delayed deletion processing; this solution does not distinguish between FIN_WAIT1 and FIN_WAIT2 states like the TCP protocol, and is designed to be a streamlined fast closing process, while supporting the Fast-Close process;

[0290] 9) DORT_TIMEWAIT state (first closing waiting state): indicates that after the active closing action is completed, if there is no data in the send and receive buffer, the space can be directly released through the Fast-Close process, otherwise it waits for delayed deletion processing in the semi-closed queue.

[0291] Optionally, the first external network-side host may send the metadata to the first internal network-side host through the first optical gate based on the pre-created first session, for example:

[0292] The first external network-side host generates a session data packet based on the UDPLite protocol based on the metadata, and sends the session data packet to the first internal network-side host through the first optical gate via a pre-created first session.

[0293] Specifically, the session data packet may be based on the UDPLite protocol, and data transmission between the first external network side host and the first internal network side host may be performed through the UDPLite protocol.

[0294] Figure 8 FIG. 3 is a flow chart of a data transmission method based on a dual one-way optical shutter system provided by an embodiment of the present invention. Figure 8 As shown, the data transmission method based on the dual one-way optical gate system can be applied to the first intranet side host, and the method includes the following steps:

[0295] Step 801: The first intranet-side host receives metadata sent by the first extranet-side host through the first optical gate based on a pre-created first session;

[0296] Step 802: The first intranet-side host sends a confirmation number corresponding to the metadata to the first external-side host via the second external-side host and the second intranet-side host; the confirmation number is used to indicate that the corresponding metadata has been received by the first intranet-side host.

[0297] Specifically, the first intranet-side host can receive metadata sent by the first external network-side host through the first optical gate based on the pre-created first session; after successfully receiving the metadata, the first intranet-side host can send a confirmation number corresponding to the metadata to the first external network-side host via the second external network-side host and the second intranet-side host to indicate that the corresponding metadata has been received by the first intranet-side host.

[0298] An embodiment of the present invention provides a data transmission method based on a dual one-way optical gate system. The first intranet side host can receive metadata sent by the first external network side host through the first optical gate based on a pre-created first session, and send a confirmation number corresponding to the metadata to the first external network side host via the second external network side host and the second intranet side host to indicate that the corresponding metadata has been received by the first intranet side host, thereby realizing reliable data transmission in a dual one-way optical gate environment.

[0299] Optionally, an embodiment of the present invention provides an implementation method for creating a first session.

[0300] Before the first intranet-side host receives the session data packet corresponding to the metadata sent by the first external-network-side host through the first optical gate through the pre-created first session, the first intranet-side host may receive a first establishment request from the first external-network-side host through the lightweight user datagram protocol UDPLite protocol, wherein the first establishment request is used to request to establish the first session, and the first establishment request is generated based on the UDPLite protocol;

[0301] The first intranet-side host allocates a session number of the first session based on the first establishment request;

[0302] The first intranet-side host sends a first establishment response based on the UDPLite protocol to the first external-side host via the second external-side host and the second intranet-side host, wherein the first establishment response includes a session number of the first session;

[0303] The first intranet-side host receives a second establishment response based on the UDPLite protocol from the first extranet-side host, where the second establishment response includes a session number of the first session.

[0304] Specifically, when receiving the TCP establishment request, the first external network side host may send a first establishment request to the first internal network side host to request to establish a first session for carrying data of two-way unidirectional transmission between the first external network side host and the first internal network side host;

[0305] After receiving the first establishment request from the first external host, the first internal host can allocate a session number of the first session based on the first establishment request, and then carry the session number of the first session in the first establishment response, and send the first establishment response to the first external host via the second external host and the second internal host. After receiving the first establishment response, the first external host can send a second establishment response including the session number of the first session to the first internal host based on the first establishment response. The first internal host receives the second establishment response to establish the first session.

[0306] Optionally, the first intranet-side host receiving the metadata sent by the first extranet-side host through the first optical gate based on the pre-created first session may include:

[0307] The first intranet-side host receives, through a pre-created first session, a session data packet corresponding to the metadata sent by the first extranet-side host through the first optical gate; the session data packet includes the metadata and a sequence number, and the sequence number is a sequence number of the metadata;

[0308] The above method may further include the following steps:

[0309] The first intranet-side host constructs a confirmation number set for the session data packet; the confirmation number set includes a confirmation number corresponding to the session data packet, and the confirmation number is used to indicate that the corresponding session data packet has been received by the first intranet-side host;

[0310] The implementation method in which the first intranet-side host sends the confirmation number corresponding to the metadata to the first external-side host via the second external-side host and the second intranet-side host may include:

[0311] The first intranet-side host sends the confirmation number set to the first extranet-side host via the second extranet-side host and the second intranet-side host.

[0312] Optionally, the implementation method of receiving, by the first intranet-side host through the pre-created first session, the session data packet corresponding to the metadata sent by the first extranet-side host through the first optical gate may include:

[0313] The first intranet-side host receives the session data packets sent in batches by the first extranet-side host through the first optical gate through the pre-created first session, and stores the batch-sent session data packets in a fourth queue; the fourth queue is a queue including at least one received and unconfirmed session data packet;

[0314] The implementation method of the first intranet-side host constructing a confirmation number set for the session data group may include:

[0315] The first intranet-side host constructs a confirmation number set for at least one session data packet in the fourth queue; the confirmation number set includes a confirmation number corresponding to at least one session data packet;

[0316] The implementation method in which the first intranet-side host sends the confirmation number set to the first external-side host via the second external-side host and the second intranet-side host may include:

[0317] The first intranet-side host is triggered by a second timer to send the set of confirmation numbers in batches to the first extranet-side host via the second extranet-side host and the second intranet-side host;

[0318] The above method may further include the following steps:

[0319] The first intranet-side host moves the confirmed session data packet from the fourth queue to the fifth queue; the fifth queue is a queue including at least one received and confirmed session data packet.

[0320] Specifically, when receiving the TCP session data, the first external network side host extracts the TCP session data to obtain metadata in the TCP session data, and then generates a session data packet of the first session based on the metadata, wherein the session data packet includes the metadata and a sequence number. The first external network side host stores the session data packet in a first queue (including at least one queue of session data packets to be sent), and then sends the session data packets in the first queue to the first internal network side host in batches through a first timer trigger;

[0321] The first intranet-side host receives the session data packets sent in batches by the first extranet-side host, and stores the sent session data packets in batches in a fourth queue, that is, a queue including at least one received and unconfirmed session data packet;

[0322] The first intranet-side host constructs a confirmation number set for at least one session data packet in the fourth queue, wherein the confirmation number set includes a confirmation number corresponding to at least one session data packet; then, triggered by a second timer, the confirmation number set is sent in batches to the first external-side host via the second external-side host and the second intranet-side host. After receiving the confirmation number set, the first external-side host can match the confirmation number in the confirmation number set with the sequence number of the session data packet in the second queue (including at least one queue of sent and unconfirmed session data packets), and move the session data packet corresponding to the sequence number matching the confirmation number in the second queue to the third queue (including at least one queue of sent and confirmed session data packets). The first intranet-side host moves the confirmed session data packet from the fourth queue to the fifth queue (including at least one queue of received and confirmed session data packets).

[0323] Optionally, the first intranet-side host receives a first closing request from the first extranet-side host, and performs delayed deletion processing on the first session; the first closing request includes a session termination message, and the session termination message is used to release the first session;

[0324] When the first intranet-side host does not include any unsent session data packets in the fifth queue, the first intranet-side host sends a first closing response to the first external-side host via the second external-side host and the second intranet-side host, wherein the first closing response includes the session number of the first session.

