Network gate penetration method, system, MQTT client, MQTT server and electronic device

Abstract

The embodiment of the present invention is applicable to the field of computer technology, and provides a network gate penetration method, system, MQTT client, MQTT server and electronic device, wherein the network gate penetration method is applied to the message queue telemetry transmission protocol MQTT client in the first network, the MQTT client is called by the data acquisition program in the first network in the form of a library, and the data acquisition program is used to send the collected data to the MQTT server in the second network through the MQTT client, and the network gate penetration method includes: generating a fixed header of the request message; setting the value of the flag bit in the fixed header to a set value; encapsulating the request message based on the fixed header; sending the encapsulated request message to the MQTT server in the second network through a one-way network gate, so that the MQTT server returns a response message that meets the network gate penetration condition according to the request message; the network gate penetration condition represents that all bytes of the response message are all 1 or 0; the first network and the second network are isolated by a one-way network gate.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a network gate penetration method, system, MQTT client, MQTT server and electronic equipment. Background Art

[0002] A one-way air gap is a security isolation device that allows data to be transmitted from an internal network to an external network, but only allows specific data to be transmitted from the external network to the internal network. Related technologies have developed a set of client and server programs that can penetrate the air gap to meet the requirements. However, these self-developed methods lack standardized implementation standards, resulting in poor versatility for applications on edge computing platforms, requiring application modification and adaptation. Summary of the Invention

[0003] In order to solve the above problems, the embodiments of the present invention provide a network gate penetration method, system, MQTT client, MQTT server and electronic device to at least solve the problem that related technical applications need to be modified to achieve network gate penetration.

[0004] The technical solution of the present invention is achieved as follows:

[0005] In one aspect, an embodiment of the present invention provides a network gate penetration method, which is applied to a message queue telemetry transmission protocol MQTT client in a first network. The MQTT client is called by a data acquisition program in the first network in the form of a library. The data acquisition program is used to send collected data through the MQTT client to an MQTT server in a second network. The network gate penetration method includes:

[0006] Generate a fixed header of the request message; the value of the set flag bit in the fixed header is a set value;

[0007] Encapsulating the request message based on the fixed header;

[0008] The encapsulated request message is sent to the MQTT server in the second network through a one-way network gate, so that the MQTT server returns a response message that meets the network gate penetration condition according to the request message; the network gate penetration condition indicates that all bytes of the response message are 1 or 0; the first network and the second network are isolated by the one-way network gate.

[0009] In the above solution, the request message includes any one of the following:

[0010] Connection request message;

[0011] Connection keepalive request message.

[0012] In the above solution, if the request message is a connection request message, the method further includes:

[0013] If a response message is received from the MQTT server, it is determined that the connection between the MQTT client and the MQTT server is successfully established.

[0014] In the above solution, after the connection between the MQTT client and the MQTT server is successfully established, the method further includes:

[0015] A message with a message topic is published to the MQTT server; the message represents the collected data of the data collection program; the QoS service quality level between the MQTT client and the MQTT server is 0.

[0016] On the other hand, an embodiment of the present invention provides another network gate penetration method, which is applied to the MQTT server in the above aspect, wherein the MQTT server is located in the second network, and the method includes:

[0017] Receiving a request message sent by an MQTT client in a first network; the first network and the second network are isolated by a one-way network firewall;

[0018] If the value of the set flag bit in the fixed header of the request message is a set value, generating a response message that meets a gatekeeper penetration condition according to the request message; the gatekeeper penetration condition indicates that all bytes of the response message are 1 or 0;

[0019] The response message is sent to the MQTT client.

[0020] In the above solution, the method further includes:

[0021] Receiving a message with a message topic published by the MQTT client; the message represents the collected data of the data collection program; wherein the quality of service level QoS between the MQTT client and the MQTT server is 0;

[0022] The message is distributed to corresponding subscribers based on the subscription topic.

[0023] In another aspect, an embodiment of the present invention provides a network gate penetration system, comprising:

[0024] The data acquisition device in the first network is used to send the collected data to the MQTT server in the second network through the MQTT client, and the MQTT client is called by the data acquisition device in the form of a library;

[0025] The MQTT client is configured to generate a fixed header of a request message, wherein the value of a set flag in the fixed header is a set value; encapsulate the request message based on the fixed header; and send the encapsulated request message to the MQTT server in the second network through a one-way gateway;

[0026] An MQTT server is configured to receive a request message sent by the MQTT client, and if the value of a set flag bit in a fixed header of the request message is a set value, generate a response message that meets a gatekeeper penetration condition based on the request message, and send the response message to the MQTT client; the gatekeeper penetration condition indicates that all bytes of the response message are 1 or 0; and the first network and the second network are isolated by the unidirectional gatekeeper.

[0027] On the other hand, an embodiment of the present invention provides an MQTT client, which includes:

[0028] A first generating module is configured to generate a fixed header of a request message; the value of a setting flag bit in the fixed header is a set value;

[0029] An encapsulation module, configured to encapsulate the request message based on the fixed header;

[0030] The first sending module is used to send the encapsulated request message to the MQTT server in the second network through a one-way network gate, so that the MQTT server returns a response message that meets the network gate penetration condition according to the request message; the network gate penetration condition indicates that all bytes of the response message are 1 or 0; the first network and the second network are isolated by the one-way network gate.

[0031] On the other hand, an embodiment of the present invention provides an MQTT server, the MQTT server comprising:

[0032] A receiving module, configured to receive a request message sent by an MQTT client in a first network; the first network and the second network are isolated by a one-way firewall;

[0033] a second generating module configured to generate, if the value of the set flag bit in the fixed header of the request message is a set value, a response message that satisfies a gatekeeper penetration condition according to the request message; the gatekeeper penetration condition indicates that all bytes of the response message are 1 or 0;

[0034] The second sending module is used to send the response message to the MQTT client.

