A method, apparatus and electronic device for establishing a data connection

Abstract

The application discloses a method, device and electronic equipment for establishing a data connection, the method comprising: a client sending a generated first encapsulation packet to a server end to enable the server end to decrypt the first encapsulation packet, obtain a first communication key, and generate a second encapsulation packet containing the first communication key; the client receiving the second encapsulation packet sent by the server end and verifying whether the first communication key in the second encapsulation packet meets a preset condition; if not, confirming that the data connection between the client and the server end fails to be established; and if yes, confirming that the data connection between the client and the server end is successfully established. According to the technical scheme provided in the embodiments of the application, only one round trip time is experienced when the data connection is established between the client and the server end, so that the time cost for establishing the data connection is reduced, and the transmission efficiency of data between the client and the server end is improved.

Description

Technical Field

[0001] This application relates to the field of data communication technology, and in particular to a method, apparatus and electronic device for establishing a data connection. Background Technology

[0002] The Transmission Control Protocol (TCP) / Internet Protocol (IP) stack is a collection of network protocols and is also the most widely used reliable communication protocol in data centers. This TCP / IP stack has a four-layer structure: application layer, transport layer, network layer, and network interface layer.

[0003] In the TCP / IP protocol stack, when a client transmits data to a server, the data needs to be encapsulated before transmission. First, the data is parsed at the application layer to obtain a datagram. Next, the datagram is passed to the transport layer, where the corresponding port numbers for the server and client are added, resulting in a TCP segment. This port number identifies the specific process on the server or client. Then, the TCP segment is passed to the network layer, where the corresponding IP addresses for the server and client are added, resulting in an IP datagram. This IP address identifies the network location of the server or client. Finally, the IP datagram is passed to the network interface layer, where the corresponding Media Access Control (MAC) addresses for the server and client are added, generating an encapsulated packet. This MAC address identifies the physical location of the server or client. The client then transmits this encapsulated packet to the server, completing the data transmission.

[0004] To ensure the correctness of data transmitted between the client and the server, a reliable data connection is usually established between the client and the server at the transport layer based on the TCP three-way handshake mechanism.

[0005] For reference Figure 1 The diagram illustrates the three-way handshake process. During the first handshake, the client sends a Synchronize Sequence Numbers (SYN) message to the server. This SYN message indicates a request to establish a data connection, meaning the client is requesting the server to establish a data connection.

[0006] During the second handshake, after receiving the SYN packet, the server replies to the client with an ACK packet. The ACK indicates that the received data is correct, which means that the communication from the client to the server is normal. In addition, in order to ensure that the communication from the server to the client is also normal, the server also sends a SYN packet to the client. Therefore, the server sends SYN and ACK packets to the client.

[0007] During the third handshake, after receiving the SYN and ACK packets, the client sends an ACK packet to the server, indicating that the communication between the server and the client is also normal.

[0008] After the three-way handshake is completed, it can be confirmed that a data connection has been successfully established between the client and the server, and data can then be transmitted normally between the client and the server.

[0009] However, when establishing a data connection between the client and the server based on the three-way handshake mechanism, two round-trip times (RTT) are required between the client and the server, which results in a large time overhead for establishing the data connection and reduces the data transmission efficiency between the client and the server. Summary of the Invention

[0010] This application provides a method, apparatus, and electronic device for establishing a data connection, to solve the problem that establishing a data connection between a client and a server based on a three-way handshake mechanism requires two round trips, resulting in a large time overhead for establishing the data connection and thus reducing the data transmission efficiency between the client and the server. The specific implementation scheme is as follows:

[0011] In a first aspect, this application provides a method for establishing a data connection, the method comprising:

[0012] The generated first encapsulated message is sent to the server so that the server can decrypt the first encapsulated message to obtain the first communication key and generate a second encapsulated message containing the first communication key.

[0013] Receive the second encapsulated message sent by the server and verify whether the first communication key in the second encapsulated message meets the preset conditions;

[0014] If not, it is confirmed that the data connection with the server failed to be established;

[0015] If so, confirm that the data connection with the server has been successfully established.

[0016] The client sends a generated first encapsulated message to the server, which decrypts it to obtain a first communication key and generates a second encapsulated message containing that key. Upon receiving the second encapsulated message, the client verifies the first communication key. If the key meets preset conditions, the data connection with the server is successfully established. This process involves only one round trip, reducing connection establishment time and improving data transmission efficiency. Furthermore, verification based on the first communication key can identify whether transmitted messages have been intercepted or forged by a third party, enhancing the security of the data connection between the client and server.

[0017] In one possible implementation, before sending the generated first encapsulated message to the server, the method further includes:

[0018] Obtain the client's initial hardware information;

[0019] Based on the first hardware information, the first hash value corresponding to the first hardware information is calculated;

[0020] The first hash value is input into the encryption suite, and the corresponding first state value is output, wherein the first state value is used to calculate the communication key;

[0021] The first hash value and the first status value are encapsulated to generate the first encapsulated message.

[0022] Based on the client's first hardware information, the first hash value corresponding to the first hardware information is calculated, and the first state value is obtained based on the first hash value and the encryption suite, thereby obtaining the first encapsulated message, which ensures that a message requesting the establishment of a data connection can be sent to the server later.