[0325] Specifically, the first intranet-side host may receive a first closing request including a session termination message from the first extranet-side host, the session termination message being used to release the first session, and the first intranet-side host may perform delayed deletion processing on the first session;

[0326] When the first intranet-side host does not include any unsent session data packets in the fifth queue, the first intranet-side host may send a first closing response including the session number of the first session to the first external-side host via the second external-side host and the second intranet-side host.

[0327] Optionally, the first intranet-side host sends a second closing request to the first external-side host via the second external-side host and the second intranet-side host, and releases the first session; the second closing request is used to indicate that the first session has expired;

[0328] The first intranet-side host receives a second closing response from the first extranet-side host, where the second closing response includes a session number of the first session.

[0329] Specifically, after completing the TCP cache data processing, the first intranet-side host may send a second closing request to the first external-side host via the second external-side host and the second intranet-side host to indicate that the first session has expired, and release the first session;

[0330] The first external host may send a second closing response including the session number of the first session to the first internal host based on the second closing request, and the first internal host receives the second closing response from the first external host to complete the TCP session closing.

[0331] Optionally, the above method may further include at least one of the following steps:

[0332] When the session has been created or the session has been released, the first intranet-side host is in an initialization state;

[0333] When the first intranet-side host is in a listening state, the first intranet-side host listens to the first establishment request;

[0334] When the first intranet-side host receives the first establishment request, the first intranet-side host enters a second semi-connected state, and the first intranet-side host waits to send the first establishment response in the second semi-connected state;

[0335] When the first intranet-side host receives the second establishment response, the first intranet-side host enters a session establishment state;

[0336] When the first intranet-side host receives the first closing request, the first intranet-side host enters a second semi-closed state, and in the second semi-closed state, the first intranet-side host supports sending data cached by the first intranet-side host, suspends receiving data, and performs delayed deletion processing on the session;

[0337] When the first intranet-side host is in the second semi-closed state and the fifth queue does not include the session data packet, the first intranet-side host enters the second closed waiting state and performs delayed deletion processing on the session;

[0338] In the case where the first intranet-side host has sent the second closing request, the first intranet-side host enters a first semi-closed state, and in the first semi-closed state, the first intranet-side host supports sending data cached by the first intranet-side host, suspends receiving data, and performs delayed deletion processing on the session;

[0339] When the first intranet-side host is in a first semi-closed state and the fifth queue does not include session data packets, the first intranet-side host enters a first closed waiting state.

[0340] Optionally, the second establishment response may also include a session data packet of the first session.

[0341] Optionally, the first intranet-side host receiving the metadata sent by the first extranet-side host through the first optical gate based on the pre-created first session may include:

[0342] The first intranet-side host receives, through a pre-created first session, a session data packet based on the UDPLite protocol corresponding to the metadata sent by the first extranet-side host through the first optical gate.

[0343] The following is an example of a data transmission method based on a dual one-way optical shutter system provided by an embodiment of the present invention.

[0344] one, Fig. 9 FIG. 2 is a second structural diagram of a dual one-way optical shutter system in a data transmission method based on a dual one-way optical shutter system provided in an embodiment of the present invention. Fig. 9 As shown, the data flow steps of the dual one-way shutter system are as follows:

[0345] ① The business client initiates a business request (HTTP, FTP, MySQL, SMTP, etc.) to the DSE front-end;

[0346] ② The DSE front-end authorization access module receives and processes the service request, and after security policy processing, the data is sent to the external network host of optical gate A (the first external network host) via TCP private protocol;

[0347] ③ The access module of the light gate A distributes and processes the TCP request, and the data is disassembled into the UDPLite private protocol and sent to the host on the intranet side of the light gate A (the first host on the intranet side);

[0348] ④ The host on the intranet side of optical gate A extracts UDPLite data and restores it into TCP request, and sends it to the DSE backend machine;

[0349] ⑤The DSE backend machine authorization access module processes the TCP private protocol and restores it to the original service request, and sends it to the DMZ server; after the DMZ server completes the processing, it responds to the DSE backend machine with a service response;

[0350] ⑥ The DSE backend receives the service response, encapsulates the data into the TCP private protocol and sends it to the host on the intranet side of the optical gate A; the host on the intranet side of the optical gate A distributes the access module, extracts the response data, encapsulates it into a UDPLite data packet, and sends it to the host on the extranet side of the optical gate B (the second extranet side host);

[0351] ⑦ The host on the external network side of the optical gate B sends the UDPLite data message to the host on the internal network side of the optical gate B (the second host on the internal network side);

[0352] ⑧ The host on the internal network side of the optical gate B sends the UDPLite data message to the host on the external network side of the optical gate A; the distribution access module of the host on the external network side of the optical gate A extracts and restores the data into the TCP private protocol and sends it to the DSE front-end;

[0353] ⑨The DSE front-end extracts the service response data from the TCP private protocol and returns it to the service client; at this point, the client completes a service "request-response" processing flow.

[0354] It should be noted that for the physical deployment of the dual one-way optical gate system, Fig. 9 As shown, the host on the intranet side of the optical gate B can be directly connected to the DSE front-end machine through the optical gate network cable, and the host on the extranet side of the optical gate B can be directly connected to the DSE back-end machine through the optical gate network cable, and then bound through the bridge port;

[0355] However, for the logical data flow, although the UDPLite datagram of the host on the internal network side of optical gate B passes through the bridge port of the DSE front-end, it is finally sent to the host on the external network side of optical gate A; similarly, the host on the external network side of optical gate B receives the UDPLite datagram from the host on the internal network side of optical gate A.

[0356] 2. The embodiment of the present invention focuses on the distribution access module on the optical gate, cooperates with WebUI configuration management, and processes multiple tasks. The distribution access module is mainly responsible for converting the single-way bidirectional TCP protocol of the front-end into a two-way unidirectional UDPLite protocol for processing.

[0357] Fig.10 FIG. 1 is a flow chart of the distribution access module processing in the data transmission method based on the dual one-way optical gate system provided by an embodiment of the present invention. Fig.10As shown, the distribution access module is divided into three layers of logic for processing: TCP access layer, protocol switching layer, and UDPLite access layer.

[0358] 1. TCP access layer

[0359] The TCP access layer of the optical gate's distribution access module is mainly responsible for accessing the TCP private protocol from the DSE front-end and back-end machines, extracting business data internally and re-encapsulating it.

[0360] 1) Unified event handling

[0361] In the embodiment of the present invention, a TCP access center processes multiple sessions by one thread, using I / O multiplexing technology. When the distributed access module is started, the following initial events are registered:

[0362] a. Signal processing event registration: If the WebUI operation task is interrupted or the configuration is changed, the corresponding distribution access task will be notified through the signal for processing;

[0363] b. TCP listener event: According to the task configuration of WebUI, register the TCP listener event. If a new TCP connection request arrives, the listener event will be triggered;

[0364] c. Water level controller: After a new TCP session is successfully created, a TCP session context will be allocated and a water level controller will be registered to process the "request-response" TCP message. When new request data arrives, it will first be placed in the receiving buffer and then the request processing function will be triggered. When the receiving buffer is full, data reception will be suspended and a low water level event will be registered. When the receiving buffer data is processed, the processing action will be triggered to resume the TCP receiving action and continue processing TCP data.

[0365] d. Fast timer and slow timer: used in conjunction with triggering DORT session management, responsible for driving multiple DORT sessions.