[0035] On the other hand, an embodiment of the present invention provides an electronic device, including a processor and a memory, which are connected to each other, wherein the memory is used to store a computer program, the computer program includes program instructions, and the processor is configured to call the program instructions to execute the steps of the network gate penetration method provided in the first aspect of the embodiment of the present invention.

[0036] In another aspect, an embodiment of the present invention provides a computer-readable storage medium, comprising: the computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the steps of the network gate penetration method provided in the first aspect of the embodiment of the present invention are implemented.

[0037] In this embodiment, the MQTT client is deployed in the form of a library in the first network for the data acquisition program to call. The data acquisition program sends the collected device data to the MQTT server in the second network through the MQTT client. Since the data acquisition program communicates with the MQTT server by calling the MQTT client library, the data acquisition program does not need to be modified (no code modification is required). Moreover, the MQTT client library is highly versatile, and any data acquisition program that supports the MQTT protocol can call the MQTT client library. The MQTT client generates a fixed header for the request message, encapsulates the request message based on the fixed header, and sends the encapsulated request message to the MQTT server in the second network through a one-way network switch, so that the MQTT server returns a response message that meets the network switch penetration condition according to the request message. Among them, the value of the set flag bit in the fixed header is the set value, all bytes of the response message are 1 or 0, and the first network and the second network are isolated by the one-way network switch. This embodiment sets the value of the set flag bit in the fixed header of the request message to a set value, so that the MQTT server can generate a response message that meets the network gate penetration condition (all bytes are 1 or 0), so that the response message can smoothly penetrate the unidirectional network gate, realizing two-way penetration of traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 This is a system architecture diagram of a network gate penetration solution provided by an embodiment of the present invention;

[0039] Figure 2 This is a schematic diagram of the implementation process of a network gate penetration method provided by an embodiment of the present invention;

[0040] Figure 3 This is a schematic diagram of the format of a fixed header of a connection request message provided by an embodiment of the present invention;

[0041] Figure 4 This is a schematic diagram of the format of a fixed header of a connection keep-alive request message provided by an embodiment of the present invention;

[0042] Figure 5 This is a schematic diagram of the message format of a response message provided by an embodiment of the present invention;

[0043] Figure 6 This is a schematic diagram of the implementation process of a network gate penetration method provided by an embodiment of the present invention;

[0044] Figure 7 Schematic diagram of a network gate penetration system provided by an embodiment of the present invention;

[0045] Figure 8 This is a system architecture diagram of a network gate penetration solution provided by an application embodiment of the present invention;

[0046] Figure 9 This is a flow chart of the forwarding logic of a connection request message provided by an application embodiment of the present invention;

[0047] Figure 10 This is a flow chart of the forwarding logic of a connection keep-alive request message provided by an application embodiment of the present invention;

[0048] Figure 11 is a schematic diagram of an MQTT client provided by an embodiment of the present invention;

[0049] Figure 12 is a schematic diagram of an MQTT server provided by an embodiment of the present invention;

[0050] Figure 13 FIG. 1 is a schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0051] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0052] With the rapid development of network technology, conducting business over the Internet has become an important way for governments, enterprises, etc. to work. However, the Internet office method inevitably needs to be connected to the external network. At this time, in order to ensure the security of the internal networks of governments, enterprises, etc., a security isolation network gateway is usually set up between the internal and external networks to achieve physical isolation between the internal and external networks, thereby avoiding external network threats.

[0053] A unidirectional airlock (both forward and reverse) is a security isolation airlock that allows data from the internal network to the external network, but only allows specific data from the external network to the internal network. For example, a forward airlock allows traffic from the production network to pass, but only allows specific traffic from non-production networks to pass, blocking all other traffic from non-production networks. The production network can refer to the network where the edge computing nodes reside, while the non-production network refers to the network where the central management nodes reside.

[0054] For example, in edge computing scenarios, industrial platforms need to collect monitoring and alarm data from production equipment to analyze product quality, equipment status, and other issues, as well as conduct real-time monitoring. Specifically, data collection programs in the production network need to send collected data to data receiving programs in non-production networks. This process typically involves two-way data transmission (for example, exchanging user data and confirming transmission results).

[0055] However, the physical isolation of the network brings a lot of inconvenience to data communication. The applications in the original network do not have the ability to penetrate the network firewall. When a one-way network firewall is deployed between the internal network and the external network, the applications need to be able to meet the penetration requirements of the one-way network firewall.

[0056] There are two solutions in related technology that can achieve network firewall penetration. The first solution is to use the Transmission Control Protocol (TCP) / User Datagram Protocol (UDP) to independently develop a set of client and server programs that can penetrate the one-way network firewall. This set of programs meets the requirements for one-way network firewall penetration. That is, message data is only sent in one direction (the direction allowed by the one-way network firewall), and data is not sent in the opposite direction or only specific messages allowed by the network firewall device are sent (TCP connection can be established normally because user data is not involved in the connection process and the network firewall device allows it to pass). The second solution is to use E language to ferry files, convert the data to be sent out into an E language description file, and then transmit it through the ferrying capability of the one-way network firewall (the network firewall device supports E language file ferrying).

[0057] The first solution has the following disadvantages: 1. Self-developed applications are not universally applicable to edge computing applications. Applications (or third-party programs) cannot be used without modification and adaptation. 2. Self-developed implementation standards are not unified, making modification of third-party programs difficult or even impossible.

[0058] The second solution has the following drawbacks: The E-language method requires data to be converted into an E-language file, resulting in poor data transmission efficiency and high latency. Furthermore, most existing applications are designed based on TCP / UDP communication, making adaptation difficult.

