Methods, apparatus, equipment, systems, media, and procedures for establishing connections

Abstract

The application discloses a connection establishment method, device, equipment, system, medium and program product, and relates to the technical field of communication. The method comprises the following steps: acquiring a plurality of IP corresponding to a service domain name to be accessed; sending a connection establishment request and a first data packet to at least one device corresponding to the plurality of IP based on the plurality of IP; in the case that a response message returned by any one of the at least one device based on any one IP of the plurality of IP is received, determining that the connection established based on the any one IP is successful, wherein the response message comprises a connection establishment response for the connection establishment request and an acknowledgement packet for the first data packet; sending a closing message to devices corresponding to the remaining IP except the any one IP of the plurality of IP based on the remaining IP, wherein the closing message is used for closing the connection established based on the remaining IP. The connection failure problem caused by the early closing of the connection establishment based on other IP without truly receiving the response message of any one of the devices is solved, and the connection establishment success rate is improved.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to methods, apparatus, devices, systems, media and program products for establishing connections. Background Technology

[0002] Quick UDP Internet Connections (QUIC), based on the User Datagram Protocol (UDP), is a secure transport protocol that runs on top of UDP and is highly integrated with Transport Layer Security (TLS) 1.3. Hypertext Transfer Protocol version 3 (HTTP / 3) based on QUIC enables the transmission of application data with 0-round trip time (RTT). Here, 0-RTT means that the first message sent by the client to the device includes application data; that is, the number of rounds of communication between the client and the device before sending application data is zero.

[0003] For example, after the client successfully completes the TLS handshake with the device for the first time, both the client and the device can store a pre-shared encryption key locally, called the recovery key. If the client re-establishes a connection with the device, it can directly send application data encrypted with the recovery key to the device when sending a connection request, without having to perform another TLS handshake before sending the application data. This achieves synchronous connection establishment and application data transmission.

[0004] In this 0-RTT scenario, connection establishment can be achieved through concurrent connection establishment using multiple Internet Protocol (IP) protocols. Multi-IP concurrent connection establishment refers to using multiple IP addresses to initiate connection establishment simultaneously, thereby improving the success rate of connection establishment. In related technologies, in a 0-RTT scenario with concurrent multi-IP connection establishment, the client will attempt to establish a connection with device 1 based on IP1 and send 0-RTT application data, and then attempt to establish a connection with device 2 based on IP2 and send 0-RTT application data. Since connection establishment based on IP1 is automatically considered successful in a 0-RTT scenario, connection establishment based on IP2 will be immediately closed. However, in reality, connection establishment based on IP1 may fail due to reasons such as device 1 malfunction. Summary of the Invention

[0005] This application provides a method, apparatus, device, system, medium, and program product for establishing connections, which can improve the connection success rate in 0-RTT scenarios with multiple IP concurrent connection establishment.

[0006] In a first aspect, a method for establishing a connection is provided, the method comprising: obtaining multiple IPs corresponding to a service domain name to be accessed; sending a connection establishment request and a first data packet to at least one device corresponding to the multiple IPs based on the multiple IPs, wherein the first data packet is a data packet in the application data required to access the service domain name; determining that the connection established based on any IP is successful upon receiving a response message returned by any device among the multiple IPs based on any IP among the multiple IPs, wherein the response message includes a connection establishment response to the connection establishment request and an acknowledgment packet for the first data packet; and sending a close message to the device corresponding to the remaining IPs based on the remaining IPs among the multiple IPs, wherein the close message is used to close the connection established based on the remaining IPs.

[0007] This method, for 0-RTT scenarios with concurrent multi-IP connection establishment, only confirms the successful establishment of a connection with any device based on any IP after receiving a response message from any device, and then closes connections established based on the remaining IPs. This differs from the previous method which assumes a connection is successful before receiving a response message from any device after initiating a connection based on any IP, and then closes connections based on other IPs. This solves the connection failure problem caused by prematurely closing connections based on other IPs before receiving a response message from any device, thus improving the connection success rate.

[0008] In one possible implementation, the connection establishment request carries a first identifier, and the first data packet carries a second identifier. The first identifier is used by the device to deduplicate connection establishment requests with the same first identifier, and the second identifier is used by the device to deduplicate first data packets with the same request identifier. By carrying the first identifier and the second identifier respectively, duplicate connection establishment requests and first data packets can be avoided from being processed repeatedly, thus improving the accuracy of processing connection establishment requests and first data packets.