[0023] In one possible implementation, after confirming the successful establishment of the data connection with the server, the method further includes:

[0024] When the data connection established with the server is broken, query whether the second hash value in the second encapsulated message and the second status value in the second encapsulated message exist;

[0025] If not, re-establish the data connection with the server.

[0026] If so, a data connection is established based on the second hash value and the second status value, and the target data is transmitted.

[0027] When the data connection between the client and the server is lost, a query based on the second hash value and the second status value confirms whether there is cached information containing the second hash value and the second status value. This avoids going through another round trip to establish the data connection between the client and the server when cached information exists, thereby reducing the time overhead of establishing the data connection.

[0028] In one possible implementation, establishing a data connection and transmitting target data based on the second hash value and the second state value includes:

[0029] Obtain the target data, the second hash value, and the second status value;

[0030] Decrypt the second hash value and the second state value to obtain the second communication key;

[0031] The second communication key and the target data are encapsulated to generate a third encapsulated message;

[0032] The third encapsulated message is sent to the server so that the server can verify the second communication key in the third encapsulated message, establish a data connection, and process the target data in the third encapsulated message.

[0033] Based on the second communication key obtained by decrypting the second hash value and the second state value, the data connection established between the client and the server is restored. Then, based on the second communication key, the target data can be directly transmitted to the server. At this time, the data connection can be established in half the round trip time, reducing the time overhead of establishing the data connection and further improving the transmission efficiency when transmitting data to the server. At the same time, based on the transmission of the second communication key, it is possible to identify whether the transmitted message has been intercepted or forged by a third party, thereby improving the security of the data connection established between the client and the server.

[0034] Secondly, this application provides a method for establishing a data connection, the method comprising:

[0035] Receive the first encapsulated message sent by the client;

[0036] The first encapsulated message is decrypted to obtain the first communication key, and a second encapsulated message containing the first communication key is generated.

[0037] The second encapsulated message is sent to the client so that the client establishes a data connection based on the first communication key in the second encapsulated message.

[0038] Based on the first encapsulated message received by the server from the client, the first encapsulated message is decrypted to obtain the first communication key, and a second encapsulated message containing the first communication key is generated. Then, the second encapsulated message is sent to the client so that the client can verify the first communication key in the second encapsulated message and establish a data connection. At this time, only one round trip is required when establishing a data connection between the client and the server, which reduces the time overhead of establishing a data connection and thus improves the data transmission efficiency between the client and the server.

[0039] In one possible implementation, generating a second encapsulated message containing the first communication key includes:

[0040] Obtain the second hardware information from the server;

[0041] Based on the second hardware information, the second hash value corresponding to the second hardware information is calculated;

[0042] The second hash value is input into the encryption suite, and the corresponding second state value is output, wherein the second state value is used to calculate the communication key;

[0043] The second hash value, the second status value, and the first communication key are encapsulated to generate the second encapsulated message.

[0044] Based on the second hardware information on the server side, the second hash value corresponding to the second hardware information is calculated, and the second state value is obtained based on the second hash value and the encryption suite, thereby obtaining the second encapsulated message. This ensures that a message allowing the establishment of a data connection can be sent to the client in the future. At the same time, based on the transmission of the first communication key, it is possible to identify whether the transmitted message has been intercepted or forged by a third party, thereby improving the security of the data connection established between the server and the client.

[0045] In one possible implementation, after sending the second encapsulated message to the client so that the client establishes a data connection based on the first communication key in the second encapsulated message, the method further includes:

[0046] When the data connection established with the client is broken, receive the third encapsulated message sent by the client;

[0047] Verify whether the second communication key in the third encapsulated message meets the preset conditions;

[0048] If not, it is confirmed that the data connection with the client failed to be established;

[0049] If so, confirm that the data connection with the client has been successfully established, and process the target data in the third encapsulated message.

[0050] When the data connection between the server and the client is broken, the data connection between the server and the client is re-established based on the verification of the second communication key in the third encapsulated message sent by the client. This time, the data connection can be established in half the round trip time, thereby reducing the time overhead of establishing the data connection. Furthermore, based on the verification of the second communication key, it is possible to identify whether the transmitted message has been intercepted or forged by a third party, thereby improving the security of the data connection established between the server and the client.

[0051] Thirdly, this application also provides an apparatus for establishing a data connection, the apparatus comprising:

[0052] The sending module is used to send the generated first encapsulated message to the server so that the server can decrypt the first encapsulated message to obtain the first communication key and generate a second encapsulated message containing the first communication key.

[0053] The first processing module is used to receive the second encapsulated message sent by the server and verify whether the first communication key in the second encapsulated message meets the preset conditions.

[0054] If not, it is confirmed that the data connection with the server failed to be established;

[0055] If so, confirm that the data connection with the server has been successfully established.

[0056] In one possible implementation, the sending module is specifically used to obtain the client's first hardware information;

[0057] Based on the first hardware information, the first hash value corresponding to the first hardware information is calculated;

[0058] The first hash value is input into the encryption suite, and the corresponding first state value is output, wherein the first state value is used to calculate the communication key;

[0059] The first hash value and the first status value are encapsulated to generate the first encapsulated message.