[0059] In view of the shortcomings of the above-mentioned related technologies, the embodiments of the present invention provide a network gate penetration method, which enables applications to have the network gate penetration capability without modification. To illustrate the technical solution of the present invention, a specific embodiment is described below.

[0060] Figure 1 This is a system architecture diagram of a network gate penetration solution provided by an embodiment of the present invention, in which the production network includes multiple production devices, the data collection program collects data from the production devices, and sends the collected data to the data receiving program in the non-production network through the Message Queuing Telemetry Transport Protocol (MQTT).

[0061] In this embodiment, an MQTT client (MQTT Client) is deployed on the production network side, and an MQTT server (MQTT Broker) is deployed on the non-production network side.

[0062] The MQTT Client is deployed in production networks as a library. A library is pre-written, reusable code. Every program relies on many underlying libraries. Essentially, a library is a binary representation of executable code. Libraries come in two types: static libraries (.a.lib) and dynamic libraries (.so.dll). Data collection programs call the MQTT Client library to send collected data to the MQTT Broker.

[0063] MQTT communication is implemented through a publish / subscribe model, where subscriptions and publications are based on topics. Publishers and subscribers connect through an MQTT broker. Through an MQTT broker, a publisher can send a topic message to the broker, and other subscribers receive push notifications from the broker through the message subscription mechanism.

[0064] exist Figure 1 In the MQTT broker, the MQTT client (publisher) needs to establish an MQTT connection with the MQTT broker first, and then publish a message with a message topic (the collected data of the data collection program) to the MQTT broker. During the connection, the MQTT client and the MQTT broker keep each other alive through ping messages.

[0065] The production network and non-production network are isolated by a forward network gate. The forward network gate allows traffic from the production network to pass through, while only allowing specific messages (messages with all 0 or all 1 bytes) to pass through the non-production network. Other traffic from the non-production network is not allowed to pass through.

[0066] As a publisher (MQTT client), the collection service must first establish an MQTT connection with the MQTT broker (bidirectional traffic), then publish messages to the MQTT broker (supporting unidirectional traffic). After the connection is established, a keepalive action is required (bidirectional traffic). When the production and non-production networks are separated by a one-way firewall, both the MQTT connection and keepalive response messages will be intercepted by the one-way firewall, causing them to malfunction. Therefore, applications directly implemented using native MQTT cannot penetrate the one-way firewall.

[0067] This embodiment extends the MQTT protocol. On the MQTT Client side, the request message sent by the MQTT Client is extended, and the value of the set flag bit in the fixed header of the request message is set to a set value (for example, 1), indicating that network gate penetration is required.

[0068] On the MQTT Broker side, the MQTT Client's response message is expanded. Because the one-way network firewall only allows specific messages (all 0 or all 1 bytes) from non-production networks to pass through, the response message is converted to all 0 or all 1 bytes.

[0069] The MQTT Broker supports communication with both extended and native MQTT Clients. Upon receiving a request message from an MQTT Client, if the MQTT Broker finds that the value of the set flag in the fixed header of the request message is the set value, it will reply with a response message that meets the gatekeeper penetration criteria (a response message containing all 1 or all 0 bytes). This response message can penetrate the unit gatekeeper and reach the MQTT Client. If the value of the set flag in the fixed header of the received request message is not the set value, the Broker will reply with a regular response message, which cannot penetrate the one-way gatekeeper.

[0070] After the above deployment and transformation, the MQTT server on the non-production network can successfully pass through the network gate to send response messages to the MQTT client on the production network, thereby establishing an MQTT connection and maintaining the connection alive. After the MQTT connection is established, any data collection program deployed on the production network can use the MQTT client to smoothly pass through the network gate to send collected data to the MQTT server on the non-production network, and then forward it to the data receiving program that subscribes to the message on the MQTT server.

[0071] Because data collection programs communicate with MQTT servers by calling the MQTT Client library, no modifications are required to the data collection programs themselves. Furthermore, this approach is highly versatile and can be used with any data collection program that supports the MQTT protocol. In edge computing scenarios, third-party programs based on MQTT communication can achieve network gatekeeper penetration without code modifications.

[0072] Figure 2 This is a schematic diagram of the implementation process of a network gate penetration method provided by an embodiment of the present invention. The network gate penetration method can be applied to the above Figure 1 The MQTT client in the embodiment is in the form of a library for the data acquisition program in the first network to call. The MQTT client can be applied to the data acquisition device, and the data acquisition device can call the MQTT client through the built-in data acquisition program to implement the technical solution of this embodiment. Any data acquisition device that supports the MQTT protocol can call the MQTT client library, and any server that supports the MQTT protocol can be expanded to an MQTT server. Among them, the data acquisition device is deployed in the first network to collect data from the terminal devices in the first network. For example, a plurality of terminal devices for production are deployed in the enterprise production network. The data acquisition device is responsible for collecting data from each terminal device, and then sending the collected data to the MQTT server in the second network through the MQTT client.

[0073] Among them, the first network can correspond to Figure 1 The first network corresponds to the production network, and the second network corresponds to the non-production network. Alternatively, the first network can correspond to the enterprise's internal network, and the second network to the enterprise's external network. The first and second networks are isolated by a one-way firewall. The one-way firewall allows traffic from the first network to pass through, but only allows specific packets (packets with all 0s or all 1s) to pass through the second network, and blocks all other traffic from the second network.

[0074] refer to Figure 2 , the methods for penetrating the network gate include:

[0075] S201, generating a fixed header of a request message; the value of a setting flag in the fixed header is a set value.

[0076] Here, the request message may include any request message that requires a reply from the MQTT server. In one embodiment, the request message includes: a connection (CONNECT) request message and a connection keep-alive (PINGREQ) message.