[0366] Fig.11 FIG. 1 is a flow chart of unified event processing in a data transmission method based on a dual one-way optical gate system provided by an embodiment of the present invention. Fig.11 As shown in the figure, through the above I / O multiplexing technology, each distribution task will handle multiple TCP sessions:

[0367] Session context: Each TCP session will be associated with a DORT session, and the associated information is stored in the session's memory heap space;

[0368] Data buffer: When a TCP request arrives, if the protocol switching layer cannot process it in time, it will be cached in the receiving buffer first and batch processed next time; the data buffer adopts a dynamic linked list structure, and each received data is mounted to a new linked list node. Combined with the water level controller technology, batch data packet processing can be realized.

[0369] 2. Protocol transfer layer

[0370] It is mainly responsible for the linkage between DORT sessions and TCP sessions. DORT sessions are centrally managed by the session manager and connected to the unified event processing of the TCP layer to complete related event driving.

[0371] 1) DORT Session

[0372] a. Transceiver Buffer and ARQ Technology

[0373] After the DORT session extracts the metadata (Payload) in TCP, it encapsulates it into a custom message based on the UDPLite protocol, called a DORT data packet message;

[0374] The embodiment of the present invention uses the ARQ mechanism to achieve reliable data transmission, defines DORT::PSH signaling for metadata+sequence number, and DORT::SACK signaling for confirmation of sequence number set;

[0375] b. Sliding Window Mechanism

[0376] For example, after the DORT session is established, the sn sequence number starts from 1 and increases monotonically for each PSH packet. Assume that the sender is ready to send multiple rounds of data {PSH(1), PSH(2)...PSH(100)} from the queue to be sent. Due to the delayed confirmation mechanism, the receiver marks the DORT::PSH packet while receiving it, but does not directly reply to DORT::SACK, and confirms in batches when the timer is triggered. Compared with the single ACK in the related art, the embodiment of the present invention can make the transmission of the receiving channel more efficient through the range SACK.

[0377] Fig.12 FIG. 1 is one of the schematic diagrams of the sliding window mechanism in the data transmission method based on the dual one-way optical shutter system provided in an embodiment of the present invention. Fig.12 As shown, at this time, the sender has sent to PSH (71), and the receiver has just received PSH (20), una = 7, then construct DORT::SACK = {SACK (7:20)} for confirmation, and then update una = 21;

[0378] Fig.13 FIG. 2 is a second schematic diagram of a sliding window mechanism in a data transmission method based on a dual one-way optical shutter system provided in an embodiment of the present invention. Fig.13 As shown, in combination with the above ARQ mechanism, after the sender processes the first DORT::SACK, there are still {PSH(21), PSH(22)...PSH(71)} in the sent but unconfirmed queue. If there is still sending space, the subsequent {PSH(72), PSH(73)...PSH(100)} will continue to be sent, and nxt=72 will be modified to nxt=101;

[0379] Then the second DORT::SACK={SACK(21:71)} of the receiving end is fed back to the sending end, and the sent unconfirmed mark of the sending end continues to move backward, marking the new una=72, nxt=101 as the sent unconfirmed range;

[0380] Finally, the third DORT::SACK={SACK(72:100)} completes all data transmission and confirmation.

[0381] c. Timeout retransmission mechanism

[0382] The embodiment of the present invention has the concepts and calculation methods of RTO, Round-Trip Time (RTT), and Smooth Round Trip Time (SRTT).

[0383] d. Fast retransmission and fast recovery technology solutions

[0384] 2) DORT Session Management

[0385] The session manager is mainly responsible for indexing DORT sessions, associating TCP session events, and maintaining DORT session status.

[0386] a. Session Manager - Processing of New Connections

[0387] b. Session Manager - Processing of Closing Connections

[0388] c.Session Manager - Finite State Machine (FSM) Design

[0389] The embodiment of the present invention refers to TCP state migration, and adds state machine drive and state migration logic to the DORT session based on the UDPLite protocol.

[0390] d. Message sorter

[0391] In the embodiment of the present invention, data drives events, and all DORT session state machines are processed through message input and timer drive. All DORT session messages within a task are processed by multiplexing a pair of UDPLite channels, and the DORT signaling obtained on the optical gate is uniformly processed by the message sorter. Fig.14 FIG. 1 is a flow chart of message sorter processing in a data transmission method based on a dual one-way optical gate system provided by an embodiment of the present invention. Fig.14 shown.

[0392] S1) Control signaling has a higher priority and is logically processed first and centrally, including: session handshake signaling (DORT::SYN, DORT::ACK1, DORT::ACK2), session termination signaling (DORT::RST), and session hold signaling (DORT::KEEPALIVE).

[0393] S2) Data signaling features a large number of data and carries business data. The signaling sorter first queries the existing DORT session from the session management through the session number Dort-id, and then adds the packet message to the receiving buffer of the corresponding DORT session.

[0394] S3) At the same time, check if the low water mark is set and the send buffer is empty, then trigger a TCP recovery action in the TCP session.

[0395] e. Simple Network Management Protocol (SNMP) counters

[0396] In each distribution access module, SNMP counters are built in units of configured tasks to collect regular data to help business analysis and fault location:

[0397] connects: current DORT session counter;

[0398] accepts: receives newly created counters;

[0399] closed: initiate DORT::FIN to actively close the counter;

[0400] peer-close: counter of passive close received by DORT::FIN;

[0401] syn-timeo: DORT handshake DORT::SYN timeout counter;

[0402] rtt-updated: round-trip time (RTT) statistics counter;

[0403] snd-fastxmit: counter of fast retransmission;

[0404] snd-rexmit: counter for timeout retransmission;

[0405] fast-open: fast open counter of DORT handshake process;

[0406] fast-close: The fast close counter of the DORT close process.

[0407] 3. UDPLite access layer

[0408] In a distributed access task, since all DORT sessions use channel multiplexing technology, a pair of UDPLite sockets are used for sending and receiving processing. Considering the need to support high-speed network transmission, batch processing technology is used to reduce system load, thereby increasing the upper limit of transmission capacity.

[0409] 1) Send child thread

[0410] Fig.15 FIG. 1 is a flow chart of UDPLite access layer processing in a data transmission method based on a dual one-way optical gate system provided in an embodiment of the present invention. Fig.15 As shown, the session manager uniformly stores the data to be sent, and notifies the sending sub-thread after accumulating a certain scale. The sending sub-thread uses the "centralized write" technology to send the DORT data packets. Specifically, multiple data packets are associated through the iovec data structure, and the sendmmsg system call is used to implement batch sending.

[0411] 2) Receiving child thread

[0412] like Fig.15 As shown, the "scattered read" technology is used for processing. Specifically, the receiving sub-thread uniformly uses recvmmsg to first receive the UDPLite message, disassembles multiple DORT groups in the iovec data structure, stores them in the queue, and then notifies the session manager, which then uniformly sorts the messages.

[0413] The embodiment of the present invention mainly designs DORT fast retransmission, congestion control, sliding window and other solutions, and adds session control and state machine mechanism, so that the dual unidirectional optical gate is suitable for high-speed network scenarios, especially 10 Gigabit scenarios.

[0414] 1. Used in dual-optical one-way gate deployment scenarios, using the distributed access module DORT technology solution to support TCP services.

[0415] 2. For the scenario of dual one-way optical gates plus front and rear platforms, the front and rear authorized access is an existing solution, which mainly protects the DORT technical solution of the distribution access module on the dual optical gates.

[0416] The data transmission method based on the dual one-way optical gate system provided in the embodiment of the present invention has the following characteristics:

[0417] Beneficial effects:

[0418] 1. Improve TCP concurrency: Through unified event processing and DORT session management at the TCP layer, the memory overhead and I / O scheduling overhead of a single session are reduced, which can solve the C100K concurrency problem from the software level;

[0419] 2. Increase the number of new TCP services: The session manager uses state machine technology, message sorting technology, and fast and slow timer technology to ensure the reliability of regular sessions and quickly process batch sessions.