[0060] In one possible implementation, the first processing module is specifically used to query whether the second hash value and the second status value in the second encapsulated message exist when the data connection established with the server is disconnected.

[0061] If not, re-establish the data connection with the server.

[0062] If so, a data connection is established based on the second hash value and the second status value, and the target data is transmitted.

[0063] In one possible implementation, the first processing module is specifically used to acquire the target data, the second hash value, and the second status value;

[0064] Decrypt the second hash value and the second state value to obtain the second communication key;

[0065] The second communication key and the target data are encapsulated to generate a third encapsulated message;

[0066] The third encapsulated message is sent to the server so that the server can verify the second communication key in the third encapsulated message, establish a data connection, and process the target data in the third encapsulated message.

[0067] Fourthly, this application provides an apparatus for establishing a data connection, the apparatus comprising:

[0068] The receiving module is used to receive the first encapsulated message sent by the client;

[0069] The decryption module is used to decrypt the first encapsulated message to obtain the first communication key and generate a second encapsulated message containing the first communication key.

[0070] The second processing module is used to send the second encapsulated message to the client so that the client can establish a data connection based on the first communication key in the second encapsulated message.

[0071] In one possible implementation, the decryption module is specifically used to obtain second hardware information from the server.

[0072] Based on the second hardware information, the second hash value corresponding to the second hardware information is calculated;

[0073] The second hash value is input into the encryption suite, and the corresponding second state value is output, wherein the second state value is used to calculate the communication key;

[0074] The second hash value, the second status value, and the first communication key are encapsulated to generate the second encapsulated message.

[0075] In one possible implementation, the second processing module is specifically configured to receive a third encapsulated message sent by the client when the data connection established with the client is broken;

[0076] Verify whether the second communication key in the third encapsulated message meets the preset conditions;

[0077] If not, it is confirmed that the data connection with the client failed to be established;

[0078] If so, confirm that the data connection with the client has been successfully established, and process the target data in the third encapsulated message.

[0079] Fifthly, this application provides an electronic device, comprising:

[0080] Memory, used to store computer programs;

[0081] When a processor executes a computer program stored in the memory, it implements the above-described method steps for establishing a data connection.

[0082] Sixthly, this application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the above-described method steps for establishing a data connection.

[0083] For the various aspects of the third to sixth aspects mentioned above, and the technical effects that each aspect may achieve, please refer to the above description of the technical effects that can be achieved for the first aspect or the various possible solutions in the first aspect, and the second aspect or the various possible solutions in the second aspect. They will not be repeated here. Attached Figure Description

[0084] Figure 1 A schematic diagram of a three-way handshake process is provided for this application;

[0085] Figure 2 This application provides a method for establishing a data connection. Figure 1 ;

[0086] Figure 3 This application provides a method for establishing a data connection. Figure 2 ;

[0087] Figure 4 A schematic diagram of a data transmission system provided in this application;

[0088] Figure 5 A schematic diagram illustrating the process of establishing a data connection as provided in this application;

[0089] Figure 6 A schematic diagram of a device for establishing a data connection provided in this application Figure 1 ;

[0090] Figure 7 A schematic diagram of a device for establishing a data connection provided in this application Figure 2 ;

[0091] Figure 8 A schematic diagram of an electronic device provided in this application. Detailed Implementation

[0092] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The specific operational methods in the method embodiments can also be applied to the device embodiments or system embodiments. It should be noted that in the description of this application, "multiple" is understood as "at least two". "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. A connected to B can represent: A and B directly connected, and A and B connected through C. Furthermore, in the description of this application, terms such as "first" and "second" are used only for distinguishing the purpose of description and should not be construed as indicating or implying relative importance or order.

[0093] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0094] Currently, when establishing a reliable data connection between a client and a server based on the three-way handshake mechanism, two RTTs are required between the client and the server, which results in a large time overhead for establishing the data connection and reduces the data transmission efficiency between the client and the server.

[0095] Therefore, this application proposes a method for establishing a data connection. The client sends a generated first encapsulated message to the server, which decrypts the first encapsulated message to obtain a first communication key and generates a second encapsulated message containing the first communication key. Then, after receiving the second encapsulated message from the server, the client verifies the first communication key in the second encapsulated message. When the first communication key meets the preset conditions, the data connection between the client and the server is confirmed to be successfully established. At this time, only one RTT is experienced when establishing a data connection between the client and the server, which reduces the time overhead of establishing a data connection and thus improves the data transmission efficiency between the client and the server.

[0096] Example 1:

[0097] Reference Figure 2 The diagram shows a method flow for establishing a data connection according to an embodiment of this application. Figure 1 This method is applied to Figure 4 The data transmission system shown includes a server and a client. Figure 2 The method flow shown is specifically applied to the client side of this data transmission system, including:

[0098] S201, send the generated first encapsulated message to the server;

[0099] Specifically, the first step is to obtain the client's primary hardware information, such as Basic Input Output System (BIOS) information and Central Processing Unit (CPU) information.

[0100] Then, based on the first hardware information, the first hash value corresponding to the first hardware information is calculated.