[0077] If the gatekeeper penetration mode is enabled, the MQTT client will set the flag value in the fix header of the request message to the set value, for example, the set value can be 1. If the gatekeeper penetration mode is not enabled, the flag value is set to the default value (the default value is 0).

[0078] Because the flag bit in the fix header of the CONNECT message and PINGREQ message in the MQTT specification is a reserved bit and is not configured, one of the bits can be used as the gatekeeper penetration bit and its value can be set to the set value.

[0079] Figure 3 The following is a schematic diagram of the format of a fixed header of a connection request message provided by an embodiment of the present invention. Message Type represents the message type, using a 4-bit binary representation. Message Type (1) indicates that the message type is CONNECT. The fixed header includes multiple flags, with flag 4 being a setting flag. The value of flag 4 can be set to 1.

[0080] Figure 4 The following is a schematic diagram of the format of a fixed header of a connection keep-alive message provided by an embodiment of the present invention. Message Type (12) indicates that the message type is PINGREQ. Flag 4 is a setting flag bit, and the value of flag 4 can be set to 1.

[0081] S202: Encapsulate the request message based on the fixed header.

[0082] When transmitting data in a network, the data needs to be encapsulated, that is, the header information corresponding to each network layer is added. The main function of this header information is to help the intermediate transmission system transmit the data to a correct destination.

[0083] The request message is encapsulated according to the fixed header, including an encapsulated connection (CONNECT) request message and an encapsulated connection keep-alive (PINGREQ) message, wherein the value of the setting flag bit (flag) of the encapsulated request message is set to a set value.

[0084] S203, sending the encapsulated request message to the MQTT server in the second network through a one-way network gate, so that the MQTT server returns a response message that meets the network gate penetration condition according to the request message; the network gate penetration condition indicates that all bytes of the response message are 1 or 0; the first network and the second network are isolated by the one-way network gate.

[0085] The first network and the second network are isolated by a one-way firewall, which allows traffic from the first network to pass through, so request messages can be sent sequentially to the MQTT server in the second network.

[0086] The MQTT server determines whether to enable gate penetration mode based on the value of the set flag in the received request message. Since the value of the set flag in the fixed header of the request message in this embodiment is the set value, the MQTT server enables gate penetration mode and generates a response message that meets the gate penetration conditions (a response message with all 1 or all 0 bytes) to the MQTT client. Because the one-way gate only allows specific messages (all 0 or all 1 bytes) from the second network to pass, the all 1 or all 0 byte response message generated by the MQTT server in this embodiment can successfully penetrate the one-way gate and be sent to the MQTT client.

[0087] Figure 5 The following is a schematic diagram of the message format of a response message provided by an embodiment of the present invention. Message Type (0) indicates that the message type is Reserved, and all bytes in the response message are 0. The response message can penetrate the one-way gateway to reach the MQTT client.

[0088] In one embodiment, if the value of the set flag in the fixed header of the request message received by the MQTT server is not a set value, the server replies with a regular response message, which may not be able to penetrate the one-way firewall.

[0089] In this embodiment, the MQTT client is deployed in the form of a library in the first network for the data acquisition program to call. The data acquisition program sends the collected device data to the MQTT server in the second network through the MQTT client. Since the data acquisition program communicates with the MQTT server by calling the MQTT client library, the data acquisition program does not need to be modified (no code modification is required). Moreover, the MQTT client library is highly versatile, and any data acquisition program that supports the MQTT protocol can call the MQTT client library. The MQTT client generates a fixed header for the request message, encapsulates the request message based on the fixed header, and sends the encapsulated request message to the MQTT server in the second network through a one-way network switch, so that the MQTT server returns a response message that meets the network switch penetration condition according to the request message. Among them, the value of the set flag bit in the fixed header is the set value, all bytes of the response message are 1 or 0, and the first network and the second network are isolated by the one-way network switch. This embodiment sets the value of the set flag bit in the fixed header of the request message to a set value, so that the MQTT server can generate a response message that meets the network gate penetration condition (all bytes are 1 or 0), so that the response message can smoothly penetrate the unidirectional network gate, realizing two-way penetration of traffic.

[0090] In one embodiment, if the request message is a connection request message, the method further includes:

[0091] If a response message is received from the MQTT server, it is determined that the connection between the MQTT client and the MQTT server is successfully established.

[0092] Because the set flag bit in the fixed header of the request message in this embodiment is set to the set value, the MQTT server activates the gatekeeper penetration mode and generates a response message with all 1s or all 0s to the MQTT client. The all-1s or all-0s response message generated by the MQTT server in this embodiment can successfully pass through the one-way gatekeeper and be sent to the MQTT client. The MQTT client receives the response message from the MQTT server, confirming that the MQTT connection has been successfully established.

[0093] In the above embodiment, after the connection between the MQTT client and the MQTT server is successfully established, the method further includes:

[0094] A message with a message topic is published to the MQTT server; the message represents the collected data of the data collection program; and the quality of service (QoS) level between the MQTT client and the MQTT server is 0.

[0095] MQTT communication is implemented through a publish / subscribe approach, where subscription and publishing are based on topics. After an MQTT connection is successfully established between an MQTT client and an MQTT server, the MQTT client (publisher) can send a message with a topic to the MQTT server. Subscribers can then receive topic message push notifications from the MQTT broker through the message subscription mechanism.

[0096] MQTT Quality of Service (QoS) is used to inform the IoT about which information is more important and less important, and to transmit information according to different QoS levels. The MQTT protocol has three QoS levels: QoS = 0 (send at most once); QoS = 1 (send at least once); and QoS = 2 (guaranteed once received). These three QoS levels represent different MQTT transmission processes. For more important MQTT messages, select a QoS > 0 (i.e., QoS 1 or 2).

