Method, device and equipment for sending data packet and storage medium

Abstract

The embodiment of the application discloses a data message sending method, device and equipment and a storage medium, which are applied to the technical field of cloud technology, artificial intelligence and the like. The method comprises the following steps: a first device generates a first data message carrying a first connection identifier, and sends the first data message to a second device associated with the first connection identifier; if the first connection identifier satisfies a connection identifier updating condition, a connection identifier updating strategy is obtained; the connection identifier updating strategy is determined by the first device and the second device; the first connection identifier is updated according to the connection identifier updating strategy, and a second connection identifier associated with the second device is obtained; a second data message carrying the second connection identifier is generated, and the second data message is sent to the second device. Through the application, the communication interruption between devices can be avoided, and the communication security between devices can be improved.

Description

Technical Field

[0001] This application relates to fields such as cloud technology and artificial intelligence technology, and in particular to a method, apparatus, device and storage medium for sending data messages. Background Technology

[0002] Currently, communication between devices typically relies on the Transmission Control Protocol (TCP), a communication method based on the device's IP address. In practice, it has been found that this communication method can lead to communication interruptions when the device's IP address changes. For example, suppose a terminal's IP address is IP address 1 at location 1 and IP address 2 at location 2. At time t1, the terminal communicates with the cloud server at location 1 using IP address 1. At time t2, the terminal switches from location 1 to location 2, and its IP address is updated to IP address 2. However, the cloud server still communicates with the terminal using IP address 1, making it unable to match the terminal and thus causing a communication interruption between the cloud server and the terminal. Furthermore, the terminal's IP address is easily obtained by unauthorized users, resulting in relatively low security for communication between devices. Summary of the Invention

[0003] This application provides a method, apparatus, device, and storage medium for sending data packets, which can avoid communication interruptions between devices and improve the security of communication between devices.

[0004] One embodiment of this application provides a method for sending data packets, including: A first device generates a first data packet carrying a first connection identifier and sends the first data packet to a second device associated with the first connection identifier; the first data packet is used to instruct the second device to process the first data packet when it determines that the first connection identifier is legitimate. If the first connection identifier meets the connection identifier update condition, then the connection identifier update strategy is obtained; the connection identifier update strategy is determined by the first device and the second device. According to the connection identifier update strategy, the first connection identifier is updated to obtain a second connection identifier associated with the second device; A second data packet carrying the second connection identifier is generated and sent to the second device; the second data packet is used to instruct the second device to process the second data packet when it determines that the second connection identifier is legitimate based on the connection identifier update policy.

[0005] One embodiment of this application provides a method for sending data packets, including: The second device receives a first data packet carrying a first connection identifier sent by the first device; If the first connection identifier is valid, then the first data packet is processed; The device receives a second data packet carrying a second connection identifier sent by the first device; the second connection identifier is obtained by updating the first connection identifier based on a connection identifier update strategy when the first connection identifier meets the connection identifier update condition, and the connection identifier update strategy is determined by the first device and the second device. The validity of the second connection identifier is verified according to the connection identifier update strategy to obtain the validity verification result; If the validity verification result indicates that the second connection identifier is valid, then the second data packet is processed.

[0006] One embodiment of this application provides a data packet sending apparatus, comprising: The generation module is used to generate a first data packet carrying a first connection identifier and send the first data packet to a second device associated with the first connection identifier; the first data packet is used to instruct the second device to process the first data packet when it determines that the first connection identifier is legitimate. The acquisition module is used to acquire a connection identifier update strategy if the first connection identifier meets the connection identifier update condition; the connection identifier update strategy is determined by the first device and the second device. The update module is used to update the first connection identifier according to the connection identifier update strategy to obtain a second connection identifier associated with the second device; The generation module is further configured to generate a second data packet carrying the second connection identifier and send the second data packet to the second device; the second data packet is used to instruct the second device to process the second data packet when it determines that the second connection identifier is legitimate based on the connection identifier update policy.

[0007] One embodiment of this application provides a data packet sending apparatus, comprising: The receiving module is used to receive a first data packet carrying a first connection identifier sent by the first device; The processing module is configured to process the first data packet if the first connection identifier is valid. The receiving module is further configured to receive a second data packet carrying a second connection identifier sent by the first device; the second connection identifier is obtained by updating the first connection identifier based on a connection identifier update strategy when the first connection identifier meets the connection identifier update condition, and the connection identifier update strategy is determined by the first device and the second device. The verification module is used to verify the legality of the second connection identifier according to the connection identifier update strategy, and obtain the legality verification result; The processing module is further configured to process the second data packet if the validity verification result indicates that the second connection identifier is valid.

[0008] One embodiment of this application provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described.

[0009] One embodiment of this application provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the method described.

[0010] One aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the method described.

[0011] In this application, during communication between the first and second devices, the first device sends data packets to the second device via a connection identifier, independent of the second device's IP address. This avoids communication interruptions caused by changes in the second device's IP address, thus improving the reliability of communication between the two devices. Furthermore, by negotiating a connection identifier update strategy between the first and second devices, the connection identifier used for communication between them is dynamically updated according to this strategy during communication. This effectively prevents unauthorized users from speculating on the user's services or other private information through a single connection identifier, facilitating the construction of secure and reliable cloud service transmission technology and enhancing the security of communication between the first and second devices. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a schematic diagram of a data packet sending system provided in this application; Figure 2a This is a flowchart illustrating a method for sending data packets provided in this application; Figure 2b This is a schematic diagram illustrating the interaction between a terminal and a server in a data packet sending system provided in this application; Figure 3 This is a flowchart illustrating a method for sending data packets provided in this application; Figure 4 This is a schematic diagram illustrating the correspondence between an update cycle and a connection identifier, as provided in this application. Figure 5 This is a schematic diagram illustrating a scenario where a connection identifier in a set of release identifiers is provided in this application; Figure 6 This is a schematic diagram illustrating a scenario where a connection identifier in a set of release identifiers is provided in this application; Figure 7 This is a flowchart illustrating a method for sending data packets provided in this application; Figure 8 This is a schematic diagram of a communication scenario between a first device and a second device provided in this application; Figure 9 This is a schematic diagram of the structure of a data packet sending device provided in an embodiment of this application; Figure 10 This is a schematic diagram of the structure of a data packet sending device provided in an embodiment of this application; Figure 11 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application; Figure 12 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0014] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0015] This application primarily relates to cloud computing within artificial intelligence. Artificial intelligence (AI) is the theory, methods, technology, and application systems that utilize digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce new intelligent machines that can react in a way similar to human intelligence. AI studies the design principles and implementation methods of various intelligent machines, enabling them to possess perception, reasoning, and decision-making capabilities. AI technology is a comprehensive discipline involving a wide range of fields, encompassing both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing technology, operating / interactive systems, and mechatronics. AI software technologies mainly include computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0016] Cloud computing is a computing model that distributes computing tasks across a resource pool composed of numerous computers, enabling various application systems to access computing power, storage space, and information services as needed. The network providing these resources is called the "cloud." From the user's perspective, resources in the "cloud" are infinitely scalable and can be accessed, used on demand, and expanded at any time. This application can improve the security of cloud service traffic transmission by periodically updating connection identifiers through the deployment of servers with cloud computing capabilities, thereby enhancing the competitiveness of cloud server providers.

[0017] To facilitate a clearer understanding of this application, the data message sending system implementing this application will be introduced first, such as... Figure 1 As shown, this data processing system includes server 10 and a terminal cluster. The terminal cluster can include one or more terminals; the number of terminals will not be limited here. Figure 1 As shown, the terminal cluster may specifically include terminal 1, terminal 2, ..., terminal n; it can be understood that terminal 1, terminal 2, terminal 3, ..., terminal n can all connect to server 10 via the network so that each terminal can interact with server 10 via the network.

[0018] The terminal has one or more applications installed, which may include social applications, shopping applications, live streaming applications, video playback applications, entertainment applications (such as game applications), ride-hailing applications, etc.

[0019] A server is a device that provides backend services to applications in a terminal. For example, a server can be a device that provides application data to applications in a terminal. The application data is associated with the application. For example, if the application is a live streaming application, the application data can refer to the live streaming data stream; if the application is a game application, the application data can refer to the game screen data; if the application is a social application, the application data can refer to social content.

[0020] Understandably, the server can send application data to the terminal device based on the connection identifier (CID). This connection identifier (CID) is crucial information in the QUIC protocol (Quick UDP Internet Connections, a UDP-based transport layer protocol) for marking session connections. This connection identifier is independent of the terminal's IP address. When the terminal user's IP address changes, because the connection identifier remains constant, there is no need to re-establish the connection, and the server can still continue sending application data to the terminal based on the connection identifier. Furthermore, the QUIC protocol's connection identifier technology also supports seamless switching between wireless and cellular networks, providing a better user experience.

[0021] Understandably, by adding a connection identifier field to the data packets sent to the terminal based on the aforementioned QUIC protocol, the server ensures that data interaction with the server continues even when the terminal's IP address changes. However, if the server consistently uses the same connection identifier when sending data packets to the terminal, it can easily lead to the leakage of the terminal's private data. For example, unauthorized users can intercept traffic containing a specific connection identifier in the data packets and use the packet number in the data packets to determine the duration and number of interaction packets between a terminal and the cloud server, thereby inferring private information such as the application services the terminal is currently using. This poses a serious challenge to user privacy and security. Therefore, this application addresses this issue by having the server and terminal negotiate a connection identifier update strategy and an initial connection identifier. Based on the initial connection identifier and the connection identifier update strategy, the connection identifier is dynamically updated to prevent unauthorized users from obtaining data packets and to improve the communication security between the server and the terminal.

[0022] Understandably, the connection identifier update policy specifies the timing of connection identifier updates, the method for generating data packet numbers, and the update rules for connection identifiers. For example, the connection identifier can be updated when it has been used to send n data packets; or, it can be updated when the usage time of a connection identifier reaches a time threshold. The connection identifier update rules indicate how to update the connection identifier, such as updating it based on parameters like the shared key between the server and the terminal. The data packet number reflects which data packet the server sent. The method for generating data packet numbers can indicate individual numbering according to the update cycle or consecutive numbering. Individual numbering according to the update cycle means that each data packet within the update cycle corresponding to each connection identifier is individually numbered, such as starting numbering from 0 for each data packet within the update cycle corresponding to each connection identifier. Consecutive numbering means numbering the data packets sent by the server sequentially in an ascending manner. One update cycle corresponds to one connection identifier. Data packets sent within one update cycle carry the same connection identifier. The number of data packets sent in different update cycles can be the same or different. The number of data packets sent within one update cycle is determined according to the connection identifier update strategy.

[0023] The server can be a single physical server, a server cluster or distributed system consisting of at least two physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, Content Delivery Network (CDN), and big data and artificial intelligence platforms. The terminal can specifically refer to in-vehicle terminals, smartphones, tablets, laptops, desktop computers, smart speakers, speakers with screens, smartwatches, etc., but is not limited to these. The terminals and servers can be directly or indirectly connected via wired or wireless communication. The number of terminals and servers can be one or at least two; this application does not impose any restrictions.

[0024] For example, such as Figure 2a and Figure 2b As shown, taking the example of terminal 32a requesting application data about the live streaming application from server 33a, Figure 2b Terminal 32a in the text can refer to Figure 1 Any terminal in the terminal cluster, Figure 2b Server 33a in the text can refer to Figure 1 The communication process between server 10, server 33a and terminal 32a is as follows: Figure 2a As shown, Figure 2a The communication process between server 33a and terminal 32a includes the following steps S21a~S31a: S21a Communication negotiation, which is to negotiate whether terminal 32a is allowed to communicate with server 33a. This process includes server 33a verifying the legitimacy of terminal 32a, such as verifying whether the user corresponding to terminal 32a is a registered user of the live streaming application. If so, terminal 32a is deemed to be legitimate and step S22a is executed; otherwise, the process ends.