[0101] It should be noted that, in this embodiment, when calculating the first hash value corresponding to the first hardware information, it can be done using either a hash value acquisition tool (GetHash) or a hash source code (HashCode). The calculation method can be adjusted according to the specific application scenario. For example, inputting the first hardware information into GetHash yields the first hash value FA79-A66B-9F3D-55AC.

[0102] Furthermore, the obtained first hash value is input into the encryption suite, and the corresponding first state value is output, wherein the first state value is used to calculate the communication key.

[0103] It should be noted that, in this embodiment, the encryption suite can be based on Transport Layer Security (TLS) or the International Data Encryption Algorithm (IDEA). In this embodiment, the encryption suite can be adjusted according to the specific application scenario. For example, inputting the first hash value FA79-A66B-9F3D-55AC into IDEA yields the first state value 57644.

[0104] After obtaining the first hash value and the first state value, the first hash value and the first state value are encapsulated to generate the first encapsulated message.

[0105] In the above manner, based on the client's first hardware information, the first hash value corresponding to the first hardware information is calculated, and based on the first hash value and the encryption suite, the first state value is obtained, thereby obtaining the first encapsulated message, ensuring that a message requesting the establishment of a data connection can be sent to the server in the future.

[0106] Furthermore, after generating the first encapsulated message, the generated first encapsulated message is sent to the server so that the server can decrypt the first encapsulated message, obtain the first communication key, and generate a second encapsulated message containing the first communication key.

[0107] S202, Receive the second encapsulated message sent by the server and verify whether the first communication key in the second encapsulated message meets the preset conditions;

[0108] After sending the generated first encapsulated message to the server, the system receives the second encapsulated message sent by the server and verifies whether the first communication key in the second encapsulated message meets the preset conditions.

[0109] It should be noted that, in this embodiment of the application, when verifying whether the first communication key in the second encapsulated message meets the preset conditions, the first communication key in the second encapsulated message is input into the decryption kit, and the verification of whether the first communication key in the second encapsulated message meets the preset conditions is based on the decryption kit. The decryption kit can be a decryption kit based on the Secure Hash Algorithm (SHA) or a decryption kit based on a deep learning algorithm. In this embodiment of the application, the decryption kit can be adjusted according to the specific application scenario.

[0110] It should also be noted that the preset condition can be that the first key value corresponding to the first hash value obtained after the decryption kit processes the first communication key is consistent with the original first key value corresponding to the first hash value stored on the client, or the value output by the first communication key after the decryption kit is within a preset range. In this application embodiment, the preset condition can be adjusted according to the specific application scenario.

[0111] If the first communication key in the second encapsulated message does not meet the preset conditions, then step S203 is executed; if the first communication key in the second encapsulated message meets the preset conditions, then step S204 is executed.

[0112] By using the above method, based on the verification of the first communication key, it is possible to identify whether the transmitted message has been intercepted or forged by a third party, thereby improving the security of the data connection established with the server.

[0113] In one possible implementation, if a second encapsulated message is not received from the server within a preset time after the first encapsulated message is sent to the server, it indicates that the server has rejected the establishment of the data connection. At this time, the possible faults that may have occurred during the process of sending the first encapsulated message to the server can be checked and the faults can be handled. Then, the first encapsulated message can be resent to the server according to step S201.

[0114] S203, Confirmation that the data connection with the server failed to be established;

[0115] If the first communication key in the second encapsulated message sent by the server does not meet the preset conditions, that is, the first communication key fails to be verified, then it is confirmed that the data connection with the server has failed to be established.

[0116] In one possible implementation, after confirming that the data connection with the server has failed to be established, the system checks for potential faults during the process of sending the first encapsulated message to the server and during the process of receiving the second encapsulated message sent by the server, and handles the faults. Then, the system re-establishes the data connection with the server according to steps S201 and S202.

[0117] S204, confirming that the data connection with the server has been successfully established;

[0118] If the first communication key in the second encapsulated message sent by the server meets the preset conditions, that is, the first communication key is verified, then the data connection between the server and the server is confirmed to be successfully established. After that, data can be transmitted to the server and data can be received from the server, thereby realizing data interaction between the server and the server.

[0119] It should be noted that, in this embodiment of the application, after confirming that the data connection with the server is successfully established, the second hash value and the second status value in the second encapsulated message are cached to obtain cached information containing the second hash value and the second status value. When the data connection between the client and the server is disconnected, data can be directly transmitted based on the second hash value and the second status value while the cached information exists, thereby saving the time overhead before data transmission and further improving the transmission efficiency when transmitting data to the server.

[0120] Specifically, when the data connection established between the client and the server is broken and a new connection is needed for data interaction, the client can first check whether the second hash value and the second status value in the second encapsulated message exist.

[0121] If the second hash value and the second status value in the second encapsulated message do not exist, the data connection with the server is re-established according to steps S201, S202, S203 and S204.

[0122] If a second hash value and a second status value exist in the second encapsulated message, a data connection is established based on the second hash value and the second status value in the second encapsulated message, and the target data is transmitted.

[0123] By using the above method, when the data connection between the client and the server is lost, the query based on the second hash value and the second state value confirms whether there is cached information containing the second hash value and the second state value. This avoids having to go through another RTT to establish a data connection with the server when cached information exists, thereby reducing the time overhead of establishing a data connection.