[0420] 3. Improve TCP service throughput: The 10G network environment is a challenge for dual optical gates. The present invention adopts a series of optimization measures such as high and low water level control, sliding window, fast retransmission, fast recovery, congestion control, and receiving and sending sub-threads, which can increase the service throughput of the distribution module to 8Gbps~9.5Gbps.

[0421] The data transmission device based on the dual one-way optical gate system provided by the present invention is described below. The data transmission device based on the dual one-way optical gate system described below and the data transmission method based on the dual one-way optical gate system described above can be referenced to each other.

[0422] Fig.16 FIG. 1 is one of the structural schematic diagrams of a data transmission device based on a dual one-way optical shutter system provided by an embodiment of the present invention. Fig.16 As shown, the data transmission device 1600 based on the dual one-way optical gate system can be applied to the first external network side host, and the device includes:

[0423] The first receiving module 1601 is used for extracting the transmission control protocol TCP session data when receiving the TCP session data to obtain metadata in the TCP session data;

[0424] A first sending module 1602 is used to send the metadata to the first intranet-side host through the first optical gate based on a pre-created first session;

[0425] The second receiving module 1603 is used to receive a confirmation number sent by the first intranet-side host via the second extranet-side host and the second intranet-side host, wherein the confirmation number is used to indicate that the session data of the transmission control protocol TCP has been received by the first intranet-side host.

[0426] In the data transmission device based on the dual one-way optical gate system provided by the embodiment of the present invention, the first receiving module can extract metadata in the TCP session data when receiving TCP session data, so that the first sending module can send the metadata to the first intranet side host through the first optical gate based on the pre-created first session, and the second receiving module can receive the confirmation number sent by the first intranet side host via the second external network side host and the second intranet side host to indicate that the TCP session data corresponding to the metadata has been received by the first intranet side host, thereby realizing reliable data transmission in the dual one-way optical gate environment.

[0427] Optionally, the first sending module 1602 is specifically used to: generate a session data packet based on the metadata, and send the session data packet to the first intranet-side host through the first optical gate through a pre-created first session; the session data packet includes the metadata and a sequence number, and the sequence number is a sequence number of the metadata;

[0428] The second receiving module 1603 is specifically used to: receive a set of confirmation numbers sent by the first intranet-side host via the second external-side host and the second intranet-side host; the set of confirmation numbers includes a confirmation number corresponding to the session data packet, and the confirmation number is used to indicate that the corresponding session data packet has been received by the first intranet-side host;

[0429] Optionally, the first sending module 1602 is further specifically configured to:

[0430] Generate a session data packet of the first session based on the metadata, and store the session data packet in a first queue; the first queue is a queue including at least one session data packet to be sent;

[0431] Triggered by a first timer, the session data in the first queue is sent in batches to the first intranet-side host through the first optical gate packets through a pre-created first session, and the batch-sent session data packets are moved from the first queue to a second queue; the second queue is a queue including at least one sent and unconfirmed session data packet;

[0432] The data transmission device 1600 based on the dual one-way optical shutter system also includes:

[0433] The first processing module is used to match the confirmation number in the confirmation number set with the serial number of the session data packet in the second queue, and move the session data packet corresponding to the serial number matching the confirmation number in the second queue to a third queue; the third queue is a queue including at least one sent and confirmed session data packet.

[0434] Optionally, the first processing module is further used for:

[0435] In a case where the confirmation number set does not include a confirmation number matching the sequence number of the target session data packet in the second queue, and the confirmation number set includes a confirmation number matching the sequence number of the next session data packet after the target session data packet in the second queue, detecting whether the next confirmation number set of the confirmation number set includes a confirmation number matching the sequence number of the target session data packet;

[0436] When the confirmation number sets of N consecutive rounds do not include a confirmation number matching the sequence number of the target session data packet, the target session data packet is retransmitted to the first intranet-side host.

[0437] Optionally, the first processing module is further used for:

[0438] When the target session data packet is retransmitted to the first intranet-side host and there is no timed-out and unconfirmed session data packet in the second queue, the current congestion threshold ssthresh is determined based on the length of the second queue using formula (1):

[0439]

[0440] Wherein, nxt represents the sequence number of the last session data packet in the second queue, una represents the sequence number of the first session data packet in the second queue, and nxt-una represents the length of the second queue;

[0441] Based on the current congestion threshold ssthresh, the current congestion window cwnd is determined using formula (2):

[0442] cwnd = ssthresh + 3 (2);

[0443] When the current congestion window is greater than the current congestion threshold, a TCP congestion avoidance algorithm is executed.

[0444] Optionally, the first processing module is further used for:

[0445] When the target session data packet is retransmitted to the first intranet host and there are timed-out and unconfirmed session data packets in the second queue, the current congestion threshold ssthresh is determined based on the current congestion window cwnd using formula (3):

[0446]

[0447] Optionally, the first processing module is further used for:

[0448] When a TCP establishment request is received, converting the TCP establishment request into a first establishment request based on a lightweight user datagram protocol UDPLite protocol, and sending the first establishment request to the first intranet-side host through the UDPLite protocol, where the first establishment request is used to request to establish the first session;

[0449] Receiving a first establishment response based on the UDPLite protocol sent by the first intranet-side host via the second extranet-side host and the second intranet-side host, wherein the first establishment response includes a session number of the first session;

[0450] Based on the first establishment response, a second establishment response based on the UDPLite protocol is sent to the first intranet-side host, wherein the second establishment response includes a session number of the first session.

[0451] Optionally, the first processing module is further used for:

[0452] In the case of receiving a TCP close request, generating a session termination message, and storing the session termination message at the end of the queue in the first queue; the session termination message is used to release the first session;

[0453] In the case that the first queue does not include any unsent session data packets, sending a first closing request to the first intranet-side host and performing delayed deletion processing on the first session; the first closing request includes the session termination message;

[0454] A first closing response is received, which is sent by the first intranet-side host via the second extranet-side host and the second intranet-side host, wherein the first closing response includes a session number of the first session.

[0455] Optionally, the first processing module is further used for:

[0456] receiving a second closing request sent by the first intranet-side host via the second extranet-side host and the second intranet-side host, and releasing the first session; the second closing request is used to indicate that the first session has expired;

[0457] Based on the second closing request, a second closing response is sent to the first intranet-side host, where the second closing response includes the session number of the first session.

[0458] Optionally, the first processing module is further configured to perform at least one of the following operations:

[0459] When the session has been created or released, it is in the initialization state;

[0460] After the first external network-side host sends the first establishment request and does not receive the first establishment response, enter a first semi-connected state, and in the first semi-connected state, wait for receiving the first establishment response and suspend receiving other data except the first establishment response;

[0461] When the first external network-side host sends the second establishment response, entering a session establishment state;

[0462] In the case where the first external network side host has sent the first closing request, entering a first semi-closed state, in which the first external network side host supports sending data cached by the first external network side host, suspends receiving data, and performs delayed deletion processing on the session;

[0463] When the first external network-side host is in a first semi-closed state and the first queue does not include session data packets, entering a first closed waiting state;

[0464] When the first external network side host receives the second closing request, it enters a second semi-closed state. In the second semi-closed state, it supports sending data cached by the first external network side host, suspends receiving data, and performs delayed deletion processing on the session;

[0465] When the first external network-side host is in the second semi-closed state and the first queue does not include session data packets, it enters the second closed waiting state and performs delayed deletion processing on the session.