[0025] S22a. Does the connection identifier change support the server 33a? The server 33a checks whether the terminal 32 supports enabling the connection identifier change. If it does not support the change, the server 33a supports the change. If it does support the change, the server 33a supports the change.

[0026] S23a and server 33a send traffic based on the initial connection identifier. That is, if the terminal does not support enabling connection identifier update, server 33a sends traffic (data packets) based on the initial connection identifier negotiated between the server and the terminal.

[0027] S24a, Obtain the connection identifier under the current update cycle; that is, if the terminal supports enabling connection identifier updates, the server 33a obtains the connection identifier under the current update cycle.

[0028] S25a, Calculate the message number.

[0029] S26a, Send data packets.

[0030] S27a and Terminal 32a verification. That is, Terminal 32a verifies the legitimacy of the connection identifier carried in the data packet and obtains the legitimacy verification result.

[0031] S28a, if the verification is successful, that is, if the connection identifier carried in the data packet is valid, the verification is successful. Then proceed to step S30a; if the verification is unsuccessful, the verification is unsuccessful. Then proceed to step S29a.

[0032] S29a, Discard the data packet.

[0033] S30a. Whether there is packet loss: Terminal 32a determines whether there is a packet loss problem in the data packets sent by server 33a. If there is a packet loss problem, it returns to the above step S24a; if there is no packet loss problem, it executes step S31a.

[0034] S31a. Concatenate and send data packets sequentially to the application layer for processing. That is, if there is no packet loss, concatenate each data packet sequentially according to the offset of the data packet and send it to the application layer for processing.

[0035] In steps S22a to S31a above, when terminal 32a supports enabling connection identifier update, terminal 32a and server 33a need to negotiate the initial connection identifier and connection identifier update strategy. Specifically, terminal 32a and server 33a can negotiate the connection identifier update strategy and initial connection identifier through any one of the following two methods or a combination of two methods: Method 1: Terminal 32a can encrypt the initial connection identifier and connection identifier update strategy using a shared key to obtain encrypted data of the connection identifier, generate a data acquisition request 1 for application data of the live streaming application, and send the data acquisition request 1 to server 33a. Here, data acquisition request 1 carries the program identifier of the live streaming application, encrypted data of the connection identifier, etc. The initial connection identifier can refer to a random number generated by terminal 32a, which is an unsigned integer with a maximum length of 64 bits. After receiving the data acquisition request 1, server 33a can use the shared key to decrypt the encrypted data of the connection identifier in the data acquisition request 1 to obtain the initial connection identifier and the connection identifier update strategy, so as to complete the process of negotiating the initial connection identifier and the connection identifier update strategy between terminal 32a and server 33a.

[0036] Method 2: Terminal 32a generates a data acquisition request 2 for application data of the live streaming application and sends this request to server 33a. This data acquisition request 2 carries the application identifier of the live streaming application, etc. After receiving the data acquisition request 2, the server generates an initial connection identifier and a connection identifier update policy for terminal 32a based on the request. It then encrypts the initial connection identifier and the connection identifier update policy using the shared key between terminal 32a and server 33a, obtaining encrypted data of the connection identifier. A negotiation message carrying this encrypted data is then generated and sent to terminal 32a. Upon receiving the negotiation message, terminal 32a decrypts the ciphertext of the connection identifier in the negotiation message to obtain the initial connection identifier and the connection identifier update policy, thus completing the negotiation process between terminal 32a and server 33a regarding the initial connection identifier and the connection identifier update policy.

[0037] Understandably, Data Acquisition Request 1 and Data Acquisition Request 2 mentioned above can refer to negotiation messages or control messages. Data Acquisition Request 1 and Data Acquisition Request 2 may also carry a Connection Identifier Update field (CID_update), occupying 1 bit, indicating whether terminal 32a supports enabling connection identifier changes. If the value of the Connection Identifier Update field is 0, it means that terminal 32a does not support enabling connection identifier changes; if the value of the Connection Identifier Update field is 1, it means that terminal 32a supports enabling connection identifier changes. Specifically, the value of the Connection Identifier Update field in both Data Acquisition Request 1 and Data Acquisition Request 2 is 1.

[0038] Understandably, when terminal 32a does not support enabling connection identifier changes, terminal 32a and server 33a need to negotiate an initial connection identifier for communication. Terminal 32a and server 33a can negotiate the initial connection identifier through any one of the following two methods or a combination of both: Method 1: Terminal 32a can encrypt the initial connection identifier using a shared key to obtain encrypted data of the initial connection identifier, generate a data acquisition request 3 for application data of the live streaming application, and send the data acquisition request 3 to server 33a. This data acquisition request 3 carries the application identifier of the live streaming application, the encrypted data of the initial connection identifier, and a connection identifier update field with a field value of 0, etc. The initial connection identifier can refer to a random number generated by terminal 32a, which is an unsigned integer with a maximum length of 64 bits. After receiving the data acquisition request 3, server 33a can decrypt the encrypted data of the initial connection identifier in the data acquisition request 3 using the shared key to obtain the initial connection identifier, thus completing the process of negotiating the initial connection identifier between terminal 32a and server 33a.

[0039] Method 2: Terminal 32a generates a data acquisition request 4 for application data related to the live streaming application and sends this request 4 to server 33a. This data acquisition request 4 carries the application identifier of the live streaming application, as well as a connection identifier update field with a value of 0, etc. Upon receiving the data acquisition request 4, the server determines that the terminal does not support enabling connection identifier changes and generates an initial connection identifier for terminal 32a based on the request. This initial connection identifier is then encrypted using the shared key between terminal 32a and server 33a, resulting in encrypted data. A negotiation message carrying this encrypted data is then generated and sent to terminal 32a. Upon receiving the negotiation message, terminal 32a decrypts the ciphertext of the initial connection identifier within the negotiation message to obtain the initial connection identifier, thus completing the negotiation process between terminal 32a and server 33a for the initial connection identifier.

[0040] Understandably, the connection update identifier strategy described above may include an update timing field (Update_duration): occupying 32 bits, indicating the period or frequency of connection identifier changes, such as every 2... Updata_duration A connection identifier change operation is performed on each data packet, or at intervals of `Update_duration`. The following example assumes `Update_duration` is 1, and the change occurs every 2... 1 This section explains how a connection identifier change operation is performed on a single data packet.

[0041] Understandably, this application can support connection identifier differentiation for each data packet, not just connection identifier updates per cycle. Specifically, in the negotiation process of step S21a, the terminal sets the value of the Update_duration field to 0, thus enabling each data packet to have a different connection identifier.

[0042] like Figure 2b During update cycle T0, server 33a can obtain application data 1 about the live streaming application, generate data packet 1 carrying application data 1 and an initial connection identifier, and send data packet 1 to terminal 32a. Upon receiving data packet 1, terminal 32a can verify the validity of the initial connection identifier in data packet 1 based on its local initial connection identifier. If the local initial connection identifier of terminal 32a is the same as the initial connection identifier in data packet 1, then the initial connection identifier in data packet 1 is considered valid, and application data 1 in data packet 1 is processed. If the local initial connection identifier of terminal 32a is different from the initial connection identifier in data packet 1, then the initial connection identifier in data packet 1 is considered invalid, and data packet 1 is discarded. Similarly, server 33a can obtain application data 2 about the live streaming application, generate data packet 2 carrying application data 2 and an initial connection identifier, and send data packet 2 to terminal 32a. After receiving data packet 2, terminal 32a can verify the validity of the initial connection identifier in data packet 2 based on its local initial connection identifier. Specifically, if the initial connection identifier in terminal 32a's local identifier is the same as the initial connection identifier in data packet 2, then the initial connection identifier in data packet 2 is deemed valid, and the application data 2 in data packet 2 is processed. If the initial connection identifier in terminal 32a's local identifier is different from the initial connection identifier in data packet 2, then the initial connection identifier in data packet 2 is deemed invalid, and data packet 2 is discarded.

[0043] Furthermore, when server 33a needs to send application data 3 to terminal 32a, since the number of packets carrying the initial connection identifier sent within update cycle T0 is two, meaning the initial connection identifier meets the connection identifier update condition, server 33a can update the initial connection identifier according to the connection identifier update strategy to obtain connection identifier 1, and enter update cycle 1. Within update cycle 1, server 33a can obtain application data 3 related to the live streaming application, generate a data packet 3 carrying application data 3 and connection identifier 1, and send data packet 3 to terminal 32a. After receiving data packet 3, terminal 32a can update its local initial connection identifier according to the connection identifier update strategy to obtain a reference connection identifier 1. It can then verify the validity of connection identifier 1 in data packet 3 based on the reference connection identifier 1. That is, if the reference connection identifier is the same as the connection identifier 1 in data packet 3, then the connection identifier 1 in data packet 3 is deemed valid, and the application data 3 in data packet 3 is processed. If the reference connection identifier 1 is different from the initial connection identifier 1 in data packet 3, then the connection identifier 1 in data packet 3 is deemed invalid, and data packet 3 is discarded. Similarly, server 33a can obtain application data 4 about the live streaming application, generate data packet 4 carrying application data 4 and connection identifier 1, and send data packet 4 to terminal 32a. After receiving data packet 4, terminal 32a can verify the validity of connection identifier 1 in data packet 4 based on the reference connection identifier 1. That is, if the reference connection identifier is the same as the connection identifier 1 in data packet 4, then the connection identifier 1 in data packet 4 is deemed valid, and the application data 4 in data packet 4 is processed. If the reference connection identifier 1 is different from the initial connection identifier 1 in data packet 4, then the connection identifier 1 in data packet 4 is deemed invalid, and data packet 4 is discarded. This process continues, and server 33a can continuously send data packets to terminal device 20a.

[0044] In summary, during communication between a server and a terminal, the server sends data packets to the terminal using a connection identifier. This avoids communication interruptions caused by changes in the terminal's IP address, thus improving the reliability of communication between the server and the terminal. Furthermore, the connection identifier used for communication between the server and the terminal changes as the number of data packets sent from the server to the terminal increases. This effectively prevents unauthorized users from inferring the user's private information, such as the services they are using, through a single connection identifier. This is beneficial for building secure and reliable cloud service transmission technologies and improving the security of communication between the terminal and the server.

[0045] Further, please see Figure 3 This is a flowchart illustrating a method for sending data packets provided in an embodiment of this application. Figure 3As shown, this method can be derived from... Figure 1 It can be executed by any terminal in the terminal cluster, or by... Figure 1 The method of sending the data packet is executed by a server in the application, and the device used in this application to execute the method of sending the data packet can be collectively referred to as the first device. The method may include the following steps: S101, the first device generates a first data packet carrying a first connection identifier and sends the first data packet to the second device associated with the first connection identifier; the first data packet is used to instruct the second device to process the first data packet when it determines that the first connection identifier is legitimate.

[0046] In this application, when a second device needs to obtain application data about a certain application, the first device corresponding to that application can generate a first data packet carrying a first connection identifier and send the first data packet to the second device associated with the first connection identifier. The first connection identifier can refer to an initial connection identifier negotiated between the first and second devices, or it can refer to an updated initial connection identifier obtained according to a connection identifier update strategy negotiated between the first and second devices. The first data packet may also include application data about the application, a packet number, and an offset field. The value of the offset field in the first data packet reflects the offset of the first data packet within the entire data sent from the first device to the second device, and is used to sort the data packets. The packet number reflects which data packet the first device sent to the second device.