[0097] In this embodiment, the QoS level between the MQTT client and the MQTT server is 0, which is the lowest QoS level. When QoS is 0, the MQTT protocol does not guarantee that all messages can be transmitted. In other words, when QoS = 0, the MQTT server and the MQTT client do not confirm or check whether the message transmission is successful. The MQTT server does not need to send a response message to the MQTT client, thus avoiding interception by a one-way network gatekeeper.

[0098] Figure 6 is a schematic diagram of the implementation flow of another network gate penetration method provided by an embodiment of the present invention, which is applied to an MQTT server in a second network, such as Figure 6 As shown, the methods for penetrating the network gate include:

[0099] S601, receiving a request message sent by an MQTT client in a first network; the first network and the second network are isolated by a one-way firewall.

[0100] Here, there are two situations for the request message sent by the MQTT client. If the MQTT client has enabled the gatekeeper penetration mode, the value of the set flag bit in the fixed header of the request message is the set value. If the MQTT client does not have the gatekeeper penetration mode enabled, the value of the set flag bit in the fixed header of the request message is not the set value (the default value is 0).

[0101] S602: If the value of the set flag in the fixed header of the request message is a set value, generate a response message that meets a gatekeeper penetration condition according to the request message; the gatekeeper penetration condition indicates that all bytes of the response message are 1 or 0.

[0102] The MQTT server parses the request message and obtains the value of the set flag in the fixed header. If the value of the set flag in the fixed header is the set value, it generates a full-byte (all bytes are 1 or 0) response message.

[0103] In one embodiment, if the value of the set flag bit in the fixed header of the received request message is not the set value, a regular response message is generated. Since the regular response message does not meet the gatekeeper penetration condition (all bytes are 1 or 0), it cannot penetrate the one-way gatekeeper to reach the MQTT client.

[0104] S603: Send the response message to the MQTT client.

[0105] The response message is encapsulated and sent to the MQTT client. Since the response message meets the gatekeeper penetration conditions (all bytes are 1 or 0), the response message can successfully penetrate the unidirectional gatekeeper to reach the MQTT client, achieving bidirectional traffic penetration.

[0106] This embodiment sets the value of the set flag bit in the fixed header of the request message to a set value, so that the MQTT server can generate a response message that meets the network gate penetration condition (all bytes are 1 or 0), so that the response message can smoothly penetrate the unidirectional network gate, realizing two-way penetration of traffic.

[0107] In one embodiment, if the request message is a connection request message, after the MQTT server sends a response message with all bytes being 1 or 0 to the MQTT client, the connection between the MQTT client and the MQTT server is successfully established.

[0108] The method further comprises:

[0109] Receive a message with a message topic published by the MQTT client; the message represents the device data collected by the data collection program; the QoS service quality level between the MQTT client and the MQTT server is 0;

[0110] The message is distributed to corresponding subscribers based on the subscription topic.

[0111] The MQTT client (publisher) can send a message with a message topic to the MQTT server, and then the subscriber can obtain the topic message push from the MQTT broker through the message subscription mechanism. The specific implementation process is detailed in the above method embodiment and will not be repeated here.

[0112] refer to Figure 7 , Figure 7 Schematic diagram of a network gate penetration system provided by an embodiment of the present invention, the network gate penetration system includes:

[0113] The data acquisition device in the first network is used to send the collected data to the MQTT server in the second network through the MQTT client, and the MQTT client is called by the data acquisition device in the form of a library;

[0114] The MQTT client is configured to generate a fixed header of a request message, wherein the value of a set flag in the fixed header is a set value; encapsulate the request message based on the fixed header; and send the encapsulated request message to the MQTT server in the second network through a one-way gateway;

[0115] An MQTT server is configured to receive a request message sent by the MQTT client, and if the value of a set flag bit in a fixed header of the request message is a set value, generate a response message that meets a gatekeeper penetration condition based on the request message, and send the response message to the MQTT client; the gatekeeper penetration condition indicates that all bytes of the response message are 1 or 0; and the first network and the second network are isolated by the unidirectional gatekeeper.

[0116] The network gate penetration system provided in this embodiment and the network gate penetration method embodiment provided in the above embodiment have the same concept. The specific implementation process is detailed in the above method embodiment and will not be repeated here.

[0117] This embodiment can be applied in an enterprise management network, for example, deploying data acquisition equipment in an enterprise production network and deploying an MQTT server in a non-production network (management network), and isolating the production network from the non-production network through a one-way firewall. The enterprise production network includes multiple terminal devices for production, and the data acquisition equipment can obtain data from each terminal device, and then send the obtained data to the MQTT server in the second network through the MQTT client. For request messages that need to return a response, the MQTT server can generate a response message that meets the firewall penetration conditions based on the request message, thereby realizing two-way penetration of traffic.

[0118] like Figure 8 As shown, Figure 8 This is a system architecture diagram of a network gate penetration solution provided by an application embodiment of the present invention. The enterprise production network and the non-production network (management network) are isolated by a forward network gate device. Multiple production terminal devices are deployed in the enterprise production network. The collection box is a hardware device equipped with a collection service. The collection service is responsible for collecting data from each terminal device. The collection service communicates with the MQTT Broker by calling the MQTT Client library.

[0119] As a publisher, the MQTT client publishes collected data as topic messages to the MQTT broker. Subscribers in the enterprise's non-production network receive topic message push notifications from the MQTT broker through a message subscription mechanism. Subscribers in the enterprise's non-production network come in two types: local application services and forwarding services. Local application services process subscribed messages locally, while forwarding services forward subscribed messages to data analysis services in the cloud data center.

[0120] Among them, the collection service sends data through the network gate to the MQTT broker through the MQTT Client, thereby achieving data network gate penetration.