[0466] Optionally, the second establishment response also includes a session data packet of the first session.

[0467] Optionally, the first sending module 1602 is further specifically configured to: generate a session data packet based on the UDPLite protocol based on the metadata, and send the session data packet to the first intranet-side host through the first optical gate via a pre-created first session.

[0468] Fig.17 FIG. 2 is a second structural diagram of a data transmission device based on a dual one-way optical shutter system provided in an embodiment of the present invention. Fig.17 As shown, the data transmission device 1700 based on the dual one-way optical shutter system can be applied to the first intranet-side host, and the device includes:

[0469] The third receiving module 1701 is used to receive metadata sent by the first external network side host through the first optical gate based on the pre-created first session;

[0470] The second sending module 1702 is used to send the confirmation number corresponding to the metadata to the first external network side host via the second external network side host and the second internal network side host; the confirmation number is used to indicate that the corresponding metadata has been received by the first internal network side host.

[0471] The data transmission device based on the dual one-way optical gate system provided by the embodiment of the present invention can be configured such that the third receiving module can receive metadata sent by the first external network side host through the first optical gate based on the pre-created first session, and the second sending module can send the confirmation number corresponding to the metadata to the first external network side host via the second external network side host and the second internal network side host to indicate that the corresponding metadata has been received by the first internal network side host, thereby realizing reliable data transmission in the dual one-way optical gate environment.

[0472] Optionally, the third receiving module 1701 is specifically used to: receive, through a pre-created first session, a session data packet corresponding to the metadata sent by the first external network-side host through the first optical gate; the session data packet includes the metadata and a sequence number, and the sequence number is a sequence number of the metadata;

[0473] The data transmission device 1700 based on the dual one-way optical shutter system also includes:

[0474] A second processing module is used to construct a confirmation number set for the session data packet; the confirmation number set includes a confirmation number corresponding to the session data packet, and the confirmation number is used to indicate that the corresponding session data packet has been received by the first intranet-side host;

[0475] The second sending module 1702 is specifically configured to send the confirmation number set to the first external network side host via the second external network side host and the second internal network side host.

[0476] Optionally, the third receiving module 1701 is further specifically used to: receive the session data packets sent in batches by the first external network side host through the first optical gate through the pre-created first session, and store the batch sent session data packets in a fourth queue; the fourth queue is a queue including at least one received and unconfirmed session data packet;

[0477] The second processing module is specifically configured to: construct a confirmation number set for at least one session data packet in the fourth queue; the confirmation number set includes a confirmation number corresponding to at least one session data packet;

[0478] The second sending module 1702 is further specifically configured to: trigger, by a second timer, the set of confirmation numbers to be sent in batches to the first external network side host via the second external network side host and the second internal network side host;

[0479] The second processing module is further used for: moving the confirmed session data packet from the fourth queue to the fifth queue; the fifth queue is a queue including at least one received and confirmed session data packet.

[0480] Optionally, the second processing module is further used for:

[0481] receiving a first establishment request from the first external network-side host through a lightweight user datagram protocol UDPLite protocol, wherein the first establishment request is used to request to establish the first session, and the first establishment request is generated based on the UDPLite protocol;

[0482] Based on the first establishment request, assigning a session number of the first session;

[0483] Sending a first establishment response based on the UDPLite protocol to the first external network side host via the second external network side host and the second internal network side host, wherein the first establishment response includes a session number of the first session;

[0484] A second establishment response based on the UDPLite protocol is received from the first external network-side host, wherein the second establishment response includes a session number of the first session.

[0485] Optionally, the second processing module is further used for:

[0486] receiving a first closing request from the first external network-side host, and performing delayed deletion processing on the first session; the first closing request includes a session termination message, and the session termination message is used to release the first session;

[0487] When the fifth queue does not include unsent session data packets, a first closing response is sent to the first external network side host via the second external network side host and the second internal network side host, wherein the first closing response includes the session number of the first session.

[0488] Optionally, the second processing module is further used for:

[0489] Sending a second closing request to the first external network side host via the second external network side host and the second internal network side host, and releasing the first session; the second closing request is used to indicate that the first session has expired;

[0490] A second closing response is received from the first external network-side host, where the second closing response includes a session number of the first session.

[0491] Optionally, the second processing module is further configured to perform at least one of the following operations:

[0492] When the session has been created or released, it is in the initialization state;

[0493] When the first intranet-side host is in a listening state, monitoring the first establishment request;

[0494] When the first intranet-side host receives the first establishment request, the host enters a second semi-connected state, and waits for sending the first establishment response in the second semi-connected state;

[0495] When the first intranet-side host receives the second establishment response, entering a session establishment state;

[0496] When the first intranet-side host receives the first closing request, it enters a second semi-closed state. In the second semi-closed state, it supports sending data cached by the first intranet-side host, suspends receiving data, and performs delayed deletion processing on the session;

[0497] When the first intranet-side host is in the second semi-closed state and the fifth queue does not include the session data packet, entering the second closed waiting state to perform delayed deletion processing on the session;

[0498] In the case where the first intranet-side host has sent the second closing request, entering a first semi-closed state, in which the first intranet-side host supports sending data cached by the first intranet-side host, suspends receiving data, and performs delayed deletion processing on the session;

[0499] When the first intranet-side host is in a first semi-closed state and the fifth queue does not include session data packets, the first closed waiting state is entered.

[0500] Optionally, the second establishment response also includes a session data packet of the first session.

[0501] Optionally, the third receiving module 1701 is further specifically configured to: receive, through a pre-created first session, a session data packet based on the UDPLite protocol corresponding to the metadata sent by the first external network-side host through the first optical gate.

[0502] Fig.18 is a schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention, such as Fig.18As shown, the electronic device 1800 may include: a processor 1810, a communication interface 1820, a memory 1830 and a communication bus 1840, wherein the processor 1810, the communication interface 1820 and the memory 1830 communicate with each other through the communication bus 1840. The processor 1810 may call the logic instructions in the memory 1830 to execute the following data transmission method based on a dual one-way optical gate system, wherein the dual one-way optical gate system includes a first external network side host, a first internal network side host, a first optical gate for controlling the first external network side host to transmit data to the first internal network side host in one direction, a second external network side host, a second internal network side host, and a second optical gate for controlling the second external network side host to transmit data to the second internal network side host in one direction, wherein the method includes:

[0503] When receiving the transmission control protocol TCP session data, the first external network side host extracts the TCP session data to obtain metadata in the TCP session data;

[0504] The first external network-side host sends the metadata to the first internal network-side host through the first optical gate based on the pre-created first session;

[0505] The first external network side host receives a confirmation number sent by the first internal network side host via the second external network side host and the second internal network side host, wherein the confirmation number is used to indicate that the transmission control protocol TCP session data has been received by the first internal network side host;

[0506] or,

[0507] The processor 1810 can call the logic instructions in the memory 1830 to execute the following data transmission method based on the dual one-way optical gate system, wherein the dual one-way optical gate system includes a first external network side host, a first internal network side host, a first optical gate for controlling the first external network side host to unidirectionally transmit data to the first internal network side host, a second external network side host, a second internal network side host, and a second optical gate for controlling the second external network side host to unidirectionally transmit data to the second internal network side host, and the method includes:

[0508] The first intranet-side host receives metadata sent by the first extranet-side host through the first optical gate based on the pre-created first session;

[0509] The first intranet-side host sends a confirmation number corresponding to the metadata to the first external-side host via the second external-side host and the second intranet-side host; the confirmation number is used to indicate that the corresponding metadata has been received by the first intranet-side host.