[0124] Furthermore, when establishing a data connection and transmitting target data based on the second hash value and the second status value in the second encapsulated message, the target data, the second hash value and the second status value in the second encapsulated message are first obtained; then the second hash value and the second status value are decrypted to obtain the second communication key.

[0125] It should be noted that, in this embodiment of the application, when decrypting the second hash value and the second state value to obtain the second communication key, the second hash value and the second state value are input into the decryption kit, and then the second hash value and the second state value are decrypted based on the decryption kit; if the decryption kit does not output the second communication key, the decryption fails, and the data connection with the server is established according to steps S201, S202, S203 and S204; if the decryption kit outputs the second communication key, the target data can be directly transmitted to the server based on the second communication key.

[0126] Furthermore, when transmitting target data directly to the server based on the second communication key, the second communication key and the target data are first encapsulated to generate a third encapsulated message; then the third encapsulated message is sent to the server so that the server can verify the second communication key in the third encapsulated message, establish a data connection, and process the target data in the third encapsulated message.

[0127] Using the above method, the data connection established with the server is restored based on the second communication key obtained by decrypting the second hash value and the second state value. Then, the target data can be directly transmitted to the server based on the second communication key. At this time, the data connection can be established in half the RTT, reducing the time overhead of establishing the data connection and further improving the transmission efficiency when transmitting data to the server. At the same time, based on the transmission of the second communication key, it is possible to identify whether the transmitted message has been intercepted or forged by a third party, thereby improving the security of the data connection established with the server.

[0128] Example 2:

[0129] Reference Figure 3 The diagram shows a method flow for establishing a data connection according to an embodiment of this application. Figure 2 This method is applied to Figure 4The data transmission system shown includes a server and a client. Figure 3 The method flow shown is specifically applied to the server side of this data transmission system, including:

[0130] S301, Receive the first encapsulated message sent by the client;

[0131] The system receives the first encapsulated message sent by the client and can then determine whether to establish a data connection with the client based on the first encapsulated message.

[0132] S302, decrypt the first encapsulated message to obtain the first communication key, and generate a second encapsulated message containing the first communication key;

[0133] Specifically, after receiving the first encapsulated message sent by the client, the first hash value and the first status value in the first encapsulated message are input into the decryption suite. If the decryption suite does not output the first communication key, decryption fails and the establishment of a data connection with the client is refused; if the decryption suite outputs the first communication key, the establishment of a data connection with the client is allowed.

[0134] It should be noted that the decryption kit here is the same as the decryption kit in Embodiment 1, that is: a decryption kit based on SHA or a decryption kit based on deep learning algorithms. In this embodiment, the decryption kit can be adjusted according to the specific application scenario.

[0135] Furthermore, after obtaining the first communication key, a second encapsulated message containing the first communication key is generated.

[0136] In one possible implementation, when generating a second encapsulated message containing a first communication key, the second hardware information of the server is first obtained; then, based on the second hardware information, the second hash value corresponding to the second hardware information is calculated.

[0137] It should be noted that the calculation of the second hash value corresponding to the second hardware information is consistent with the calculation of the first hash value corresponding to the first hardware information in Embodiment 1. That is, the second hash value corresponding to the second hardware information is calculated based on the GetHash calculation method or based on the HashCode calculation method. In this embodiment, the calculation method can be adjusted according to the specific application scenario.

[0138] Furthermore, the second hash value is input into the encryption suite, and the corresponding second state value is output, wherein the second state value is used to calculate the communication key.

[0139] It should be noted that the encryption suite here is the same as the encryption suite in Embodiment 1, that is, a TLS-based encryption suite or an IDEA-based encryption suite. In this embodiment, the encryption suite can be adjusted according to the specific application scenario.

[0140] After obtaining the second hash value and the second state value, the second hash value, the second state value, and the aforementioned first communication key are encapsulated to generate a second encapsulated message.

[0141] In the above manner, based on the second hardware information on the server side, the second hash value corresponding to the second hardware information is calculated, and based on the second hash value and the encryption suite, the second state value is obtained, and then the second encapsulated message is obtained. This ensures that a message allowing the establishment of a data connection can be sent to the client in the future. At the same time, based on the transmission of the first communication key, it is possible to identify whether the transmitted message has been intercepted or forged by a third party, thereby improving the security of the data connection established between the server and the client.

[0142] S303, send the second encapsulated message to the client;

[0143] After generating the second encapsulated message, the second encapsulated message is sent to the client so that the client can establish a data connection based on the first communication key in the second encapsulated message.

[0144] Once a data connection is successfully established with the client, data interaction between the two clients can be achieved.

[0145] In one possible implementation, after the client establishes a data connection based on the first communication key in the second encapsulated message, when the data connection between the server and the client is broken and a reconnection is required for data interaction, the server first receives the third encapsulated message sent by the client; then it verifies whether the second communication key in the third encapsulated message meets the preset conditions.

[0146] It should be noted that the preset conditions here are the same as those in Embodiment 1, namely: the second key value corresponding to the second hash value obtained after the decryption kit processes the second communication key is the same as the original second key value corresponding to the second hash value stored on the server, or the value output by the second communication key after the decryption kit is within the preset range. In this embodiment, the preset conditions can be adjusted according to the specific application scenario.