[0121] like Figure 9 As shown, Figure 9 This is a flow chart of the forwarding logic of a connection request message provided by an application embodiment of the present invention. Figure 9 Two cases, MQTT Client extension and MQTT Client non-extension, are shown respectively. For the extended MQTTClient, global variables (such as environment variables or configurations) are used to control whether the network gate penetration mode is adopted. When the global variable is set, it indicates that the network gate penetration mode is adopted for packet sending; if it is not set or the value is false, it indicates non-network gate penetration mode (i.e. native MQTT protocol). By setting the value of the set flag bit in the fixed header of the connection request message, if the value of the set flag bit is the set value, the network gate penetration mode is enabled and the connection request message is encapsulated (flag.4=1); if the value of the set flag bit is not the set value, the network gate penetration mode is not enabled and the connection request message is encapsulated (flag.4=0).

[0122] For the unextended MQTT Client, the connection request message is directly encapsulated (flag.4=0).

[0123] The extended MQTT broker supports communication with both extended and unextended MQTT clients. Upon receiving a connection request message, the extended MQTT broker determines whether flag.4 is 1. If flag.4 is 1, it encapsulates a response message with a message type of 0, a header length of 1 byte, and content consisting of all zeros. If flag.4 is 0, it encapsulates a regular ConnACK message. The extended MQTT broker then returns a conn response message to the MQTT client.

[0124] If the extended MQTT Client has the gatekeeper penetration mode enabled, it can receive a response message with message type 0 and all zeros, confirming that the MQTT connection is established.

[0125] For regular response messages, since the one-way firewall intercepts the regular response messages, the unextended MQTT Client cannot receive the regular response messages.

[0126] like Figure 10 As shown, Figure 10 This is a flow chart of forwarding logic of a connection keep-alive request message provided by an application embodiment of the present invention. Figure 10The diagram shows the two cases of MQTT Client extension and MQTT Client non-extension. For the extended MQTT Client, by setting the value of the set flag in the fixed header of the connection keep-alive request message, if the value of the set flag is the set value, the network gate penetration mode is enabled and the connection keep-alive request message is encapsulated (flag.4=1); if the value of the set flag is not the set value, the network gate penetration mode is not enabled and the connection keep-alive request message is encapsulated (flag.4=0).

[0127] For the unextended MQTT Client, the connection keep-alive request message (flag.4=0) is directly encapsulated.

[0128] The extended MQTT broker supports communication with both extended and unextended MQTT clients. Upon receiving a connection keepalive request message, the extended MQTT broker determines whether flag.4 is 1. If flag.4 is 1, it encapsulates a response message with a message type of 0, a header length of 1 byte, and content consisting of all zeros. If flag.4 is 0, it encapsulates a regular pingResp message. The extended MQTT broker returns a pingReq response message to the MQTT client.

[0129] If the extended MQTT Client has the gatekeeper penetration mode enabled, it can receive a response message with message type 0, whose content is all 0s, confirming that the MQTT heartbeat is ok, that is, the connection is kept alive successfully.

[0130] For regular response messages, since the one-way firewall intercepts the regular response messages, the unextended MQTT Client cannot receive the regular response messages.

[0131] This embodiment extends the MQTT protocol, enabling third-party programs that use MQTT communication to automatically and seamlessly penetrate network gates without modification. Most programs on the edge computing platform use MQTT as the message bus for data transmission, providing versatility within the edge computing platform. Furthermore, the MQTT protocol uses TCP for communication, maintaining low-latency requirements for data.

[0132] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0133] It will be understood that when used in this specification and the appended claims, the terms “comprises” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0134] It should be noted that the technical solutions described in the embodiments of the present invention can be arbitrarily combined without conflict.

[0135] In addition, in the embodiments of the present invention, “first”, “second”, etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0136] refer to Figure 11 , Figure 11 Schematic diagram of an MQTT client provided by an embodiment of the present invention, such as Figure 11 As shown, the device includes:

[0137] A first generating module is configured to generate a fixed header of a request message; the value of a setting flag bit in the fixed header is a set value;

[0138] An encapsulation module, configured to encapsulate the request message based on the fixed header;

[0139] The first sending module is used to send the encapsulated request message to the MQTT server in the second network through a one-way network gate, so that the MQTT server returns a response message that meets the network gate penetration condition according to the request message; the network gate penetration condition indicates that all bytes of the response message are 1 or 0; the first network and the second network are isolated by the one-way network gate.

[0140] In one embodiment, the request message includes any one of the following:

[0141] Connection request message;

[0142] Connection keepalive request message.

[0143] In one embodiment, if the request message is a connection request message, the MQTT client further includes:

[0144] The connection establishment module is used to determine whether the connection between the MQTT client and the MQTT server is successfully established if a response message sent by the MQTT server is received.

[0145] In one embodiment, the MQTT client further includes:

[0146] A publishing module is used to publish a message with a message topic to the MQTT server after the connection between the MQTT client and the MQTT server is successfully established; the message represents the collected data of the data collection program; the QoS service quality level between the MQTT client and the MQTT server is 0.

[0147] refer to Figure 12 , Figure 12 Schematic diagram of an MQTT server provided by an embodiment of the present invention, such as Figure 12 As shown, the device includes:

[0148] A receiving module, configured to receive a request message sent by an MQTT client in a first network; the first network and the second network are isolated by a one-way firewall;

[0149] a second generating module configured to generate, if the value of the set flag bit in the fixed header of the request message is a set value, a response message that satisfies a gatekeeper penetration condition according to the request message; the gatekeeper penetration condition indicates that all bytes of the response message are 1 or 0;

[0150] The second sending module is used to send the response message to the MQTT client.