[0510] In addition, the logic instructions in the above-mentioned memory 1830 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk.

[0511] On the other hand, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the following data transmission method based on a dual one-way optical gate system is implemented, wherein the dual one-way optical gate system includes a first external network side host, a first internal network side host, a first optical gate for controlling the first external network side host to transmit data unidirectionally to the first internal network side host, a second external network side host, a second internal network side host, and a second optical gate for controlling the second external network side host to transmit data unidirectionally to the second internal network side host, wherein the method includes:

[0512] When receiving the transmission control protocol TCP session data, the first external network side host extracts the TCP session data to obtain metadata in the TCP session data;

[0513] The first external network-side host sends the metadata to the first internal network-side host through the first optical gate based on the pre-created first session;

[0514] The first external network side host receives a confirmation number sent by the first internal network side host via the second external network side host and the second internal network side host, wherein the confirmation number is used to indicate that the transmission control protocol TCP session data has been received by the first internal network side host;

[0515] or,

[0516] The following data transmission method based on a dual one-way optical gate system is implemented, wherein the dual one-way optical gate system includes a first external network side host, a first internal network side host, a first optical gate for controlling the first external network side host to unidirectionally transmit data to the first internal network side host, a second external network side host, a second internal network side host, and a second optical gate for controlling the second external network side host to unidirectionally transmit data to the second internal network side host, and the method includes:

[0517] The first intranet-side host receives metadata sent by the first extranet-side host through the first optical gate based on the pre-created first session;

[0518] The first intranet-side host sends a confirmation number corresponding to the metadata to the first external-side host via the second external-side host and the second intranet-side host; the confirmation number is used to indicate that the corresponding metadata has been received by the first intranet-side host.

[0519] On the other hand, an embodiment of the present invention further provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, and when the program instructions are executed by a computer, the following data transmission method based on a dual one-way optical gate system is implemented, the dual one-way optical gate system comprising a first external network side host, a first internal network side host, a first optical gate for controlling the first external network side host to transmit data unidirectionally to the first internal network side host, a second external network side host, a second internal network side host, and a second optical gate for controlling the second external network side host to transmit data unidirectionally to the second internal network side host, the method comprising:

[0520] When receiving the transmission control protocol TCP session data, the first external network side host extracts the TCP session data to obtain metadata in the TCP session data;

[0521] The first external network-side host sends the metadata to the first internal network-side host through the first optical gate based on the pre-created first session;

[0522] The first external network side host receives a confirmation number sent by the first internal network side host via the second external network side host and the second internal network side host, wherein the confirmation number is used to indicate that the transmission control protocol TCP session data has been received by the first internal network side host;

[0523] or,

[0524] The following data transmission method based on a dual one-way optical gate system is implemented, wherein the dual one-way optical gate system includes a first external network side host, a first internal network side host, a first optical gate for controlling the first external network side host to unidirectionally transmit data to the first internal network side host, a second external network side host, a second internal network side host, and a second optical gate for controlling the second external network side host to unidirectionally transmit data to the second internal network side host, and the method includes:

[0525] The first intranet-side host receives metadata sent by the first extranet-side host through the first optical gate based on the pre-created first session;

[0526] The first intranet-side host sends a confirmation number corresponding to the metadata to the first external-side host via the second external-side host and the second intranet-side host; the confirmation number is used to indicate that the corresponding metadata has been received by the first intranet-side host.

[0527] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0528] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0529] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data transmission method based on a dual one-way optical shutter system, characterized in that: The dual one-way optical gate system includes a first external network side host, a first internal network side host, a first optical gate for controlling the first external network side host to transmit data to the first internal network side host in one direction, a second external network side host, a second internal network side host, and a second optical gate for controlling the second external network side host to transmit data to the second internal network side host in one direction, the first optical gate is arranged between the first external network side host and the first internal network side host, and the second optical gate is arranged between the second external network side host and the second internal network side host, and the method includes: When receiving the transmission control protocol TCP session data, the first external network side host extracts the TCP session data to obtain metadata in the TCP session data; The first external network-side host sends the metadata to the first internal network-side host through the first optical gate based on the pre-created first session; The first external network side host receives a confirmation number sent by the first internal network side host via the second external network side host and the second internal network side host, wherein the confirmation number is used to indicate that the transmission control protocol TCP session data has been received by the first internal network side host; The first external network-side host sends the metadata to the first internal network-side host through the first optical gate based on the pre-created first session, including: When receiving the TCP establishment request, the first external network-side host converts the TCP establishment request into a first establishment request based on the lightweight user datagram protocol UDPLite protocol, and sends the first establishment request to the first internal network-side host through the UDPLite protocol, wherein the first establishment request is used to request to establish the first session, and the first establishment request includes a DORT::SYN message, and the DORT::SYN message includes a random number cookie and a timestamp ts, and the session corresponding to the first establishment request is maintained in the semi-connected queue SYN-Queue in the form of a cookie; The first external network-side host receives a first establishment response based on the UDPLite protocol sent by the first internal network-side host via the second external network-side host and the second internal network-side host, wherein the first establishment response includes a session number of the first session; the session corresponding to the first establishment response is in a semi-connected queue SYN-Queue, using Dort-id as an index; Based on the first establishment response, the first external network host indexes the session corresponding to the first establishment response from the SYN-Queue, moves the session corresponding to the first establishment response to the full connection queue Establish-Queue, and uses Dort-id as an index to send a second establishment response based on the UDPLite protocol to the first internal network host, where the second establishment response includes the session number of the first session; The first external network side host generates a session data packet based on the metadata, and sends the session data packet to the first internal network side host through the first optical gate via a pre-created first session; the session data packet includes the metadata and a sequence number, and the sequence number is a sequence number of the metadata; The first external network-side host receives a confirmation number sent by the first internal network-side host via the second external network-side host and the second internal network-side host, including: The first external network host receives a confirmation number set sent by the first internal network host via the second external network host and the second internal network host; the confirmation number set includes a confirmation number corresponding to the session data packet, and the confirmation number is used to indicate that the corresponding session data packet has been received by the first internal network host.

2. The method according to claim 1, characterized in that The first external network host generates a session data packet based on the metadata, and sends the session data packet to the first internal network host through the first optical gate through a pre-created first session, including: The first external network-side host generates a session data packet of the first session based on the metadata, and stores the session data packet in a first queue; the first queue is a queue including at least one session data packet to be sent; The first external network host is triggered by a first timer, and sends the session data in the first queue to the first internal network host in batches through the first optical gate packets through a pre-created first session, and moves the batch-sent session data packets from the first queue to a second queue; the second queue is a queue including at least one sent and unconfirmed session data packet; After the first external network-side host receives the confirmation number set sent by the first internal network-side host via the second external network-side host and the second internal network-side host, the method further includes: The first external network host matches the confirmation number in the confirmation number set with the serial number of the session data packet in the second queue, and moves the session data packet corresponding to the serial number matching the confirmation number in the second queue to the third queue; the third queue is a queue including at least one sent and confirmed session data packet.

3. The method according to claim 2, characterized in that The method further comprises: When the first external network-side host does not include a confirmation number matching the sequence number of the target session data packet in the second queue in the confirmation number set, and the confirmation number set includes a confirmation number matching the sequence number of the next session data packet after the target session data packet in the second queue, detecting whether the next confirmation number set of the confirmation number set includes a confirmation number matching the sequence number of the target session data packet; When the first external network-side host does not include a confirmation number matching the sequence number of the target session data packet in N consecutive rounds of confirmation number sets, the first external network-side host retransmits the target session data packet to the first internal network-side host.