[0047] Understandably, before the first device sends a data packet to the second device, the first and second devices can negotiate the initial connection identifier and connection identifier update policy as follows: When the second device needs to obtain application data about a certain application, the second device can send a request to obtain the application data about that application. When the first device receives the data acquisition request, it can obtain the initial connection identifier and the connection identifier update policy associated with the second device based on the data acquisition request; the initial connection identifier is a random number generated by the first device, which is an unsigned integer with a maximum length of 64 bits. The connection identifier update strategy can be determined based on historical communication data between the second device and the first device within a historical time period. This historical communication data may include communication frequency, communication security, etc. For example, if the communication security between the second device and the first device is relatively low, the connection identifier update strategy can stipulate that the connection identifier is updated every n data packets. If the communication security between the second device and the first device is relatively high, the connection identifier update strategy can stipulate that the connection identifier is updated every m data packets, where n is less than m. That is, when the communication security between the first device and the second device is relatively low, the communication security between the first device and the second device can be improved by increasing the update frequency of the connection identifier.

[0048] Furthermore, the first device can obtain the shared key between itself and the second device, sample the shared key to encrypt the initial connection identifier and the connection identifier update policy, obtain encrypted data of the connection identifier, generate a negotiation message carrying the encrypted data of the connection identifier, and send the negotiation message to the second device. The negotiation message instructs the second device, when the initial connection identifier meets the connection identifier update conditions, to verify the legitimacy of the second target connection identifier based on the connection identifier update policy. The second target connection identifier is any connection identifier other than the initial connection identifier carried in the data packet sent by the first device to the second device; the first connection identifier is the initial connection identifier, or the first connection identifier is obtained by updating the initial connection identifier according to the connection identifier update policy. Encrypting the transmission of the initial connection identifier and the connection identifier update policy improves the security of data transmission.

[0049] Understandably, the shared key between the first device and the second device can be generated as follows: the first device can generate two prime numbers g and p, and a key pair for the first device, which includes a public key A and a private key a, i.e., A = g. a Mod p, the first device can send g, p, and A to the second device. The second device can generate its own key pair based on g and p. The second device's key pair includes a public key B and a private key b, i.e., B = g. bmod p, the second device can send B to the first device. The first device can calculate the shared key K=B. a mod p, the second device can calculate the shared key K = A b mod p. Wherein, when the first device encrypts data R using a shared key to obtain encrypted data R, the second device can decrypt the encrypted data R using the shared key to obtain data R; similarly, when the second device encrypts data D using a shared key to obtain encrypted data D, the first device can decrypt the encrypted data D using the shared key to obtain data D.

[0050] S102. If the first connection identifier meets the connection identifier update condition, the first device obtains the connection identifier update strategy; the connection identifier update strategy is determined by the first device and the second device.

[0051] In this application, when the first device needs to send data to the second device again, the first device can detect whether the first connection identifier meets the update conditions. If the first connection identifier meets the update conditions, the first device can obtain the connection identifier update strategy. The connection identifier update strategy can be determined by the first device and the second device, that is, the connection identifier update strategy can be obtained by the first device and the second device through negotiation.

[0052] Understandably, the first device can detect whether the first connection identifier meets the connection identifier update condition through any one or a combination of the following two methods: Method 1: The first device counts the number of data packets carrying the first connection identifier that it currently sends to the second device, and uses this count as the first message count. If the first message count is greater than the message count threshold, then the first connection identifier is determined to meet the connection identifier update condition. This message count threshold can refer to the maximum number of data packets carrying the first connection identifier that the first device sends to the second device as specified in the connection identifier update strategy. The message count threshold for each connection identifier specified in the connection identifier update strategy can be the same or different. By setting the update timing of the first connection identifier according to the message count threshold corresponding to the first connection identifier, it is possible to avoid too many data packets carrying the same connection identifier, leading to the loss of user privacy data and improving the communication security between the first and second devices.

[0053] Method Two: The first device can count the usage duration of the first connection identifier during the process of sending data packets from the first device to the second device. If the usage duration exceeds a duration threshold, the first connection identifier is determined to meet the connection identifier update condition. This duration threshold can refer to the longest usage duration of the first connection identifier during the process of sending data packets from the first device to the second device, as specified in the connection identifier update strategy. The duration threshold for each connection identifier specified in the connection identifier update strategy can be the same or different. By setting the update timing of the first connection identifier according to the duration threshold corresponding to the first connection identifier, the use of the same connection identifier to send data packets to the second device for an extended period can be avoided, preventing the loss of user privacy data and improving the communication security between the first and second devices.

[0054] S103. The first device updates the first connection identifier according to the connection identifier update strategy to obtain a second connection identifier associated with the second device.

[0055] In this application, the first device can update the first connection identifier according to the connection identifier update policy to obtain a second connection identifier associated with the second device. The second connection identifier is a connection identifier used by the first device to send data packets. By dynamically updating the connection identifier between the first device and the second device, the communication security between the first device and the second device is improved.

[0056] Understandably, when the aforementioned connection identifier update strategy is used to instruct the connection identifier to be updated according to the total number of data packets currently sent by the first device to the second device, the first device can update the first connection identifier to obtain the second connection identifier in the following way: The first device can obtain the number of second packets corresponding to the data packets sent by the first device to the second device within a time period; this time period is from the time when the first device sends the first data packet to the second device to the time when the first device sends the first data packet to the second device, that is, the number of second packets is the total number of data packets currently sent by the first device to the second device. Further, the first device can obtain from the connection identifier update strategy the packet limit number corresponding to the data packets sent by the first device to the second device within a unit update cycle, as well as the shared key between the first device and the second device. Here, the unit update cycle can refer to one update cycle. The connection identifier update strategy specifies that one connection identifier corresponds to one update cycle, and the packet limit number can refer to the maximum number of data packets carrying the same connection identifier sent within one update cycle, that is, the connection identifier needs to be updated every packet limit number. Then, the first device can determine the update cycle of the first connection identifier based on the message limit and the second message quantity, and update the first connection identifier according to the update cycle and the shared key to obtain the second connection identifier associated with the second device. By dynamically updating the connection identifier based on the connection identifier update strategy, the problem of user privacy data leakage caused by using a single connection identifier is avoided, thereby improving the communication security between the first and second devices.

[0057] For example, the number of second packets corresponding to the data packets currently sent by the first device to the second device is Sent_pkt_num, and the limit on the number of packets corresponding to the data packets sent by the first device to the second device within a unit update cycle is 2. Updata_duration Then the update period corresponding to the first connection identifier can be expressed by the following formula (1): Period_id = Sent_pkt_num / / 2 Updata_duration (1) In formula (1), Period_id represents the update period of the first connection identifier, and the operator " / / " represents the division rounding operation.

[0058] Understandably, when the connection identifier update policy is used to instruct the connection identifier to be updated according to the total transmission duration corresponding to the data packets currently sent by the first device to the second device, the first device can update the first connection identifier to obtain the second connection identifier in the following way: the first device obtains the total transmission duration corresponding to the data packets sent by the first device to the second device within a time period; this time period is from the time when the first device sends the first data packet to the second device to the time when the first device sends the first data packet to the second device, that is, the total transmission duration is the transmission duration corresponding to the data packets currently sent by the first device to the second device. Further, the first device can obtain from the connection identifier update policy the transmission limit duration corresponding to the data packets sent by the first device to the second device within a unit update cycle, as well as the shared key between the first device and the second device; the transmission limit duration refers to the maximum transmission duration corresponding to sending data packets carrying the same connection identifier within an update cycle, that is, the connection identifier needs to be updated every transmission limit duration. Then, the first device can determine the update cycle of the first connection identifier based on the transmission limit duration and the total transmission duration. For example, it can perform a division and rounding operation on the total transmission duration and the transmission limit duration to obtain the update cycle of the first connection identifier. Based on the update cycle of the first connection identifier and the shared key, the first connection identifier is updated to obtain the second connection identifier associated with the second device. By dynamically updating the connection identifier based on the connection identifier update strategy, the problem of leakage of user privacy data caused by using a single connection identifier is avoided, thereby improving the communication security between the first device and the second device.

[0059] Understandably, one update cycle corresponds to one connection identifier, and the relationship between the update cycle and the connection identifier is as follows: Figure 4As shown, the initial connection identifier CID_0 corresponds to period 0, and the connection identifier CID_1 corresponds to period 1. Connection identifier CID_1 is obtained by updating the initial connection identifier based on the connection identifier update strategy. The connection identifier CID_2 corresponds to period 2, and is obtained by updating connection identifier CID_1 based on the connection identifier update strategy. The connection identifier CID_3 corresponds to period 3, and is obtained by updating connection identifier CID_2 based on the connection identifier update strategy. Similarly, the connection identifier CID_4 corresponds to period 4, and is obtained by updating connection identifier CID_3 based on the connection identifier update strategy. The connection identifier CID_5 corresponds to period 5, and is obtained by updating connection identifier CID_4 based on the connection identifier update strategy. The number of restricted packets corresponding to each connection identifier specified in the connection identifier update strategy can be the same or different. For example, the number of restricted packets corresponding to each connection identifier can increase, decrease, or change randomly according to certain rules. For example, the message limit for CID_0 is 2, the message limit for CID_1 is 4, and so on. That is, when the first device sends 2 data packets carrying CID_0 to the second device, the first device updates CID_0 according to the connection identifier update policy to obtain CID_1; further, when the first device sends 4 data packets carrying CID_1 to the second device, the first device updates CID_1 according to the connection identifier update policy to obtain CID_2; and so on.

[0060] Understandably, the above-described updating of the first connection identifier based on its update cycle and the shared key to obtain a second connection identifier associated with the sending second device includes: the first device can concatenate the update cycle of the first connection identifier with the first connection identifier to obtain a candidate connection identifier associated with the second device. Here, the update cycle of the first connection identifier is concatenated after the first connection identifier, or concatenated before the first connection identifier. For example, if the update cycle of the first connection identifier is 1 and the first connection identifier is 1234569, then the candidate connection identifier could be 11234569 or 12345691. Furthermore, the first device can use the shared key to encrypt the candidate connection identifier to obtain a second connection identifier associated with the second device.

[0061] Understandably, before the first device sends traffic (data packets) to the second device, if Sent_pkt_num < 2... Updata_duration That is, if Period_id < 1, then CID = CID_0, where CID_0 is the initial connection identifier; if Sent_pkt_num ≥ 2Updata_duration When Period_id≥1, the calculation formula for the connection identifier CID_i is as follows: Formula (2): CID_i = Enc Key (Period_id||CID_(i-1))(2) For example, in formula (2), CID_i represents the second connection identifier, CID_(i-1) represents the first connection identifier, and Enc Key This means that Period_id||CID_(i-1) is encrypted using the shared key Key between the first and second devices. The operator "||" means concatenation, that is, concatenating Period_id and CID_(i-1) into a whole.

[0062] S104. The first device generates a second data packet carrying the second connection identifier and sends the second data packet to the second device. The second data packet is used to instruct the second device to process the second data packet when it determines that the second connection identifier is legitimate based on the connection identifier update policy.

[0063] In this application, the first device can generate a second data packet carrying the second connection identifier and send the second data packet to the second device, so that the second device can verify the legality of the second connection identifier in the second data packet based on the connection identifier update policy, and process the second data packet when it is determined that the second connection identifier is legal. Similarly, the second data packet may also include a packet number, application data, and an offset field.

[0064] Understandably, generating the second data packet carrying the second connection identifier involves: the first device acquiring the application data requested by the second device, and the first packet number corresponding to the application data. This first packet number reflects which packet the application data is sent from the first device to the second device. The first packet number can be generated incrementally for each packet number corresponding to the second connection identifier, i.e., an incrementally increasing packet number is generated for each different connection identifier; for example, the packet numbers for data packets corresponding to different connection identifiers all start from 0. Alternatively, the first packet number can be generated by continuously increasing the packet numbers corresponding to all connection identifiers, such as the packet numbers being 1, 2, 3, 4…, n. Further, the first packet number corresponding to the application data and the second connection identifier are encapsulated in a data packet header, and the application data is encapsulated in a data packet body; based on the data packet header encapsulated with the first packet number and the second connection identifier, and the data packet body encapsulated with the application data, a second data packet carrying the second connection identifier is generated. Adding message numbers to data packets helps the second device detect packet loss issues and improves data integrity.