[0151] In one embodiment, the MQTT server further includes:

[0152] A topic message receiving module, configured to receive a message with a message topic published by the MQTT client; the message represents the collected data of the data collection program; wherein the quality of service level QoS between the MQTT client and the MQTT server is 0;

[0153] The distribution module is used to distribute the message to the corresponding subscribers based on the subscription topic.

[0154] In actual application, the receiving module, the second generating module, the second sending module, the first generating module, the encapsulation module and the first sending module can be implemented by a processor in an electronic device, such as a central processing unit (CPU), a digital signal processor (DSP), a microcontroller unit (MCU) or a programmable gate array (FPGA).

[0155] It should be noted that the MQTT client and MQTT server provided in the above embodiments are only used as examples to illustrate the division of the above modules when performing network gate penetration. In actual applications, the above processing can be assigned to different modules as needed, that is, the internal structure of the device can be divided into different modules to complete all or part of the processing described above. In addition, the MQTT client / MQTT server provided in the above embodiments and the network gate penetration method embodiment are based on the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0156] The MQTT client / MQTT server described above can be in the form of an image file. After the image file is executed, it can be run in the form of a container or virtual machine to implement the network gate penetration method described in this application. Of course, it is not limited to the image file format. Any software form that can implement the network gate penetration method described in this application is within the scope of protection of this application.

[0157] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiment of the present application, the embodiment of the present application also provides an electronic device. Figure 13 This is a schematic diagram of the hardware structure of the electronic device according to the embodiment of the present application. Figure 13 As shown, the electronic equipment includes:

[0158] Communication interface, capable of exchanging information with other devices such as network equipment;

[0159] The processor is connected to the communication interface to implement information exchange with other devices and is used to execute the methods provided by one or more technical solutions on the electronic device side when running a computer program. The computer program is stored in the memory.

[0160] Of course, in actual applications, the various components in the electronic device are coupled together through a bus system. It is understood that the bus system is used to achieve connection and communication between these components. In addition to the data bus, the bus system also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Figure 13 In the text, various buses are labeled as bus systems.

[0161] The electronic devices described above can be clustered, such as in the form of a cloud computing platform. A cloud computing platform is a service model that uses computing virtualization, network virtualization, and storage virtualization technologies to organize the physical hardware resources of multiple independent servers into pooled resources. It is a software-defined resource architecture based on the development of virtualization technology, providing resource capabilities in the form of virtual machines and containers. By eliminating the fixed relationship between hardware and operating systems and relying on network connectivity to unify resource scheduling and then provide the required virtual resources and services, it represents a new IT and software delivery model characterized by flexibility, elasticity, distribution, multi-tenancy, and on-demand nature.

[0162] The current cloud computing platform supports several service models:

[0163] SaaS (Software as a Service): Cloud computing platform users do not need to purchase software, but instead rent software deployed on the cloud computing platform. Users do not need to maintain the software, and the software service provider will fully manage and maintain the software.

[0164] PaaS (Platform as a Service): Cloud computing platform users (usually software developers) can build new applications or extend existing applications on the cloud computing platform's infrastructure without having to purchase development, quality control, or production servers.

[0165] IaaS (Infrastructure as a Service): Cloud computing platforms provide data centers, infrastructure hardware, and software resources through the Internet. Cloud computing platforms under the IaaS model can provide servers, operating systems, disk storage, databases, and / or information resources.

[0166] The memory in the embodiments of the present application is used to store various types of data to support the operation of the electronic device. Examples of such data include: any computer program used to operate on the electronic device.

[0167] It is understood that the memory can be volatile memory or non-volatile memory, or can include both volatile and non-volatile memory. Among them, non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disk, or compact disc read-only memory (CD-ROM); magnetic surface memory can be magnetic disk memory or tape memory. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronized dynamic random access memory (SLDRAM), and direct rambus random access memory (DRRAM). The memory described in the embodiments of the present application is intended to include, but is not limited to, these and any other suitable types of memory.

[0168] The methods disclosed in the above embodiments of the present application can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, the steps of the above methods can be completed by hardware integrated logic circuits in the processor or instructions in software form. The above processor may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of the present application can be directly embodied as being executed by a hardware decoding processor, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in a memory. The processor reads the program in the memory and completes the steps of the above methods in combination with its hardware.

[0169] Optionally, when the processor executes the program, it implements the corresponding processes implemented by the electronic device in each method of the embodiments of the present application, which will not be described here for the sake of brevity.

[0170] In an exemplary embodiment, the present application also provides a storage medium, namely, a computer storage medium, specifically a computer-readable storage medium, including, for example, a first memory storing a computer program, wherein the computer program can be executed by a processor of an electronic device to perform the steps of the aforementioned method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface storage, optical disk, or CD-ROM.

[0171] In the several embodiments provided in this application, it should be understood that the disclosed devices, electronic devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0172] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0173] In addition, all functional units in the embodiments of the present application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the above-mentioned integrated units can be implemented in the form of hardware or in the form of hardware plus software functional units.

[0174] Those skilled in the art will understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: mobile storage devices, ROM, RAM, disks or optical disks, etc. Various media that can store program codes.

[0175] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application can be essentially or in other words, the part that contributes to the relevant technology can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, magnetic disks or optical disks.