[0147] If the second communication key in the third encapsulated message does not meet the preset conditions, the data connection with the client is refused, and the failure to establish the data connection with the client is confirmed. If the second communication key in the third encapsulated message meets the preset conditions, the data connection with the client is allowed, the successful establishment of the data connection with the client is confirmed, and the target data in the third encapsulated message is processed.

[0148] In this way, when the data connection between the server and the client is broken, the data connection between the server and the client is re-established based on the verification of the second communication key in the third encapsulated message sent by the client. At this time, the data connection can be established in half the RTT, thereby reducing the time overhead of establishing the data connection. Furthermore, based on the verification of the second communication key, it is possible to identify whether the transmitted message has been intercepted or forged by a third party, thereby improving the security of the data connection established between the server and the client.

[0149] In summary, the method for establishing a data connection proposed in this application involves the client sending a generated first encapsulated message to the server, which then decrypts the first encapsulated message to obtain a first communication key and generates a second encapsulated message containing the first communication key. Upon receiving the second encapsulated message from the server, the client verifies the first communication key in the second encapsulated message. If the first communication key meets preset conditions, the successful establishment of the data connection with the server can be confirmed.

[0150] On the server side, after receiving the first encapsulated message sent by the client, the server decrypts the first encapsulated message to obtain the first communication key and generates a second encapsulated message containing the first communication key; then the server sends the second encapsulated message to the client so that the client can verify the first communication key in the second encapsulated message and establish a data connection.

[0151] At this point, establishing a data connection between the client and the server only requires one RTT, which reduces the time overhead of establishing the data connection and thus improves the data transmission efficiency between the client and the server.

[0152] Furthermore, when the data connection between the client and the server is lost, the client checks whether there is cached information containing the second hash value and the second state value based on the query of the second hash value and the second state value. During the period when the cached information exists, the data connection established with the server is restored based on the second communication key obtained by decrypting the second hash value and the second state value. Then, the target data can be directly transmitted to the server based on the second communication key.

[0153] On the server side, the second communication key in the third encapsulated message sent by the client is verified, and the data connection with the client is re-established.

[0154] At this point, only half of the RTT is experienced when establishing a data connection between the client and the server, which reduces the time overhead of establishing a data connection and further improves the data transmission efficiency between the client and the server.

[0155] On the other hand, based on the transmission and verification of the first and second communication keys, it is possible to identify whether the transmitted messages have been intercepted or forged by a third party, thereby improving the security of the data connection established between the client and the server.

[0156] The technical solution of this application will be further explained below with reference to a specific application process.

[0157] like Figure 5 The diagram illustrates the process of establishing a data connection. First, on the client side, the first hardware information of the client is input into GetHash to obtain the first hash value. Then, the first hash value is input into the encryption suite to obtain the first status value. Next, the first hash value and the first status value are encapsulated to generate the first encapsulated message. Finally, the first encapsulated message is sent to the server.

[0158] On the server side, a first encapsulated message is received and decrypted using a decryption suite. If the decryption suite does not output a first communication key, a data connection with the client is refused. If the decryption suite outputs the first communication key, a data connection with the client is allowed, and a second encapsulated message containing the first communication key is encapsulated. Specifically, when encapsulating the second encapsulated message containing the first communication key, the second hardware information obtained from the server is first input into GetHash to obtain a second hash value. Then, the second hash value is input into an encryption suite to obtain a second status value. Finally, the second hash value, the second status value, and the first communication key are encapsulated to generate the second encapsulated message. This second encapsulated message is then sent to the client.

[0159] Furthermore, in the client, the second encapsulated message is received, and the first communication key in the second encapsulated message is input into the decryption kit to verify the first communication key. If the first communication key fails to pass verification, it is confirmed that the data connection with the server has failed to be established; if the first communication key passes verification, it is confirmed that the data connection with the server has been established successfully, and then data interaction with the server can be performed.

[0160] Furthermore, on the client side, after confirming the successful establishment of the data connection with the server, the second hash value and the second status value in the second encapsulated message are cached. When the data connection with the server is broken, the client checks whether the second hash value and the second status value exist. If the second hash value and the second status value do not exist, the client re-establishes the data connection with the server based on the above steps. If the second hash value and the second status value exist, the client decrypts the second hash value and the second status value using a decryption suite to obtain the second communication key. Then, the client obtains the target data, encapsulates the second communication key and the target data, generates a third encapsulated message, and sends the third encapsulated message to the server.

[0161] Furthermore, on the server side, when the data connection with the client is broken, the server receives the third encapsulated message sent by the client and verifies the second communication key in the third encapsulated message using a decryption suite. If the second communication key fails to be verified, the server confirms that the data connection with the client has failed to be established. If the second communication key passes the verification, the server confirms that the data connection with the client has been established successfully and processes the target data.