[0065] Understandably, when the first device generates message numbers in a uniquely incrementing manner for each connection identifier, the process includes: the first device obtaining the number of second messages corresponding to the data packets it sends to the second device within a time period; this time period is from the time the first device sends the first data packet to the second device to the time the first device sends the first data packet to the second device. Then, from the connection identifier update strategy, the message limit number corresponding to the data packets sent by the first device to the second device within a unit update cycle is obtained, and the remainder of the second message number and the message limit number is calculated to obtain the first message number corresponding to the application data. By generating message numbers in a uniquely incrementing manner for each connection identifier, the message number can be recounted for each connection identifier, effectively preventing unauthorized user attacks. For example, it can prevent unauthorized users from inferring the user's application usage time based on consecutive message numbers, which is beneficial for protecting user privacy and building a secure and reliable end-to-end cloud network transmission system.

[0066] For example, during the process of sending data packets from the first device to the second device, a separate incrementing packet number (PKT_NUM) can be generated for each connection identifier (CID). For instance, in the initial connection identifier CID_0, the packet number increments sequentially from 0 to 2. Updata_duration-1 In the first connection identifier CID_1, the message number also increments sequentially from 0 to 2. Updata _duration-1 The message number in each connection identifier (CID) is calculated using the following formula (3): PKT_NUM = Sent_pkt_num % 2 Updata_duration (3) In formula (3), the algorithm "%" represents division and remainder operation, PKT_NUM identifies the message number, and Sent_pkt_num represents the total number of data packets that have been sent to the second device.

[0067] Understandably, when the first device receives the second data packet, it can send an acknowledgment message about the second data packet. If the second device does not receive the second data packet, or if it receives the second data packet but fails to parse it, the second device can send a transmission failure notification message about the second data packet to the first device. This transmission failure notification message indicates that the second data packet was not successfully sent to the second device. The first device can receive the transmission failure notification message about the second data packet sent by the second device. If the second connection identifier does not meet the connection identifier update conditions, the first device can, based on the transmission failure notification message, re-obtain the packet number corresponding to the application data to obtain the second packet number. For example, if the first packet number is 0, the second packet number can be 1. Furthermore, the second message number and the second connection identifier are encapsulated in the data packet header; the application data is encapsulated in the data packet body; based on the data packet header encapsulated with the second message number and the second connection identifier, and the data packet body encapsulated with the application data, a third data packet carrying the second connection identifier is generated; and the third data packet is sent to the second device. In other words, if data packet transmission loss occurs, i.e., the second device does not receive a certain data packet, the first device needs to retransmit the lost data packet; if the second connection identifier does not meet the connection identifier update condition, the retransmitted data packet uses the latest message number (PKT_NUM) for retransmission. This can improve the communication security between the first device and the second device and avoid the leakage of user privacy data.

[0068] Understandably, when the second device does not receive the second data packet, or fails to parse the second data packet after receiving it, the second device can send a transmission failure notification message about the second data packet to the first device. This transmission failure notification message is used to reflect that the second data packet was not successfully sent to the second device. The first device can receive the transmission failure notification message about the second data packet sent by the second device. If the second connection identifier does not meet the connection identifier update condition, the first device can update the second connection identifier according to the connection identifier update strategy to obtain the third connection identifier. Based on the transmission failure notification message, the first device can re-obtain the packet number corresponding to the application data to obtain the third packet number. If the above formula (3) is used, the third packet number is calculated. Further, the third packet number and the third connection identifier are encapsulated in the data packet header; the application data is encapsulated in the data packet body; a fourth data packet carrying the third connection identifier is generated according to the data packet header encapsulated with the third packet number and the third connection identifier, and the data packet body encapsulated with the application data; the fourth data packet is sent to the second device. In other words, if a data packet is lost, meaning the second device does not receive a certain data packet, the first device needs to retransmit the lost data packet. If the second connection identifier meets the connection identifier update condition, the retransmitted data packet uses the latest connection identifier and packet number (PKT_NUM) for retransmission. This can improve the communication security between the first and second devices and prevent the leakage of users' private data.

[0069] Understandably, the first device can release the connection identifier in the first device through any one of the following two methods or a combination of both: Method 1: In this method, the first device can wait until all data packets are acknowledged by the second device before releasing the connection identifier in the first device. Specifically, the first device can store the first connection identifier and the second connection identifier in its identifier set. If it receives message acknowledgment messages corresponding to M data packets respectively, it deletes all connection identifiers in the identifier set. The message acknowledgment message reflects that the corresponding data packet has been successfully sent to the second device. The M data packets are all data packets sent by the first device to the second device, where M is an integer greater than or equal to 2, and the M data packets include the first data packet and the second data packet. By releasing the connection identifier in the first device after all data packets sent by the first device are acknowledged by the second device, the released connection identifier can be reused by other devices, improving the utilization rate of the connection identifier.

[0070] For example, such as Figure 5As shown, before the first device releases the connection identifiers in the identifier set, the identifier set includes n connection identifiers, namely CID_0, CID_1, CID_2, ..., CID_n. After the data packets corresponding to the n connection identifiers are all acknowledged by the second device, the second device can release all connection identifiers in the identifier set, that is, delete all connection identifiers in the identifier set. After releasing the connection identifiers in the identifier set, the identifier set does not contain any connection identifiers.

[0071] Method Two: In this method, the first device waits until all data packets carrying the same connection identifier are acknowledged by the second device before releasing the corresponding connection identifier in the first device. Specifically, the first device can store the first connection identifier and the second connection identifier in its identifier set. If it receives message acknowledgments for K data packets, it deletes the first target connection identifier carried by the K data packets from the identifier set. The message acknowledgment indicates that the corresponding data packet has been successfully sent to the second device. The K data packets are all data packets carrying the first target connection identifier, which includes either the first connection identifier or the second connection identifier, where K is an integer greater than or equal to 1. By releasing the first target connection identifier in the first device only after all data packets carrying the first target connection identifier sent by the first device are acknowledged by the second device, the released connection identifier can be reused by other devices, improving the utilization rate of the connection identifier.

[0072] For example, such as Figure 6 As shown, before the first device releases the connection identifiers in the identifier set, the identifier set includes n connection identifiers, namely CID_0, CID_1, CID_2, ..., CID_n. When the first device receives a message acknowledgment message for a data packet carrying CID_0, the first device can release CID_0 from the identifier set, that is, delete CID_0 from the identifier set. At this time, the identifier set includes n-1 connection identifiers, namely CID_1, CID_2, ..., CID_n. The first device can continue to wait for the second device to acknowledge the data packets carrying other connection identifiers, thereby releasing the other connection identifiers in the identifier set.

[0073] In this application, during communication between the first device and the second device, the first device sends data packets to the second device through a connection identifier. This connection identifier is randomly generated and independent of the second device's IP address. This avoids communication interruptions caused by changes in the second device's IP address, thus improving the reliability of communication between the two devices. Simultaneously, by negotiating a connection identifier update strategy between the first and second devices, the connection identifier used for communication between them is dynamically updated according to this strategy during communication. This effectively prevents unauthorized users from speculating on the user's services or other private information through a single connection identifier, facilitating the construction of secure and reliable cloud service transmission technology and improving the security of communication between the first and second devices.

[0074] Further, please see Figure 7 This is a flowchart illustrating a method for sending data packets provided in an embodiment of this application. Figure 7 As shown, this method can be derived from... Figure 1 It can be executed by any terminal in the terminal cluster, or by... Figure 1 The method of sending the data packet is executed by a server in the application, and the device used in this application to execute the method of sending the data packet can be collectively referred to as the second device. The method may include the following steps: S201, The second device receives a first data packet carrying a first connection identifier sent by the first device.

[0075] In this application, the process of generating the first data packet carrying the first connection identifier can refer to the above step S101. The repeated parts will not be described again. After the first device generates the first data packet carrying the first connection identifier, it can send the first data packet to the second device. The second device can receive the first data packet carrying the first connection identifier sent by the first device.

[0076] S202. If the first connection identifier is valid, the second device processes the first data packet.

[0077] In this application, when the second device receives a first data packet carrying a first connection identifier sent by the first device, the second device can verify the legitimacy of the first connection identifier. If the first connection identifier is legitimate, the second device can process the first data packet.

[0078] Understandably, step S202 includes: the second device can determine the update period corresponding to the first connection identifier according to the connection identifier update policy, and use it as the first update period. For example, the second device can refer to the method in step S103 above to obtain the update period corresponding to the first connection identifier according to the connection identifier update policy, and repeated details will not be repeated. If the first update period is the same as the update period corresponding to the initial connection identifier, and the first connection identifier is the same as the initial connection identifier, then the first connection identifier is determined to be legitimate, and the first data packet is processed. If the first update period is not the same as the update period corresponding to the initial connection identifier, then the connection identifier corresponding to the first update period is searched from the identifier set of the second device, and used as the first reference connection identifier. If the first connection identifier is the same as the first reference identifier, then the first connection identifier is determined to be legitimate, and the first data packet is processed. The identifier set includes multiple connection identifiers, one connection identifier corresponds to one update period, and the identifier set is generated according to the connection identifier update policy and the initial connection identifier. By verifying the legitimacy of the first connection identifier, the security of data packet processing is improved.

[0079] Understandably, the above processing of the first data packet includes: when the second device receives all data packets corresponding to the first connection identifier, obtaining the offset field in all data packets carrying the first connection identifier, where all data packets carrying the first connection identifier include the aforementioned first data packet; concatenating all data packets carrying the first connection identifier according to the field value in the offset field to obtain the concatenated data packet, and sending the concatenated data packet to the application layer for processing.

[0080] S203, the second device receives a second data packet carrying a second connection identifier sent by the first device; the second connection identifier is obtained by updating the first connection identifier based on a connection identifier update strategy when the first connection identifier meets the connection identifier update conditions, and the connection identifier update strategy is determined by the first device and the second device.

[0081] In this application, the process of generating the second data packet carrying the second connection identifier can refer to the above step S104. The repeated parts will not be described again. After the first device generates the second data packet carrying the second connection identifier, it can send the second data packet to the second device. The second device can receive the second data packet carrying the second connection identifier sent by the first device.

[0082] S204. The second device verifies the legality of the second connection identifier according to the connection identifier update policy and obtains the legality verification result.

[0083] Understandably, step S204 above may include: the second device can obtain the update period of the second connection identifier according to the connection identifier update policy, and use it as the second update period. For example, the second device can refer to the method in step S103 above to obtain the update period corresponding to the first connection identifier according to the connection identifier update policy, and increment the update period of the first connection identifier by 1 to obtain the update period of the second connection identifier. Further, the second device can search for the connection identifier corresponding to the second update period from the identifier set of the second device, and use it as the second reference connection identifier; the identifier set includes multiple connection identifiers, one connection identifier corresponds to one update period, and the identifier set is generated according to the connection identifier update policy. If the second connection identifier is different from the second reference identifier, it indicates that the connection identifier carried in the second data packet is different from the connection identifier of the second device, that is, the second data packet is an invalid data packet that the second device does not need, then it is determined that the second connection identifier is not legitimate, and a legitimacy verification result indicating that the second connection identifier is not legitimate is generated. If the second connection identifier is the same as the second reference identifier, it indicates that the connection identifier carried in the second data packet is the same as the local connection identifier of the second device. That is, the second data packet refers to a valid data packet requested by the second device. In this case, the second connection identifier is determined to be legitimate, and a legitimacy verification result indicating the legitimacy of the second connection identifier is generated. By verifying the legitimacy of the connection identifier carried in the second data packet, processing invalid data packets is avoided, saving processing resources of the second device.