[0176] It should be noted that the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0177] In addition, in the examples of this application, "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0178] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A method for penetrating a network gate, characterized in that: The method is applied to a message queue telemetry transmission protocol MQTT client in a first network. The MQTT client is called by a data acquisition program in the first network in the form of a library. The data acquisition program is used to send the collected data through the MQTT client to an MQTT server in a second network. The network gate penetration method includes: In response to starting the gatekeeper penetration mode, generating a fixed header of the request message; the value of the set flag bit in the fixed header is a set value; Encapsulating the request message based on the fixed header; Sending the encapsulated request message to the MQTT server in the second network through a one-way gatekeeper, so that the MQTT server returns a response message that meets a gatekeeper penetration condition based on the request message; the gatekeeper penetration condition indicates that all bytes of the response message are either 1 or 0; the first network and the second network are isolated by the one-way gatekeeper; The method further comprises: In response to not enabling the gatekeeper penetration mode, generating a fixed header of the request message, wherein a value of a setting flag bit in the fixed header is a default value; Encapsulating the request message based on the fixed header; The encapsulated request message is sent to the MQTT server in the second network through a one-way network gate, so that the MQTT server returns a response message that meets the conventional requirements according to the request message; the conventional response message cannot pass through the one-way network gate.

2. The method according to claim 1, wherein The request message includes any of the following: Connection request message; Connection keepalive request message.

3. The method according to claim 2, wherein If the request message is a connection request message, the method further includes: If a response message is received from the MQTT server, it is determined that the connection between the MQTT client and the MQTT server is successfully established.

4. The method according to claim 3, wherein After the connection between the MQTT client and the MQTT server is successfully established, the method further includes: A message with a message topic is published to the MQTT server; the message represents the collected data of the data collection program; the QoS service quality level between the MQTT client and the MQTT server is 0.

5. A network gate penetration method, applied to the MQTT server according to claim 1, wherein the MQTT server is located in a second network, characterized in that: The method comprises: Receiving a request message sent by an MQTT client in a first network; the first network and the second network are isolated by a one-way network firewall; If the value of the set flag bit in the fixed header of the request message is a set value, generating a response message that meets a gatekeeper penetration condition according to the request message; the gatekeeper penetration condition indicates that all bytes of the response message are 1 or 0; Sending the response message to the MQTT client; The method further comprises: If the value of the setting flag in the fixed header of the request message is a default value, a conventional response message is generated according to the request message, and the conventional response message cannot penetrate the unidirectional network gate.

6. The method according to claim 5, wherein The method further comprises: Receiving a message with a message topic published by the MQTT client; the message represents the collected data of the data collection program; wherein the quality of service level QoS between the MQTT client and the MQTT server is 0; The message is distributed to corresponding subscribers based on the subscription topic.

7. A network gate penetration system, characterized in that: include: The data acquisition device in the first network is used to send the collected data to the MQTT server in the second network through the MQTT client, and the MQTT client is called by the data acquisition device in the form of a library; The MQTT client is configured to, in response to enabling the gatekeeper penetration mode, generate a fixed header for the request message, wherein the value of a set flag in the fixed header is a set value; encapsulate the request message based on the fixed header; and send the encapsulated request message to the MQTT server in the second network through the unidirectional gatekeeper; An MQTT server is configured to receive a request message sent by the MQTT client, and if the value of a set flag bit in a fixed header of the request message is a set value, generate a response message that satisfies a gatekeeper penetration condition based on the request message, and send the response message to the MQTT client; the gatekeeper penetration condition indicates that all bytes of the response message are either 1 or 0; and the first network and the second network are isolated by the unidirectional gatekeeper; The MQTT client is further configured to: in response to not enabling the gatekeeper penetration mode, generate a fixed header for the request message, wherein the value of a set flag bit in the fixed header is a default value; encapsulate the request message based on the fixed header; and send the encapsulated request message to the MQTT server in the second network through a one-way gatekeeper, so that the MQTT server returns a response message that satisfies the conventional requirements according to the request message; conventional response messages cannot pass through the one-way gatekeeper; The MQTT server is further configured to generate a conventional response message according to the request message if the value of the set flag bit in the fixed header of the request message is a default value, and the conventional response message cannot penetrate the one-way firewall.

8. An MQTT client, characterized in that: The MQTT client is used as a library for the data acquisition program in the first network to call. The data acquisition program is used to send the collected data to the MQTT server in the second network through the MQTT client. The MQTT client includes: A first generating module is configured to generate a fixed header of a request message in response to enabling the gatekeeper penetration mode; the value of a setting flag bit in the fixed header is a set value; An encapsulation module, configured to encapsulate the request message based on the fixed header; a first sending module, configured to send the encapsulated request message to the MQTT server in the second network through a one-way gateway, so that the MQTT server returns a response message that meets a gateway penetration condition based on the request message; the gateway penetration condition indicates that all bytes of the response message are either 1 or 0; and the first network and the second network are isolated by the one-way gateway; The first generating module is further configured to: in response to not enabling the gatekeeper penetration mode, generate a fixed header of the request message, wherein the value of the setting flag bit in the fixed header is a default value; The first sending module is also used to: send the encapsulated request message to the MQTT server in the second network through the one-way network gate, so that the MQTT server returns a conventional response message according to the request message; the conventional response message cannot pass the one-way network gate.

9. An MQTT server, located on a second network, characterized in that: The MQTT server interacts with the MQTT client according to claim 8, and the MQTT server includes: A receiving module, configured to receive a request message sent by an MQTT client in a first network; the first network and the second network are isolated by a one-way firewall; a second generating module configured to generate, if the value of the set flag bit in the fixed header of the request message is a set value, a response message that satisfies a gatekeeper penetration condition according to the request message; the gatekeeper penetration condition indicates that all bytes of the response message are 1 or 0; A second sending module is used to send the response message to the MQTT client; The second generating module is further configured to generate a conventional response message according to the request message if the value of the setting flag in the fixed header of the request message is a default value. The conventional response message cannot penetrate the unidirectional firewall.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the network gate penetration method according to any one of claims 1 to 6 is implemented.

11. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions. When the program instructions are executed by a processor, the processor executes the network gate penetration method according to any one of claims 1 to 6.

Images