[0162] In the above manner, the client sends the generated first encapsulated message to the server; the server decrypts the first encapsulated message to obtain the first communication key, and generates a second encapsulated message containing the first communication key, and then sends the second encapsulated message to the client; then the client verifies the first communication key in the second encapsulated message, and when the verification is successful, it can be confirmed that the data connection between the client and the server is successfully established. At this time, the data connection between the client and the server only needs to go through one RTT, which reduces the time overhead of establishing the data connection and thus improves the data transmission efficiency between the client and the server.

[0163] Furthermore, when the data connection between the client and the server is lost, the presence of cached information in the client is confirmed by the presence of a second hash value and a second state value. During the period when the cached information exists, a data connection between the client and the server can be directly established based on the second hash value and the second state value. At this time, the data connection between the client and the server only takes half of the RTT, thereby reducing the time overhead of establishing the data connection and further improving the data transmission efficiency between the client and the server.

[0164] On the other hand, based on the transmission and verification of the first and second communication keys, it is possible to identify whether the transmitted messages have been intercepted or forged by a third party, thereby improving the security of the data connection established between the client and the server.

[0165] Based on the same inventive concept, this application also provides a device for establishing a data connection, such as... Figure 6 The diagram shown is a schematic representation of a device structure for establishing a data connection according to this application. Figure 1 This device is applied to Figure 4 The data transmission system shown includes a client and a server. Figure 6 The illustrated device structure, specifically applied to the client side of this data transmission system, includes:

[0166] The sending module 601 is used to send the generated first encapsulated message to the server so that the server can decrypt the first encapsulated message to obtain the first communication key and generate a second encapsulated message containing the first communication key.

[0167] The first processing module 602 is used to receive the second encapsulated message sent by the server and verify whether the first communication key in the second encapsulated message meets the preset conditions.

[0168] If not, it indicates that the data connection with the server failed to be established.

[0169] If so, confirm that the data connection with the server has been successfully established.

[0170] In one possible implementation, the sending module 601 is specifically used to obtain the first hardware information of the client;

[0171] Based on the first hardware information, the first hash value corresponding to the first hardware information is calculated;

[0172] The first hash value is input into the encryption suite, and the corresponding first state value is output. The first state value is used to calculate the communication key.

[0173] The first hash value and the first state value are encapsulated to generate the first encapsulated message.

[0174] In one possible implementation, the first processing module 602 is specifically used to query whether the second hash value and the second status value in the second encapsulated message exist when the data connection established with the server is disconnected.

[0175] If not, re-establish the data connection with the server;

[0176] If so, establish a data connection based on the second hash value and the second state value, and transmit the target data.

[0177] In one possible implementation, the first processing module 602 is specifically used to acquire target data, a second hash value, and a second state value;

[0178] Decrypt the second hash value and the second state value to obtain the second communication key;

[0179] Encapsulate the second communication key and target data to generate a third encapsulated message;

[0180] Send a third encapsulated message to the server so that the server can verify the second communication key in the third encapsulated message, establish a data connection, and process the target data in the third encapsulated message.

[0181] like Figure 7 The diagram shown is a schematic representation of a device structure for establishing a data connection according to this application. Figure 2 This device is applied to Figure 4 The data transmission system shown includes a server and a client. Figure 7 The illustrated device structure, specifically applied to the server side of this data transmission system, includes:

[0182] Receiver module 701 is used to receive the first encapsulated message sent by the client;

[0183] The decryption module 702 is used to decrypt the first encapsulated message to obtain the first communication key and generate a second encapsulated message containing the first communication key.

[0184] The second processing module 703 is used to send a second encapsulated message to the client so that the client can establish a data connection based on the first communication key in the second encapsulated message.

[0185] In one possible implementation, the decryption module 702 is specifically used to obtain the second hardware information from the server.

[0186] Based on the second hardware information, the second hash value corresponding to the second hardware information is calculated;

[0187] The second hash value is input into the encryption suite, and the corresponding second state value is output. The second state value is used to calculate the communication key.

[0188] The second hash value, the second status value, and the first communication key are encapsulated to generate a second encapsulated message.

[0189] In one possible implementation, the second processing module 703 is specifically configured to receive a third encapsulated message sent by the client when the data connection established with the client is broken.

[0190] Verify whether the second communication key in the third encapsulated message meets the preset conditions;

[0191] If not, confirm that the data connection with the client failed to be established;

[0192] If so, confirm that the data connection with the client has been successfully established, and process the target data in the third encapsulated message.

[0193] Based on the same inventive concept, this application also provides an electronic device that can realize the function of the aforementioned data connection establishment device. (Refer to...) Figure 8 The aforementioned electronic devices include:

[0194] At least one processor 801 and a memory 802 connected to at least one processor 801. In this embodiment, the specific connection medium between the processor 801 and the memory 802 is not limited. Figure 8 The example shown is the connection between processor 801 and memory 802 via bus 800. Bus 800 is... Figure 8 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. The 800 bus can be divided into address bus, data bus, control bus, etc., for ease of representation. Figure 8 The term is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, the processor 801 can also be called a controller; there is no restriction on the name.

[0195] In this embodiment, memory 802 stores instructions executable by at least one processor 801. By executing the instructions stored in memory 802, at least one processor 801 can perform the method for establishing a data connection as described above. Processor 801 can implement... Figure 8 The functions of each module in the device shown.