[0084] S205. If the validity verification result indicates that the second connection identifier is valid, the second device processes the second data packet.

[0085] In this application, after receiving a second data packet, the second device can perform a validity verification on the second connection identifier carried in the second data packet to obtain a validity verification result. This validity verification result reflects whether the second connection identifier is valid. If the validity verification result indicates that the second connection identifier is invalid, it means that the second data packet is invalid data sent to the second device, and the second device can discard the second data packet. If the validity verification result indicates that the second connection identifier is valid, it means that the second data packet is valid data sent to the second device, and the second device can process the second data packet. By verifying the validity of the connection identifier carried in the data packet, the second device avoids processing invalid data.

[0086] Understandably, step S205 includes: if the validity verification result indicates that the second connection identifier is valid, the second device can obtain the offset fields corresponding to the Q data packets respectively; the Q data packets are all data packets sent from the first device to the second device and carrying the second connection identifier; the Q data packets include the second data packet, and Q is an integer greater than or equal to 1. Further, the second device can concatenate the Q data packets sequentially according to the offset fields corresponding to the Q data packets respectively, for example, concatenating the Q data packets sequentially according to the field values ​​of the offset fields corresponding to the Q data packets from smallest to largest. Further, the second device can send the concatenated Q data packets to the application layer of the second device for processing. In other words, if a connection identifier (CID) passes verification, data packets belonging to the same connection identifier are concatenated together in order and uploaded to the second device for application layer processing. The concatenation is performed sequentially based on the `stream_offset` field in the data packets. By concatenating data packets based on their offset field, ordered processing of data packets is achieved.

[0087] Understandably, the second device can release the connection identifier in the first device through any one or a combination of the following two methods: Method 1: In this method, the second device can wait until all data packets are received before releasing the connection identifier in the second device. Specifically, if M data packets are received, the second device can send message acknowledgments to the first device for each of the M data packets. In particular, the second device can send a message acknowledgment to the first device for each of the M data packets, which indicates that all M data packets sent by the first device have been received. Further, the second device can delete all connection identifiers in the identifier set; wherein, the message acknowledgment reflects that the corresponding data packet has been successfully sent to the second device, and the M data packets are all data packets sent by the first device to the second device, where M is an integer greater than or equal to 2, and the M data packets include the first data packet and the second data packet. After all data packets sent by the first device are received by the second device, the connection identifier in the second device is released. The released connection identifier can be reused by other devices, thereby improving the utilization rate of the connection identifier.

[0088] In method two, the second device waits to receive all data packets carrying the same connection identifier before releasing the corresponding connection identifier. Specifically, if K data packets are received, an acknowledgment message corresponding to each of the K data packets is sent to the first device. In particular, the second device can send an acknowledgment message corresponding to each of the K data packets, indicating that all K data packets sent by the first device have been received. Further, the second device can delete the first target connection identifier carried by the K data packets in the identifier set; where the acknowledgment message reflects that the corresponding data packet has been successfully sent to the second device, the K data packets being all data packets carrying the first target connection identifier, and the first target connection identifier including either the first connection identifier or the second connection identifier, where K is an integer greater than or equal to 1. By releasing the first target connection identifier in the second device after receiving all data packets carrying the first target connection identifier, the released connection identifier can be reused by other devices, improving the utilization rate of the connection identifier.

[0089] Understandably, such as Figure 8 As shown, when the second device receives a data packet, it can send an acknowledgment message to the first device for that data packet. This acknowledgment message indicates that the data packet was successfully sent to the first device. The second device can either immediately send an acknowledgment message for the received data packet upon receipt, or wait for the first device to stop sending data packets before generating acknowledgment messages for all received data packets and sending them to the first device. Sending acknowledgment messages to the first device helps it determine if any data packets have been lost, ensuring the integrity of the data packets.

[0090] In this application, during communication between the first and second devices, the first device sends data packets to the second device using a connection identifier. This connection identifier is randomly generated and independent of the second device's IP address, thus avoiding communication interruptions caused by changes in the second device's IP address and improving the reliability of communication between the two devices. Simultaneously, by negotiating a connection identifier update strategy between the first and second devices, the connection identifier used for communication between them is dynamically updated according to this strategy during communication. This effectively prevents unauthorized users from speculating on the user's services or other private information through a single connection identifier, facilitating the construction of secure and reliable cloud service transmission technology and improving the security of communication between the first and second devices. Furthermore, after receiving a data packet from the first device, the second device verifies the legitimacy of the connection identifier carried in the data packet. Only when the connection identifier in the data packet is legitimate is the data packet processed. This avoids processing invalid data, saves the second device's processing resources, and improves the security of data processing.

[0091] Please see Figure 9 This is a schematic diagram of the structure of a data packet sending device provided in an embodiment of this application. Figure 9 As shown, the device for sending the data message may include: a generation module 911, an acquisition module 912, an update module 913, a determination module 914, and a deletion module 915.

[0092] The generation module 911 is used to generate a first data packet carrying a first connection identifier and send the first data packet to a second device associated with the first connection identifier; the first data packet is used to instruct the second device to process the first data packet when it is determined that the first connection identifier is legitimate. The acquisition module 912 is used to acquire a connection identifier update strategy if the first connection identifier meets the connection identifier update condition; the connection identifier update strategy is determined by the first device and the second device. Update module 913 is used to update the first connection identifier according to the connection identifier update strategy to obtain a second connection identifier associated with the second device; The generation module 911 is further configured to generate a second data packet carrying the second connection identifier and send the second data packet to the second device; the second data packet is used to instruct the second device to process the second data packet when it determines that the second connection identifier is legitimate based on the connection identifier update policy.

[0093] The determining module 914 is used to obtain the number of first packets corresponding to the data packets carrying the first connection identifier sent by the first device to the second device. If the number of first packets is greater than the number of packets, it is determined that the first connection identifier meets the connection identifier update condition; or, it obtains the usage time of the first connection identifier during the process of the first device sending data packets to the second device. If the usage time is greater than the duration threshold, it is determined that the first connection identifier meets the connection identifier update condition.

[0094] Understandably, the connection identifier update strategy is used to indicate the update of the connection identifier according to the total number of data packets currently sent by the first device to the second device; the update module 913 includes: a first acquisition unit 91a, a determination unit 92a and an update unit 93a; The first acquisition unit 91a is used to acquire the number of second packets corresponding to the data packets sent by the first device to the second device within a time period; the time period is from the time when the first device sends the first data packet to the second device to the time when the first device sends the first data packet to the second device; and from the connection identifier update policy, to acquire the packet limit number corresponding to the data packets sent by the first device to the second device within a unit update cycle, and the shared key between the first device and the second device. The determining unit 92a is used to determine the update period of the first connection identifier based on the message limit and the second message quantity; The update unit 93a is used to update the first connection identifier according to the update period of the first connection identifier and the shared key to obtain a second connection identifier associated with the second device.

[0095] It is understood that the connection identifier update policy is used to instruct the connection identifier to be updated according to the total transmission duration corresponding to the data packets currently being sent by the first device to the second device; The first acquisition unit 91a is used to acquire the total transmission duration of the data packets sent by the first device to the second device within a time period; the time period is from the time when the first device sends the first data packet to the second device to the time when the first device sends the first data packet to the second device; and from the connection identifier update policy, to acquire the transmission limit duration of the data packets sent by the first device to the second device within a unit update cycle, and the shared key between the first device and the second device. The determining unit 92a is used to determine the update cycle of the first connection identifier based on the transmission limit duration and the total transmission duration; The update unit 93a is used to update the first connection identifier according to the update period of the first connection identifier and the shared key to obtain a second connection identifier associated with the second device.

[0096] Understandably, the update unit 93a updates the first connection identifier according to the update cycle of the first connection identifier and the shared key to obtain a second connection identifier associated with the second device, including: The update period of the first connection identifier is concatenated with the first connection identifier to obtain a candidate connection identifier associated with the second device; The candidate connection identifier is encrypted using the shared key to obtain a second connection identifier associated with the second device. It is understood that the generation module 911 may include a second acquisition unit 94a, an encapsulation unit 95a, and a generation unit 96a. The second acquisition unit 94a is used to acquire the application data requested by the second device and the first message number corresponding to the application data. Encapsulation unit 95a is used to encapsulate the first message number and the second connection identifier corresponding to the application data into a data packet header; and to encapsulate the application data into a data packet body; The generation unit 96a is configured to generate a second data packet carrying the second connection identifier based on a data packet header encapsulating the first message number and the second connection identifier, and a data packet body encapsulating the application data.

[0097] Understandably, the acquisition module 912 acquires the first message number corresponding to the application data, including: Obtain the number of second packets corresponding to the data packets sent by the first device to the second device within a time period; the time period is from the time when the first device sends the first data packet to the second device to the time when the first device sends the first data packet to the second device; From the connection identifier update strategy, obtain the packet limit number corresponding to the data packets sent by the first device to the second device within a unit update cycle; The first message number corresponding to the application data is obtained by performing a modulo operation between the second message quantity and the message limit quantity.

[0098] The generation module 911 is also configured to receive a transmission failure notification message about the second data packet sent by the second device; If the second connection identifier does not meet the connection identifier update condition, then based on the sending failure notification message, the message number corresponding to the application data is re-acquired to obtain the second message number; The second message number and the second connection identifier are encapsulated in the data packet header; the application data is encapsulated in the data packet body. A third data packet carrying the second connection identifier is generated based on a data packet header encapsulating the second message number and the second connection identifier, and a data packet body encapsulating the application data. The third data packet is sent to the second device.

[0099] The generation module 911 is also configured to receive a transmission failure notification message about the second data packet sent by the second device; If the second connection identifier meets the connection identifier update condition, then the second connection identifier is updated according to the connection identifier update strategy to obtain the third connection identifier; Based on the sending failure notification message, the message number corresponding to the application data is retrieved again to obtain the third message number; The third message number and the third connection identifier are encapsulated in the data packet header; the application data is encapsulated in the data packet body. A fourth data packet carrying the third connection identifier is generated based on a data packet header encapsulating the third message number and the third connection identifier, and a data packet body encapsulating the application data. The fourth data packet is sent to the second device.

[0100] Deletion module 915 is used to store the first connection identifier and the second connection identifier into the identifier set of the first device; If a message acknowledgment is received for each of the M data packets, then all connection identifiers in the identifier set are deleted. The message confirmation message is used to reflect that the corresponding data packet has been successfully sent to the second device. The M data packets are all data packets sent from the first device to the second device, where M is an integer greater than or equal to 2, and the M data packets include the first data packet and the second data packet.

[0101] Deletion module 915 is used to store the first connection identifier and the second connection identifier into the identifier set of the first device; If a message acknowledgment message is received for each of the K data packets, then the first target connection identifier carried by the K data packets is deleted from the identifier set. The message confirmation message is used to reflect that the corresponding data packet has been successfully sent to the second device. The K data packets are all data packets carrying the first target connection identifier. The first target connection identifier includes the first connection identifier or the second connection identifier, and K is an integer greater than or equal to 1.

[0102] The generation module 911 is also configured to receive a data acquisition request for application data sent by the second device; Based on the data acquisition request, obtain the initial connection identifier associated with the second device and the connection identifier update strategy; The initial connection identifier and the connection identifier update strategy are encrypted to obtain encrypted data of the connection identifier. A negotiation message carrying the encrypted data of the connection identifier is generated and the negotiation message is sent to the second device. The negotiation message is used to instruct the second device to verify the legality of the second target connection identifier based on the connection identifier update policy when the initial connection identifier meets the connection identifier update conditions. The second target connection identifier is any connection identifier other than the initial connection identifier carried in the data packet sent by the first device to the second device. The first connection identifier is the initial connection identifier, or the first connection identifier is obtained by updating the initial connection identifier according to the connection identifier update policy.