4. The method according to claim 3, characterized in that The method further comprises: When the first external network host retransmits the target session data packet to the first internal network host and there is no timed-out and unconfirmed session data packet in the second queue, the current congestion threshold ssthresh is determined based on the length of the second queue using formula (1): Wherein, nxt represents the sequence number of the last session data packet in the second queue, una represents the sequence number of the first session data packet in the second queue, and nxt-una represents the length of the second queue; The first external network-side host determines the current congestion window cwnd based on the current congestion threshold ssthresh using formula (2): cwnd = ssthresh + 3 (2); The first external network-side host executes a TCP congestion avoidance algorithm when the current congestion window is greater than the current congestion threshold.

5. The method according to claim 4, characterized in that The method further comprises: When the first external network host retransmits the target session data packet to the first internal network host and there are timed-out and unconfirmed session data packets in the second queue, the current congestion threshold ssthresh is determined based on the current congestion window cwnd using formula (3):

6. The method according to claim 1, characterized in that The method further comprises: When the first external network host receives the TCP close request, it generates a session termination message and stores the session termination message at the end of the queue in the first queue; the session termination message is used to release the first session; When the first queue does not include any unsent session data packets, the first external network host sends a first closing request to the first internal network host and performs delayed deletion processing on the first session; the first closing request includes the session termination message; The first external-network-side host receives a first closing response sent by the first internal-network-side host via the second external-network-side host and the second internal-network-side host, wherein the first closing response includes a session number of the first session.

7. The method according to claim 6, characterized in that The method further comprises: The first external network side host receives a second closing request sent by the first internal network side host via the second external network side host and the second internal network side host, and releases the first session; the second closing request is used to indicate that the first session has expired; The first external network-side host sends a second closing response to the first internal network-side host based on the second closing request, where the second closing response includes the session number of the first session.

8. The method according to claim 7, characterized in that The method further comprises at least one of the following: When the session has been created or the session has been released, the first external network host is in an initialization state; After the first external network side host sends the first establishment request and does not receive the first establishment response, the first external network side host enters a first semi-connected state, in which the first external network side host waits to receive the first establishment response and suspends receiving other data except the first establishment response; When the first external network side host sends the second establishment response, the first external network side host enters a session establishment state; In the case where the first external network side host has sent the first closing request, the first external network side host enters a first semi-closed state, and in the first semi-closed state, the first external network side host supports sending data cached by the first external network side host, suspends receiving data, and performs delayed deletion processing on the session; When the first external network side host is in a first semi-closed state and the first queue does not include session data packets, the first external network side host enters a first closed waiting state; When the first external network side host receives the second closing request, the first external network side host enters a second semi-closed state, and in the second semi-closed state, the first external network side host supports sending data cached by the first external network side host, suspends receiving data, and performs delayed deletion processing on the session; When the first external network side host is in the second semi-closed state and the first queue does not include session data packets, the first external network side host enters the second closed waiting state and performs delayed deletion processing on the session.

9. The method according to claim 1, characterized in that: The second establishment response also includes a session data packet of the first session.

10. The method according to any one of claims 1 to 9, characterized in that: The first external network-side host sends the metadata to the first internal network-side host through the first optical gate based on the pre-created first session, including: The first external network-side host generates a session data packet based on the UDPLite protocol based on the metadata, and sends the session data packet to the first internal network-side host through the first optical gate via a pre-created first session.

11. A data transmission method based on a dual one-way optical shutter system, characterized in that: The dual one-way optical gate system includes a first external network side host, a first internal network side host, a first optical gate for controlling the first external network side host to transmit data to the first internal network side host in one direction, a second external network side host, a second internal network side host, and a second optical gate for controlling the second external network side host to transmit data to the second internal network side host in one direction, the first optical gate is arranged between the first external network side host and the first internal network side host, and the second optical gate is arranged between the second external network side host and the second internal network side host, and the method includes: The first intranet-side host receives metadata sent by the first extranet-side host through the first optical gate based on the pre-created first session; The first intranet-side host sends a confirmation number corresponding to the metadata to the first external-side host via the second external-side host and the second intranet-side host; the confirmation number is used to indicate that the corresponding metadata has been received by the first intranet-side host; The first intranet-side host receives metadata sent by the first extranet-side host through the first optical gate based on the pre-created first session, including: The first intranet-side host receives a first establishment request from the first extranet-side host through a lightweight user datagram protocol UDPLite protocol, wherein the first establishment request is used to request establishment of the first session, and the first establishment request is generated based on the UDPLite protocol; the first establishment request includes a DORT::SYN message, and the DORT::SYN message includes a random number cookie and a timestamp ts, and the session corresponding to the first establishment request is maintained in a semi-connected queue SYN-Queue in the form of a cookie; The first intranet-side host allocates a session number of the first session based on the first establishment request; The first intranet-side host sends a first establishment response based on the UDPLite protocol to the first external-side host via the second external-side host and the second intranet-side host, wherein the first establishment response includes a session number of the first session; the session corresponding to the first establishment response is in a semi-connected queue SYN-Queue, using Dort-id as an index; The first intranet-side host receives a second establishment response based on the UDPLite protocol from the first extranet-side host, wherein the second establishment response includes a session number of the first session; the second establishment response is sent by the first extranet-side host after indexing the session corresponding to the first establishment response from the SYN-Queue based on the first establishment response, and moving the session corresponding to the first establishment response to the full connection queue Establish-Queue, using the Dort-id as an index; The first intranet-side host receives, through a pre-created first session, a session data packet corresponding to the metadata sent by the first extranet-side host through the first optical gate; the session data packet includes the metadata and a sequence number, and the sequence number is a sequence number of the metadata; The method further comprises: The first intranet-side host constructs a confirmation number set for the session data packet; the confirmation number set includes a confirmation number corresponding to the session data packet, and the confirmation number is used to indicate that the corresponding session data packet has been received by the first intranet-side host; The first intranet-side host sends the confirmation number corresponding to the metadata to the first external-side host via the second external-side host and the second intranet-side host, including: The first intranet-side host sends the confirmation number set to the first extranet-side host via the second extranet-side host and the second intranet-side host.

12. The method according to claim 11, characterized in that The first intranet-side host receives, through a pre-created first session, a session data packet corresponding to metadata sent by the first extranet-side host through the first optical gate, including: The first intranet-side host receives the session data packets sent in batches by the first extranet-side host through the first optical gate through the pre-created first session, and stores the batch-sent session data packets in a fourth queue; the fourth queue is a queue including at least one received and unconfirmed session data packet; The first intranet-side host constructs a confirmation number set for the session data group, including: The first intranet-side host constructs a confirmation number set for at least one session data packet in the fourth queue; the confirmation number set includes a confirmation number corresponding to at least one session data packet; The first intranet-side host sends the confirmation number set to the first external-side host via the second external-side host and the second intranet-side host, including: The first intranet-side host is triggered by a second timer to send the set of confirmation numbers in batches to the first extranet-side host via the second extranet-side host and the second intranet-side host; The method further comprises: The first intranet-side host moves the confirmed session data packet from the fourth queue to the fifth queue; the fifth queue is a queue including at least one received and confirmed session data packet.

13. The method according to claim 11, characterized in that The method further comprises: The first intranet-side host receives a first closing request from the first extranet-side host, and performs delayed deletion processing on the first session; the first closing request includes a session termination message, and the session termination message is used to release the first session; When the first intranet-side host does not include any unsent session data packets in the fifth queue, the first intranet-side host sends a first closing response to the first external-side host via the second external-side host and the second intranet-side host, wherein the first closing response includes the session number of the first session.