[0196] The processor 801 is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory 802 and calling data stored in memory 802, the processor can perform various functions and process data, thereby monitoring the device as a whole.

[0197] In one possible design, processor 801 may include one or more processing units. Processor 801 may integrate an application processor and a modem processor, wherein the application processor mainly handles operating devices, user interfaces, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into processor 801. In some embodiments, processor 801 and memory 802 may be implemented on the same chip; in some embodiments, they may also be implemented on separate chips.

[0198] The processor 801 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method for establishing a data connection disclosed in the embodiments of this application can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0199] Memory 802, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 802 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Memory 802 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In the embodiments of this application, memory 802 can also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0200] By designing and programming the processor 801, the code corresponding to the data connection establishment method described in the foregoing embodiments can be embedded into the chip, enabling the chip to execute it during operation. Figure 6 and Figure 7 The steps of establishing a data connection in the illustrated embodiment are described. How to design and program the processor 801 is a technique well-known to those skilled in the art and will not be elaborated upon here.

[0201] Based on the same inventive concept, embodiments of this application also provide a storage medium storing computer instructions that, when executed on a computer, cause the computer to perform the method for establishing a data connection as described above.

[0202] In some possible implementations, various aspects of the method for establishing a data connection provided in this application can also be implemented as a program product comprising program code that, when the program product is run on a device, causes the control device to perform the steps in the method for establishing a data connection according to the various exemplary embodiments of this application described above.

[0203] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0204] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0205] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0206] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0207] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method of establishing a data connection, characterized by, The method includes: A first encapsulated message is sent to the server so that the server can decrypt the first encapsulated message to obtain a first communication key and generate a second encapsulated message containing the first communication key; wherein, the first encapsulated message includes a first hash value and a first status value; Receive the second encapsulated message sent by the server and verify whether the first communication key in the second encapsulated message meets the preset conditions; If not, it is confirmed that the data connection with the server failed to be established; If so, confirm that the data connection with the server has been successfully established; cache the second hash value and the second status value in the second encapsulated message.

2. The method of claim 1, wherein, Before sending the generated first encapsulated message to the server, the method further includes: Obtain the client's initial hardware information; Based on the first hardware information, the first hash value corresponding to the first hardware information is calculated; The first hash value is input into the encryption suite, and the corresponding first state value is output, wherein the first state value is used to calculate the communication key; The first hash value and the first status value are encapsulated to generate the first encapsulated message.

3. The method of claim 1, wherein, After confirming the successful establishment of the data connection with the server, the process further includes: When the data connection established with the server is broken, query whether the second hash value and the second status value exist; If not, re-establish the data connection with the server. If so, a data connection is established based on the second hash value and the second status value, and the target data is transmitted.

4. The method of claim 3, wherein, The step of establishing a data connection and transmitting target data based on the second hash value and the second state value includes: Obtain the target data, the second hash value, and the second status value; Decrypt the second hash value and the second state value to obtain the second communication key; The second communication key and the target data are encapsulated to generate a third encapsulated message; The third encapsulated message is sent to the server so that the server can verify the second communication key in the third encapsulated message, establish a data connection, and process the target data in the third encapsulated message.

5. A method of establishing a data connection, characterized by, The method includes: Receive a first encapsulated message sent by the client; wherein the first encapsulated message includes a first hash value and a first status value; The first encapsulated message is decrypted to obtain the first communication key, and a second encapsulated message containing the first communication key is generated. The second encapsulated message is sent to the client so that the client establishes a data connection based on the first communication key in the second encapsulated message and caches the second hash value and the second status value in the second encapsulated message.

6. The method of claim 5, wherein, The generation of the second encapsulated message containing the first communication key includes: Obtain the second hardware information from the server; Based on the second hardware information, the second hash value corresponding to the second hardware information is calculated; The second hash value is input into the encryption suite, and the corresponding second state value is output, wherein the second state value is used to calculate the communication key; The second hash value, the second status value, and the first communication key are encapsulated to generate the second encapsulated message.

7. The method of claim 5, wherein, After sending the second encapsulated message to the client so that the client establishes a data connection based on the first communication key in the second encapsulated message, the method further includes: When the data connection established with the client is broken, receive the third encapsulated message sent by the client; Verify whether the second communication key in the third encapsulated message meets the preset conditions; If not, it is confirmed that the data connection with the client failed to be established; If so, confirm that the data connection with the client has been successfully established, and process the target data in the third encapsulated message.

8. An apparatus for establishing a data connection, characterized by The device includes: The sending module is used to send a generated first encapsulated message to the server, so that the server can decrypt the first encapsulated message to obtain a first communication key and generate a second encapsulated message containing the first communication key; wherein, the first encapsulated message includes a first hash value and a first status value; The first processing module is used to receive the second encapsulated message sent by the server and verify whether the first communication key in the second encapsulated message meets the preset conditions. If not, it is confirmed that the data connection with the server failed to be established; If so, confirm that the data connection with the server has been successfully established; cache the second hash value and the second status value in the second encapsulated message.

9. An electronic device, comprising: include: Memory, used to store computer programs; A processor, when executing a computer program stored in the memory, implements the method steps of any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method described in any one of claims 1-7.

Images