[0103] In this application, during communication between the first device and the second device, the first device sends data packets to the second device through a connection identifier. This connection identifier is randomly generated and independent of the second device's IP address. This avoids communication interruptions caused by changes in the second device's IP address, thus improving the reliability of communication between the two devices. Simultaneously, by negotiating a connection identifier update strategy between the first and second devices, the connection identifier used for communication between them is dynamically updated according to this strategy during communication. This effectively prevents unauthorized users from speculating on the user's services or other private information through a single connection identifier, facilitating the construction of secure and reliable cloud service transmission technology and improving the security of communication between the first and second devices.

[0104] Please see Figure 10 This is a schematic diagram of the structure of a data packet sending device provided in an embodiment of this application. Figure 10 As shown, the device for sending the data message may include: a receiving module 111, a processing module 112, a verification module 113, and a deletion module 114.

[0105] The receiving module 111 is used to receive a first data packet carrying a first connection identifier sent by the first device; The processing module 112 is used to process the first data packet if the first connection identifier is valid; The receiving module 111 is further configured to receive a second data packet carrying a second connection identifier sent by the first device; the second connection identifier is obtained by updating the first connection identifier based on a connection identifier update strategy when the first connection identifier meets the connection identifier update condition, and the connection identifier update strategy is determined by the first device and the second device. The verification module 113 is used to verify the legality of the second connection identifier according to the connection identifier update strategy, and obtain the legality verification result; The processing module 112 is further configured to process the second data packet if the validity verification result indicates that the second connection identifier is valid.

[0106] It is understood that the processing module 112 includes a first determining unit 11a and a first searching unit 12a; The first determining unit 11a is configured to determine the update period corresponding to the first connection identifier according to the connection identifier update strategy, and use it as the first update period; if the first update period is the same as the update period corresponding to the initial connection identifier, and the first connection identifier is the same as the initial connection identifier, then the first connection identifier is determined to be valid, and the first data packet is processed. The first lookup unit 12a is configured to, if the first update period is not the same as the update period corresponding to the initial connection identifier, search for a connection identifier corresponding to the first update period from the identifier set of the second device as a first reference connection identifier; if the first connection identifier is the same as the first reference identifier, determine that the first connection identifier is valid and process the first data packet; the identifier set includes multiple connection identifiers, one connection identifier corresponds to one update period, and the identifier set is generated according to the connection identifier update strategy and the initial connection identifier.

[0107] It is understood that the verification module 113 includes an acquisition unit 13a, a second search unit 14a, and a second determination unit 15a; The acquisition unit 13a is used to acquire the update period of the second connection identifier according to the connection identifier update strategy, and use it as the second update period; The second lookup unit 14a is used to look up a connection identifier corresponding to the second update cycle from the identifier set of the second device, and use it as a second reference connection identifier; the identifier set includes multiple connection identifiers, one connection identifier corresponds to one update cycle, and the identifier set is generated according to the connection identifier update strategy. The second determining unit 15a is used to determine that the second connection identifier is valid if the second connection identifier is the same as the second reference identifier, and to generate a validity verification result indicating that the second connection identifier is valid.

[0108] The deletion module 114 is used to send a message confirmation message corresponding to each of the M data packets to the first device if M data packets are received; and to delete all connection identifiers in the identifier set; wherein the message confirmation message is used to reflect that the corresponding data packet has been successfully sent to the second device, the M data packets are all data packets sent from the first device to the second device, M is an integer greater than or equal to 2, and the M data packets include the first data packet and the second data packet.

[0109] The deletion module 114 is configured to, if K data packets are received, send a message confirmation message to the first device corresponding to each of the K data packets; and delete the first target connection identifier carried by the K data packets in the identifier set; wherein, the message confirmation message is used to reflect that the corresponding data packet has been successfully sent to the second device, the K data packets are all data packets carrying the first target connection identifier, the first target connection identifier includes the first connection identifier or the second connection identifier, and K is an integer greater than or equal to 1.

[0110] Understandably, if the validity verification result indicates that the second connection identifier is valid, the processing module 112 processes the second data packet, including: If the validity verification result indicates that the second connection identifier is valid, then the offset fields corresponding to the Q data packets are obtained respectively; the Q data packets are all data packets sent from the first device to the second device and carrying the second connection identifier; the Q data packets include the second data packet, and Q is an integer greater than or equal to 1; According to the offset fields corresponding to the Q data packets respectively, the Q data packets are concatenated sequentially to obtain the concatenated Q data packets; The concatenated Q data packets are sent to the application layer of the second device, where the application layer processes the concatenated Q data packets.

[0111] In this application, during communication between the first and second devices, the first device sends data packets to the second device using a connection identifier. This connection identifier is randomly generated and independent of the second device's IP address, thus avoiding communication interruptions caused by changes in the second device's IP address and improving the reliability of communication between the two devices. Simultaneously, by negotiating a connection identifier update strategy between the first and second devices, the connection identifier used for communication between them is dynamically updated according to this strategy during communication. This effectively prevents unauthorized users from speculating on the user's current services or other private information through a single connection identifier, facilitating the construction of secure and reliable cloud service transmission technology and improving the security of communication between the first and second devices. Furthermore, after receiving a data packet from the first device, the second device verifies the legitimacy of the connection identifier carried in the data packet. Only when the connection identifier in the data packet is legitimate is the data packet processed. This avoids processing invalid data, saves the second device's processing resources, and improves the security of data processing.

[0112] Please see Figure 11 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Figure 11 As shown, the computer device 1000 described above can be the first device in the above method, specifically a terminal or server, including: a processor 1001, a network interface 1004, and a memory 1005. Furthermore, the computer device 1000 may also include: a user interface 1003, and at least one communication bus 1002. The communication bus 1002 is used to implement communication between these components. In some embodiments, the user interface 1003 may include a display screen and a keyboard; optionally, the user interface 1003 may also include a standard wired interface or a wireless interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface). The memory 1005 may be a high-speed RAM or a non-volatile memory, such as at least one disk storage device. The memory 1005 may also optionally be at least one storage device located remotely from the aforementioned processor 1001. Figure 11 As shown, the memory 1005, which is a computer-readable storage medium, may include an operating system, a network communication module, a user interface module, and a device-defined application program.

[0113] exist Figure 11In the computer device 1000 shown, the network interface 1004 provides network communication functions; the user interface 1003 is mainly used to provide an input interface; and the processor 1001 can be used to call device-defined application programs stored in the memory 1005 to achieve: A first data packet carrying a first connection identifier is generated, and the first data packet is sent to a second device associated with the first connection identifier; the first data packet is used to instruct the second device to process the first data packet when it is determined that the first connection identifier is legitimate. If the first connection identifier meets the connection identifier update condition, then the connection identifier update strategy is obtained; the connection identifier update strategy is determined by the first device and the second device. According to the connection identifier update strategy, the first connection identifier is updated to obtain a second connection identifier associated with the second device; A second data packet carrying the second connection identifier is generated and sent to the second device; the second data packet is used to instruct the second device to process the second data packet when it determines that the second connection identifier is legitimate based on the connection identifier update policy.

[0114] Understandably, the processor 1001 can be used to call the device-defined application stored in the memory 1005 to: obtain the number of first packets corresponding to the data packets carrying the first connection identifier sent by the first device to the second device; if the number of first packets is greater than the number of packets threshold, then determine that the first connection identifier meets the connection identifier update condition; or, During the process of obtaining the usage duration of the first connection identifier when the first device sends a data packet to the second device, if the usage duration is greater than the duration threshold, then it is determined that the first connection identifier meets the connection identifier update condition.

[0115] Understandably, the connection identifier update strategy is used to instruct the connection identifier to be updated according to the total number of data packets currently sent by the first device to the second device; the processor 1001 can be used to call the device-defined application stored in the memory 1005 to achieve: obtaining the number of second packets corresponding to the data packets sent by the first device to the second device within a time period; the time period is from the time when the first device sends the first data packet to the second device to the time when the first device sends the first data packet to the second device; From the connection identifier update policy, obtain the packet limit number corresponding to the data packets sent by the first device to the second device within a unit update cycle, as well as the shared key between the first device and the second device; The update cycle of the first connection identifier is determined based on the message limit and the second message quantity. The first connection identifier is updated according to the update cycle of the first connection identifier and the shared key to obtain a second connection identifier associated with the second device.

[0116] Understandably, the connection identifier update policy is used to instruct the connection identifier to be updated according to the total transmission duration corresponding to the data packets currently being sent by the first device to the second device; the processor 1001 can be used to call the device-defined application stored in the memory 1005 to achieve: Obtain the total transmission duration of the data packets sent by the first device to the second device within the time period; the time period is from the time when the first device sends the first data packet to the second device to the time when the first device sends the first data packet to the second device. From the connection identifier update policy, obtain the transmission limit duration corresponding to the data packets sent by the first device to the second device within a unit update cycle, as well as the shared key between the first device and the second device; The update cycle of the first connection identifier is determined based on the transmission limit duration and the total transmission duration; The first connection identifier is updated according to the update cycle of the first connection identifier and the shared key to obtain a second connection identifier associated with the second device.

[0117] Understandably, processor 1001 can be used to call device-defined applications stored in memory 1005 to achieve: The update period of the first connection identifier is concatenated with the first connection identifier to obtain a candidate connection identifier associated with the second device; The candidate connection identifier is encrypted using the shared key to obtain a second connection identifier associated with the second device.

[0118] Understandably, processor 1001 can be used to call device-defined applications stored in memory 1005 to achieve: Obtain the application data requested by the second device, and the first message number corresponding to the application data; The first message number and the second connection identifier corresponding to the application data are encapsulated into the data packet header; the application data is encapsulated into the data packet body. A second data packet carrying the second connection identifier is generated based on a data packet header encapsulating the first message number and the second connection identifier, and a data packet body encapsulating the application data.

[0119] Understandably, processor 1001 can be used to call device-defined applications stored in memory 1005 to achieve: Obtain the number of second packets corresponding to the data packets sent by the first device to the second device within a time period; the time period is from the time when the first device sends the first data packet to the second device to the time when the first device sends the first data packet to the second device; From the connection identifier update strategy, obtain the packet limit number corresponding to the data packets sent by the first device to the second device within a unit update cycle; The first message number corresponding to the application data is obtained by performing a modulo operation between the second message quantity and the message limit quantity.

[0120] Understandably, processor 1001 can be used to call device-defined applications stored in memory 1005 to achieve: Receive a notification message from the second device regarding the failure to transmit the second data packet; If the second connection identifier does not meet the connection identifier update condition, then based on the sending failure notification message, the message number corresponding to the application data is re-acquired to obtain the second message number; The second message number and the second connection identifier are encapsulated in the data packet header; the application data is encapsulated in the data packet body. A third data packet carrying the second connection identifier is generated based on a data packet header encapsulating the second message number and the second connection identifier, and a data packet body encapsulating the application data. The third data packet is sent to the second device.

[0121] Understandably, processor 1001 can be used to call device-defined applications stored in memory 1005 to achieve: Receive a notification message from the second device regarding the failure to transmit the second data packet; If the second connection identifier meets the connection identifier update condition, then the second connection identifier is updated according to the connection identifier update strategy to obtain the third connection identifier; Based on the sending failure notification message, the message number corresponding to the application data is retrieved again to obtain the third message number; The third message number and the third connection identifier are encapsulated in the data packet header; the application data is encapsulated in the data packet body. A fourth data packet carrying the third connection identifier is generated based on a data packet header encapsulating the third message number and the third connection identifier, and a data packet body encapsulating the application data. The fourth data packet is sent to the second device.

[0122] Understandably, processor 1001 can be used to call device-defined applications stored in memory 1005 to achieve: Store the first connection identifier and the second connection identifier into the identifier set of the first device; If a message acknowledgment is received for each of the M data packets, then all connection identifiers in the identifier set are deleted. The message confirmation message is used to reflect that the corresponding data packet has been successfully sent to the second device. The M data packets are all data packets sent from the first device to the second device, where M is an integer greater than or equal to 2, and the M data packets include the first data packet and the second data packet.