14. The method according to claim 13, characterized in that The method further comprises: The first intranet-side host sends a second closing request to the first external-side host via the second external-side host and the second intranet-side host, and releases the first session; the second closing request is used to indicate that the first session has expired; The first intranet-side host receives a second closing response from the first extranet-side host, where the second closing response includes a session number of the first session.

15. The method according to claim 14, characterized in that The method further comprises at least one of the following: When the session has been created or the session has been released, the first intranet-side host is in an initialization state; When the first intranet-side host is in a listening state, the first intranet-side host listens to the first establishment request; When the first intranet-side host receives the first establishment request, the first intranet-side host enters a second semi-connected state, and the first intranet-side host waits to send the first establishment response in the second semi-connected state; When the first intranet-side host receives the second establishment response, the first intranet-side host enters a session establishment state; When the first intranet-side host receives the first closing request, the first intranet-side host enters a second semi-closed state, and in the second semi-closed state, the first intranet-side host supports sending data cached by the first intranet-side host, suspends receiving data, and performs delayed deletion processing on the session; When the first intranet-side host is in the second semi-closed state and the fifth queue does not include the session data packet, the first intranet-side host enters the second closed waiting state and performs delayed deletion processing on the session; In the case where the first intranet-side host has sent the second closing request, the first intranet-side host enters a first semi-closed state, and in the first semi-closed state, the first intranet-side host supports sending data cached by the first intranet-side host, suspends receiving data, and performs delayed deletion processing on the session; When the first intranet-side host is in a first semi-closed state and the fifth queue does not include session data packets, the first intranet-side host enters a first closed waiting state.

16. The method according to claim 12, characterized in that The second establishment response also includes a session data packet of the first session.

17. The method according to any one of claims 12 to 16, characterized in that: The first intranet-side host receives metadata sent by the first extranet-side host through the first optical gate based on the pre-created first session, including: The first intranet-side host receives, through a pre-created first session, a session data packet based on the UDPLite protocol corresponding to the metadata sent by the first extranet-side host through the first optical gate.

18. A data transmission device based on a dual one-way optical shutter system, characterized in that: The dual one-way optical gate system includes a first external network side host, a first internal network side host, a first optical gate for controlling the first external network side host to transmit data to the first internal network side host in one direction, a second external network side host, a second internal network side host, and a second optical gate for controlling the second external network side host to transmit data to the second internal network side host in one direction, the first optical gate is arranged between the first external network side host and the first internal network side host, and the second optical gate is arranged between the second external network side host and the second internal network side host, and the device includes: A first receiving module is used to extract the transmission control protocol TCP session data when the TCP session data is received, so as to obtain metadata in the TCP session data; A first sending module, configured to send the metadata to the first intranet-side host through the first optical gate based on a pre-created first session; The first processing module is used for, when receiving a TCP establishment request, converting the TCP establishment request into a first establishment request based on a lightweight user datagram protocol UDPLite protocol, sending the first establishment request to the first intranet-side host through the UDPLite protocol, wherein the first establishment request is used to request to establish the first session, the first establishment request includes a DORT::SYN message, the DORT::SYN message includes a random number cookie and a timestamp ts, and the session corresponding to the first establishment request is maintained in a semi-connected queue SYN-Queue in the form of a cookie; receiving the first intranet-side host via the second external network-side host and a first establishment response based on the UDPLite protocol sent by the second intranet-side host, wherein the first establishment response includes the session number of the first session; the session corresponding to the first establishment response is in the semi-connection queue SYN-Queue, using Dort-id as an index; based on the first establishment response, index the session corresponding to the first establishment response from the SYN-Queue, and move the session corresponding to the first establishment response to the full-connection queue Establish-Queue, using Dort-id as an index, and sending a second establishment response based on the UDPLite protocol to the first intranet-side host, wherein the second establishment response includes the session number of the first session; A second receiving module is used to receive a confirmation number sent by the first intranet-side host via the second external-network-side host and the second intranet-side host, wherein the confirmation number is used to indicate that the session data of the transmission control protocol TCP has been received by the first intranet-side host; The first sending module is specifically configured to generate a session data packet based on the metadata, and send the session data packet to the first intranet-side host through the first optical gate via a pre-created first session; the session data packet includes the metadata and a sequence number, and the sequence number is a sequence number of the metadata; The second receiving module is specifically used to receive a confirmation number set sent by the first intranet side host via the second external network side host and the second intranet side host; the confirmation number set includes a confirmation number corresponding to the session data packet, and the confirmation number is used to indicate that the corresponding session data packet has been received by the first intranet side host.

19. A data transmission device based on a dual one-way optical shutter system, characterized in that: The dual one-way optical gate system includes a first external network side host, a first internal network side host, a first optical gate for controlling the first external network side host to transmit data to the first internal network side host in one direction, a second external network side host, a second internal network side host, and a second optical gate for controlling the second external network side host to transmit data to the second internal network side host in one direction, the first optical gate is arranged between the first external network side host and the first internal network side host, and the second optical gate is arranged between the second external network side host and the second internal network side host, and the device includes: A third receiving module, configured to receive metadata sent by the first external network-side host through the first optical gate based on the pre-created first session; A second sending module, configured to send a confirmation number corresponding to the metadata to the first external network side host via the second external network side host and the second internal network side host; the confirmation number is used to indicate that the corresponding metadata has been received by the first internal network side host; The second processing module is used to receive a first establishment request from the first external network side host through the lightweight user datagram protocol UDPLite protocol, the first establishment request is used to request to establish the first session, and the first establishment request is generated based on the UDPLite protocol; the first establishment request includes a DORT::SYN message, the DORT::SYN message includes a random number cookie and a timestamp ts, and the session corresponding to the first establishment request is in a semi-connected queue SYN-Queue and is maintained in the form of a cookie; based on the first establishment request, a session number of the first session is allocated; and a session number of the first session is sent to the first external network side host via the second external network side host and the second internal network side host. A first establishment response based on the UDPLite protocol, wherein the first establishment response includes the session number of the first session; the session corresponding to the first establishment response is in the semi-connection queue SYN-Queue, and Dort-id is used as an index; a second establishment response based on the UDPLite protocol is received from the first external network side host, wherein the second establishment response includes the session number of the first session; the second establishment response is the first external network side host indexing the session corresponding to the first establishment response from the SYN-Queue based on the first establishment response, and moving the session corresponding to the first establishment response to the full connection queue Establish-Queue, and sending it after using Dort-id as an index; The third receiving module is specifically used to receive, through the pre-created first session, a session data packet corresponding to the metadata sent by the first external network side host through the first optical gate; the session data packet includes the metadata and a sequence number, and the sequence number is a sequence number of the metadata; The second processing module is further used to construct a confirmation number set for the session data packet; the confirmation number set includes a confirmation number corresponding to the session data packet, and the confirmation number is used to indicate that the corresponding session data packet has been received by the first intranet-side host; The second sending module is specifically configured to send the confirmation number set to the first external network side host via the second external network side host and the second internal network side host.

20. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the data transmission method based on the dual one-way optical gate system as described in any one of claims 1 to 10 is implemented, or the data transmission method based on the dual one-way optical gate system as described in any one of claims 11 to 17 is implemented.

21. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the data transmission method based on the dual one-way optical gate system as described in any one of claims 1 to 10, or implements the data transmission method based on the dual one-way optical gate system as described in any one of claims 11 to 17.

22. A computer program product having executable instructions stored thereon, characterized in that: When the instruction is executed by the processor, the processor implements the data transmission method based on the dual one-way optical gate system as described in any one of claims 1 to 10, or implements the data transmission method based on the dual one-way optical gate system as described in any one of claims 11 to 17.

Images