[0123] Understandably, processor 1001 can be used to call device-defined applications stored in memory 1005 to achieve: Store the first connection identifier and the second connection identifier into the identifier set of the first device; If a message acknowledgment message is received for each of the K data packets, then the first target connection identifier carried by the K data packets is deleted from the identifier set. The message confirmation message is used to reflect that the corresponding data packet has been successfully sent to the second device. The K data packets are all data packets carrying the first target connection identifier. The first target connection identifier includes the first connection identifier or the second connection identifier, and K is an integer greater than or equal to 1.

[0124] Understandably, processor 1001 can be used to call device-defined applications stored in memory 1005 to achieve: Receive a data acquisition request for application data sent by the second device; Based on the data acquisition request, obtain the initial connection identifier associated with the second device and the connection identifier update strategy; The initial connection identifier and the connection identifier update strategy are encrypted to obtain encrypted data of the connection identifier. A negotiation message carrying the encrypted data of the connection identifier is generated and the negotiation message is sent to the second device. The negotiation message is used to instruct the second device to verify the legality of the second target connection identifier based on the connection identifier update policy when the initial connection identifier meets the connection identifier update conditions. The second target connection identifier is any connection identifier other than the initial connection identifier carried in the data packet sent by the first device to the second device. The first connection identifier is the initial connection identifier, or the first connection identifier is obtained by updating the initial connection identifier according to the connection identifier update policy.

[0125] It should be understood that the computer device 1000 described in the embodiments of this application can execute the foregoing text. Figure 3 The description of the data packet sending method in the corresponding embodiment can also be performed as described above. Figure 9 The description of the data packet sending device in the corresponding embodiments will not be repeated here. Furthermore, the beneficial effects of using the same method will also not be repeated.

[0126] In this application, during communication between the first device and the second device, the first device sends data packets to the second device through a connection identifier. This connection identifier is randomly generated and independent of the second device's IP address. This avoids communication interruptions caused by changes in the second device's IP address, thus improving the reliability of communication between the two devices. Simultaneously, by negotiating a connection identifier update strategy between the first and second devices, the connection identifier used for communication between them is dynamically updated according to this strategy during communication. This effectively prevents unauthorized users from speculating on the user's services or other private information through a single connection identifier, facilitating the construction of secure and reliable cloud service transmission technology and improving the security of communication between the first and second devices.

[0127] Please see Figure 12 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Figure 12As shown, the computer device 2000 described above can be the second device in the above method, specifically a terminal or server, including: a processor 2001, a network interface 2004, and a memory 2005. Furthermore, the computer device 2000 may also include: a user interface 2003, and at least one communication bus 2002. The communication bus 2002 is used to implement communication between these components. In some embodiments, the user interface 2003 may include a display screen and a keyboard; optionally, the user interface 2003 may also include a standard wired interface or a wireless interface. The network interface 2004 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface). The memory 2005 may be high-speed RAM or non-volatile memory, such as at least one disk storage device. The memory 2005 may also optionally be at least one storage device located remotely from the aforementioned processor 2001. Figure 12 As shown, the memory 2005, which is a computer-readable storage medium, may include an operating system, a network communication module, a user interface module, and a device-defined application program.

[0128] exist Figure 12 In the computer device 2000 shown, the network interface 2004 provides network communication functions; the user interface 2003 is mainly used to provide an input interface; and the processor 2001 can be used to call device-defined application programs stored in the memory 2005 to achieve: Receive a first data packet carrying a first connection identifier sent by the first device; If the first connection identifier is valid, then the first data packet is processed; The device receives a second data packet carrying a second connection identifier sent by the first device; the second connection identifier is obtained by updating the first connection identifier based on a connection identifier update strategy when the first connection identifier meets the connection identifier update condition, and the connection identifier update strategy is determined by the first device and the second device. The validity of the second connection identifier is verified according to the connection identifier update strategy to obtain the validity verification result; If the validity verification result indicates that the second connection identifier is valid, then the second data packet is processed.

[0129] Understandably, processor 2001 can be used to call device-defined applications stored in memory 2005 to achieve: Based on the connection identifier update strategy, the update period corresponding to the first connection identifier is determined as the first update period; If the first update period is the same as the update period corresponding to the initial connection identifier, and the first connection identifier is the same as the initial connection identifier, then the first connection identifier is determined to be valid, and the first data packet is processed. If the first update period is different from the update period corresponding to the initial connection identifier, then the connection identifier corresponding to the first update period is searched from the identifier set of the second device and used as the first reference connection identifier. If the first connection identifier is the same as the first reference identifier, then the first connection identifier is determined to be valid and the first data packet is processed. The identifier set includes multiple connection identifiers, one connection identifier corresponds to one update period, and the identifier set is generated according to the connection identifier update strategy and the initial connection identifier.

[0130] Understandably, processor 2001 can be used to call device-defined applications stored in memory 2005 to achieve: According to the connection identifier update strategy, the update period of the second connection identifier is obtained and used as the second update period; From the identifier set of the second device, a connection identifier corresponding to the second update cycle is found and used as the second reference connection identifier; the identifier set includes multiple connection identifiers, one connection identifier corresponds to one update cycle, and the identifier set is generated according to the connection identifier update strategy. If the second connection identifier is the same as the second reference identifier, then the second connection identifier is determined to be valid, and a validity verification result indicating that the second connection identifier is valid is generated.

[0131] Understandably, processor 2001 can be used to call device-defined applications stored in memory 2005 to achieve: If M data packets are received, then send a message confirmation message to the first device for each of the M data packets; Delete all connection identifiers in the identifier set; wherein, the message confirmation message is used to reflect that the corresponding data packet has been successfully sent to the second device, the M data packets are all data packets sent from the first device to the second device, M is an integer greater than or equal to 2, and the M data packets include the first data packet and the second data packet.

[0132] Understandably, processor 2001 can be used to call device-defined applications stored in memory 2005 to achieve: If K data packets are received, then send a message confirmation message to the first device corresponding to each of the K data packets; Delete the first destination connection identifier carried by the K data packets in the identifier set; The message confirmation message is used to reflect that the corresponding data packet has been successfully sent to the second device. The K data packets are all data packets carrying the first target connection identifier. The first target connection identifier includes the first connection identifier or the second connection identifier, and K is an integer greater than or equal to 1.

[0133] Understandably, processor 2001 can be used to call device-defined applications stored in memory 2005 to achieve: If the validity verification result indicates that the second connection identifier is valid, then the offset fields corresponding to the Q data packets are obtained respectively; the Q data packets are all data packets sent from the first device to the second device and carrying the second connection identifier; the Q data packets include the second data packet, and Q is an integer greater than or equal to 1; According to the offset fields corresponding to the Q data packets respectively, the Q data packets are concatenated sequentially to obtain the concatenated Q data packets; The concatenated Q data packets are sent to the application layer of the second device, where the application layer processes the concatenated Q data packets.

[0134] In this application, during communication between the first and second devices, the first device sends data packets to the second device using a connection identifier. This connection identifier is randomly generated and independent of the second device's IP address, thus avoiding communication interruptions caused by changes in the second device's IP address and improving the reliability of communication between the two devices. Simultaneously, by negotiating a connection identifier update strategy between the first and second devices, the connection identifier used for communication between them is dynamically updated according to this strategy during communication. This effectively prevents unauthorized users from speculating on the user's current services or other private information through a single connection identifier, facilitating the construction of secure and reliable cloud service transmission technology and improving the security of communication between the first and second devices. Furthermore, after receiving a data packet from the first device, the second device verifies the legitimacy of the connection identifier carried in the data packet. Only when the connection identifier in the data packet is legitimate is the data packet processed. This avoids processing invalid data, saves the second device's processing resources, and improves the security of data processing.

[0135] It should be understood that the computer device 2000 described in the embodiments of this application can execute the foregoing text. Figure 7The description of the data packet sending method in the corresponding embodiment can also be performed as described above. Figure 10 The description of the data packet sending device in the corresponding embodiments will not be repeated here. Furthermore, the beneficial effects of using the same method will also not be repeated.

[0136] Furthermore, it should be noted that this application embodiment also provides a computer-readable storage medium, which stores a computer program executed by the aforementioned data packet transmitting device, and the computer program includes program instructions. When the processor executes the program instructions, it can execute the aforementioned... Figure 7 The description of the data packet transmission method in the corresponding embodiments is already provided and will not be repeated here. Furthermore, the beneficial effects of using the same method will also not be repeated. For technical details not disclosed in the computer-readable storage medium embodiments related to this application, please refer to the description of the method embodiments of this application.

[0137] As an example, the above program instructions can be deployed and executed on a computer device, or deployed and executed on at least two computer devices in one location, or executed on at least two computer devices distributed in at least two locations and interconnected by a communication network. At least two computer devices distributed in at least two locations and interconnected by a communication network can form a blockchain network.

[0138] The aforementioned computer-readable storage medium may be a data packet transmitting device provided in any of the foregoing embodiments or a central storage unit of the aforementioned computer device, such as a hard disk or central storage of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk or a smart memory card (Smart Memory Card) equipped on the computer device. e dia card, SMC), Security Number (S) e Cure digital (SD) cards, flash memory cards, etc. Furthermore, the computer-readable storage medium may include both internal storage units of the computer device and external storage devices. The computer-readable storage medium is used to store the computer program and other programs and data required by the computer device. The computer-readable storage medium can also be used to temporarily store data that has been output or will be output.

[0139] The terms "first," "second," etc., in the specification, claims, and drawings of this application are used to distinguish content in different media, rather than to describe a specific order. Furthermore, the term "comprising," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, apparatus, product, or device that includes a series of steps or units is not limited to the listed steps or modules, but may optionally include steps or modules not listed, or may optionally include other step units inherent to these processes, methods, apparatuses, products, or devices.

[0140] It is understood that if the above embodiments of this application require the use of user information, user permission or consent must be obtained, and relevant laws and regulations of the relevant countries and regions must be complied with.

[0141] This application also provides a computer program product, including a computer program / instructions, which, when executed by a processor, implement the foregoing description. Figure 3 and Figure 7 The descriptions of the data packet sending and decoding methods in the corresponding embodiments are already provided and will not be repeated here. Furthermore, the beneficial effects of using the same methods will also not be repeated. For technical details not disclosed in the embodiments of the computer program product involved in this application, please refer to the description of the method embodiments of this application.

[0142] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0143] The methods and related apparatus provided in this application are described with reference to the method flowcharts and / or structural diagrams provided in this application. Specifically, each block of the method flowchart and / or structural diagram, as well as combinations of blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable network-connected device to create a machine, such that the instructions, which execute via the processor of the computer or other programmable network-connected device, generate instructions for implementing the process. Figure 1 A schematic diagram of one or more processes and / or structures. Figure 1The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable network-connected device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 A schematic diagram of one or more processes and / or structures. Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable network-connected device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable device for implementing the process. Figure 1 A process or multiple processes and / or structures illustrate the steps of the functions specified in one or more boxes.

[0144] The above-disclosed embodiments are merely preferred embodiments of this application and should not be construed as limiting the scope of this application. Therefore, any equivalent variations made in accordance with the claims of this application shall still fall within the scope of this application.

Claims

1. A method for sending data packets, characterized in that, include: The first device generates a first data packet carrying a first connection identifier and sends the first data packet to the second device associated with the first connection identifier; The first data packet is used to instruct the second device to process the first data packet when it determines that the first connection identifier is legitimate; If the first connection identifier meets the connection identifier update condition, then obtain the connection identifier update strategy; The connection identifier update strategy is determined by the first device and the second device; According to the connection identifier update strategy, the first connection identifier is updated to obtain a second connection identifier associated with the second device; A second data packet carrying the second connection identifier is generated and sent to the second device; the second data packet is used to instruct the second device to process the second data packet when it determines that the second connection identifier is legitimate based on the connection identifier update policy; Store the first connection identifier and the second connection identifier into the identifier set of the first device; If a message acknowledgment is received for each of the M data packets, then all connection identifiers in the identifier set are deleted. The message confirmation message is used to reflect that the corresponding data packet has been successfully sent to the second device. The M data packets are all data packets sent from the first device to the second device, where M is an integer greater than or equal to 2, and the M data packets include the first data packet and the second data packet.

2. The method as described in claim 1, characterized in that, The method further includes: The number of first packets corresponding to the data packets carrying the first connection identifier sent by the first device to the second device is obtained. If the number of first packets is greater than the number of packets, it is determined that the first connection identifier meets the connection identifier update condition; or, During the process of obtaining the usage duration of the first connection identifier when the first device sends a data packet to the second device, if the usage duration is greater than the duration threshold, then it is determined that the first connection identifier meets the connection identifier update condition.

3. The method as described in claim 1, characterized in that, The connection identifier update policy is used to instruct the connection identifier to be updated according to the total number of data packets currently sent by the first device to the second device. The step of updating the first connection identifier according to the connection identifier update strategy to obtain a second connection identifier associated with the second device includes: Obtain the number of second packets corresponding to the data packets sent by the first device to the second device within a time period; the time period is from the time when the first device sends the first data packet to the second device to the time when the first device sends the first data packet to the second device; From the connection identifier update policy, obtain the packet limit number corresponding to the data packets sent by the first device to the second device within a unit update cycle, as well as the shared key between the first device and the second device; The update cycle of the first connection identifier is determined based on the message limit and the second message quantity. The first connection identifier is updated according to the update cycle of the first connection identifier and the shared key to obtain a second connection identifier associated with the second device.

4. The method as described in claim 1, characterized in that, The connection identifier update policy is used to instruct the connection identifier to be updated according to the total transmission duration of the data packets currently being sent from the first device to the second device. The step of updating the first connection identifier according to the connection identifier update strategy to obtain a second connection identifier associated with the second device includes: Obtain the total transmission duration of the data packets sent by the first device to the second device within the time period; the time period is from the time when the first device sends the first data packet to the second device to the time when the first device sends the first data packet to the second device. From the connection identifier update policy, obtain the transmission limit duration corresponding to the data packets sent by the first device to the second device within a unit update cycle, as well as the shared key between the first device and the second device; The update cycle of the first connection identifier is determined based on the transmission limit duration and the total transmission duration; The first connection identifier is updated according to the update cycle of the first connection identifier and the shared key to obtain a second connection identifier associated with the second device.

5. The method as described in claim 3 or 4, characterized in that, The step of updating the first connection identifier according to the update cycle of the first connection identifier and the shared key to obtain a second connection identifier associated with the second device includes: The update period of the first connection identifier is concatenated with the first connection identifier to obtain a candidate connection identifier associated with the second device; The candidate connection identifier is encrypted using the shared key to obtain a second connection identifier associated with the second device.

6. The method as described in claim 1, characterized in that, The generation of the second data packet carrying the second connection identifier includes: Obtain the application data requested by the second device, and the first message number corresponding to the application data; The first message number and the second connection identifier corresponding to the application data are encapsulated into the data packet header; the application data is encapsulated into the data packet body. A second data packet carrying the second connection identifier is generated based on a data packet header encapsulating the first message number and the second connection identifier, and a data packet body encapsulating the application data.

7. The method as described in claim 6, characterized in that, The step of obtaining the first message number corresponding to the application data includes: Obtain the number of second packets corresponding to the data packets sent by the first device to the second device within a time period; the time period is from the time when the first device sends the first data packet to the second device to the time when the first device sends the first data packet to the second device; From the connection identifier update strategy, obtain the packet limit number corresponding to the data packets sent by the first device to the second device within a unit update cycle; The first message number corresponding to the application data is obtained by performing a modulo operation between the second message quantity and the message limit quantity.

8. The method as described in claim 6, characterized in that, The method further includes: Receive a notification message from the second device regarding the failure to transmit the second data packet; If the second connection identifier does not meet the connection identifier update condition, then based on the sending failure notification message, the message number corresponding to the application data is re-acquired to obtain the second message number; The second message number and the second connection identifier are encapsulated in the data packet header; the application data is encapsulated in the data packet body. A third data packet carrying the second connection identifier is generated based on a data packet header encapsulating the second message number and the second connection identifier, and a data packet body encapsulating the application data. The third data packet is sent to the second device.

9. The method as described in claim 6, characterized in that, The method further includes: Receive a notification message from the second device regarding the failure to transmit the second data packet; If the second connection identifier meets the connection identifier update condition, then the second connection identifier is updated according to the connection identifier update strategy to obtain the third connection identifier; Based on the sending failure notification message, the message number corresponding to the application data is retrieved again to obtain the third message number; The third message number and the third connection identifier are encapsulated in the data packet header; the application data is encapsulated in the data packet body. A fourth data packet carrying the third connection identifier is generated based on a data packet header encapsulating the third message number and the third connection identifier, and a data packet body encapsulating the application data. The fourth data packet is sent to the second device.

10. The method as described in claim 1, characterized in that, The method further includes: Store the first connection identifier and the second connection identifier into the identifier set of the first device; If a message acknowledgment message is received for each of the K data packets, then the first target connection identifier carried by the K data packets is deleted from the identifier set. The message confirmation message is used to reflect that the corresponding data packet has been successfully sent to the second device. The K data packets are all data packets carrying the first target connection identifier. The first target connection identifier includes the first connection identifier or the second connection identifier, and K is an integer greater than or equal to 1.

11. The method as described in claim 1, characterized in that, The method further includes: Receive a data acquisition request for application data sent by the second device; Based on the data acquisition request, obtain the initial connection identifier associated with the second device and the connection identifier update strategy; The initial connection identifier and the connection identifier update strategy are encrypted to obtain encrypted data of the connection identifier. A negotiation message carrying the encrypted data of the connection identifier is generated and the negotiation message is sent to the second device. The negotiation message is used to instruct the second device to verify the legality of the second target connection identifier based on the connection identifier update policy when the initial connection identifier meets the connection identifier update conditions. The second target connection identifier is any connection identifier other than the initial connection identifier carried in the data packet sent by the first device to the second device. The first connection identifier is the initial connection identifier, or the first connection identifier is obtained by updating the initial connection identifier according to the connection identifier update policy.

12. A method for sending data packets, characterized in that, include: The second device receives a first data packet carrying a first connection identifier sent by the first device; If the first connection identifier is valid, then the first data packet is processed; Receive a second data packet carrying a second connection identifier sent by the first device; The second connection identifier is obtained by updating the first connection identifier based on a connection identifier update strategy when the first connection identifier meets the connection identifier update conditions. The connection identifier update strategy is determined by the first device and the second device. The validity of the second connection identifier is verified according to the connection identifier update strategy to obtain the validity verification result; If the validity verification result indicates that the second connection identifier is valid, then the second data packet is processed; The first device is used to store the first connection identifier and the second connection identifier into the identifier set of the first device; If a message acknowledgment is received for each of the M data packets, then all connection identifiers in the identifier set are deleted; wherein, the message acknowledgment is used to reflect that the corresponding data packet has been successfully sent to the second device, the M data packets are all data packets sent from the first device to the second device, M is an integer greater than or equal to 2, and the M data packets include the first data packet and the second data packet.

13. The method as described in claim 12, characterized in that, If the first connection identifier is valid, then the first data packet is processed, including: Based on the connection identifier update strategy, the update period corresponding to the first connection identifier is determined as the first update period; If the first update period is the same as the update period corresponding to the initial connection identifier, and the first connection identifier is the same as the initial connection identifier, then the first connection identifier is determined to be valid, and the first data packet is processed. If the first update period is different from the update period corresponding to the initial connection identifier, then the connection identifier corresponding to the first update period is searched from the identifier set of the second device and used as the first reference connection identifier. If the first connection identifier is the same as the first reference connection identifier, then the first connection identifier is determined to be valid and the first data packet is processed. The identifier set includes multiple connection identifiers, one connection identifier corresponds to one update period, and the identifier set is generated according to the connection identifier update strategy and the initial connection identifier.

14. The method as described in claim 12, characterized in that, The step of verifying the legality of the second connection identifier according to the connection identifier update strategy and obtaining the legality verification result includes: According to the connection identifier update strategy, the update period of the second connection identifier is obtained and used as the second update period; From the identifier set of the second device, a connection identifier corresponding to the second update cycle is found and used as the second reference connection identifier; the identifier set includes multiple connection identifiers, one connection identifier corresponds to one update cycle, and the identifier set is generated according to the connection identifier update strategy. If the second connection identifier is the same as the second reference connection identifier, then the second connection identifier is determined to be valid, and a validity verification result indicating that the second connection identifier is valid is generated.

15. The method as described in claim 12, characterized in that, If the validity verification result indicates that the second connection identifier is valid, then the second data packet is processed, including: If the validity verification result indicates that the second connection identifier is valid, then the offset fields corresponding to the Q data packets are obtained respectively; the Q data packets are all data packets sent from the first device to the second device and carrying the second connection identifier; the Q data packets include the second data packet, and Q is an integer greater than or equal to 1; According to the offset fields corresponding to the Q data packets respectively, the Q data packets are concatenated sequentially to obtain the concatenated Q data packets; The concatenated Q data packets are sent to the application layer of the second device, where the application layer processes the concatenated Q data packets.

16. A data packet transmitting apparatus, characterized in that, include: The generation module is used to generate a first data packet carrying a first connection identifier and send the first data packet to a second device associated with the first connection identifier; The first data packet is used to instruct the second device to process the first data packet when it determines that the first connection identifier is legitimate; The acquisition module is used to acquire the connection identifier update strategy if the first connection identifier meets the connection identifier update condition; The connection identifier update strategy is determined by the first device and the second device; The update module is used to update the first connection identifier according to the connection identifier update strategy to obtain a second connection identifier associated with the second device; The generation module is further configured to generate a second data packet carrying the second connection identifier and send the second data packet to the second device; the second data packet is used to instruct the second device to process the second data packet when it determines that the second connection identifier is legitimate based on the connection identifier update policy; The deletion module is used to store the first connection identifier and the second connection identifier into the identifier set of the first device; If a message acknowledgment is received for each of the M data packets, then all connection identifiers in the identifier set are deleted; wherein, the message acknowledgment is used to reflect that the corresponding data packet has been successfully sent to the second device, the M data packets are all data packets sent from the first device to the second device, M is an integer greater than or equal to 2, and the M data packets include the first data packet and the second data packet.

17. A data packet transmitting apparatus, characterized in that, include: The receiving module is used to receive a first data packet carrying a first connection identifier sent by the first device; The processing module is configured to process the first data packet if the first connection identifier is valid. The receiving module is further configured to receive a second data packet carrying a second connection identifier sent by the first device; the second connection identifier is obtained by updating the first connection identifier based on a connection identifier update strategy when the first connection identifier meets the connection identifier update condition, and the connection identifier update strategy is determined by the first device and the second device. The verification module is used to verify the legality of the second connection identifier according to the connection identifier update strategy, and obtain the legality verification result; The processing module is further configured to process the second data packet if the legality verification result indicates that the second connection identifier is legal; the first device is configured to store the first connection identifier and the second connection identifier in the identifier set of the first device; If a message acknowledgment is received for each of the M data packets, then all connection identifiers in the identifier set are deleted; wherein, the message acknowledgment is used to reflect that the corresponding data packet has been successfully sent to the second device, the M data packets are all data packets sent from the first device to the second device, M is an integer greater than or equal to 2, and the M data packets include the first data packet and the second data packet.

18. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 15.

19. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 15.

Images