[0009] In one possible implementation, the connection request and the first data packet are encapsulated in a message for transmission. The message also encapsulates a third identifier, which is used by the device to deduplicate received messages with the same third identifier. By including the third identifier in the message package, duplicate messages are avoided from being processed repeatedly, thus improving the accuracy of message processing.

[0010] In one possible implementation, the first data packet is encrypted using a recovery key, which is a shared key determined during the initial handshake with the device corresponding to the service domain name. Encryption enhances the security of the first data packet transmission, and because the recovery key is a shared key determined during the initial handshake with the device corresponding to the service domain name, the accuracy of the encryption and decryption process of the first data packet can be guaranteed.

[0011] In one possible implementation, after confirming that a connection based on any IP address has been successfully established, a second data packet is sent to the device corresponding to that IP address. This second data packet follows the first data packet. Once the connection is successfully established, subsequent data transmission can then proceed through that connection.

[0012] Secondly, a method for establishing a connection is provided, the method comprising: receiving a connection request and a first data packet sent by a client based on any IP address, wherein the first data packet is a data packet in the application data required to access the service domain name; if the connection request and the first data packet are being processed for the first time, returning a response message to the client based on any IP address to determine that the connection established based on any IP address is successful, wherein the response message includes a connection response to the connection request and an acknowledgment packet for the first data packet; or, if the connection request and the first data packet are not being processed for the first time, receiving a close message sent by the client based on any IP address to close the connection established based on any IP address.

[0013] In this method, for 0-RTT scenarios with concurrent multi-IP connection establishment, the connection establishment request and the first data packet are only processed if it is determined to be the first time they are being processed. This avoids duplicate processing of repeatedly sent connection establishment requests and the first data packet, improving the accuracy of processing these data packets.

[0014] In one possible implementation, the connection request carries a first identifier, and the first data packet carries a second identifier. The first identifier is used by the device to deduplicate connection requests with the same first identifier, and the second identifier is used by the device to deduplicate first data packets with the same request identifier. After receiving a connection request and a first data packet from any IP receiving client, the method further includes: if the connection database does not contain the first identifier and does not contain the second identifier, determining that the connection request and the first data packet are being processed for the first time, and the connection database records the identifier of the connection request being processed for the first time and the identifier of the first data packet being processed for the first time; if the connection database contains at least one of the first identifier or the second identifier, determining that the connection request and the first data packet are not being processed for the first time.

[0015] In one possible implementation, after returning a response message to the client based on any IP address, the method further includes: adding a first identifier and a second identifier to the connection establishment database. The connection establishment database records the first identifier of the first connection establishment request and the second identifier of the first data packet processed initially. Therefore, by checking whether the connection establishment database contains the first and second identifiers, it can be accurately determined whether the received connection establishment request and the first data packet are being processed for the first time.

[0016] In one possible implementation, the connection request and the first data packet are encapsulated in a message for transmission. The message also encapsulates a third identifier, which is used by the device to deduplicatize received messages with the same third identifier. After receiving the connection request and the first data packet from any IP receiving client, the method further includes: if the connection database does not contain the third identifier, determining that the connection request and the first data packet are being processed for the first time, and the connection database records the identifier of the message being processed for the first time; if the connection database contains the third identifier, determining that the connection request and the first data packet are not being processed for the first time.

[0017] In one possible implementation, after returning a response message to the client based on any IP address, the method further includes: adding a third identifier to the connection database. The connection database records the third identifier of the first processed message, and by checking whether the connection database contains the third identifier, it can be accurately determined whether the received message is the first processed message.

[0018] In one possible implementation, the first data packet is encrypted using a recovery key, which is a shared key determined during the initial handshake with the client; the first data packet is also decrypted using the recovery key before returning a response message to the client based on any IP address.

[0019] Thirdly, a connection-establishing device is provided, which includes a transceiver module and a processing module.

[0020] The transceiver module is used to perform receiving and / or sending related operations performed in the first aspect or any possible implementation of the first aspect; the processing module is used to perform other operations besides receiving and / or sending related operations in the first aspect or any possible implementation of the first aspect.

[0021] Alternatively, the transceiver module is used to perform the receiving and / or sending related operations performed in the second aspect or any possible implementation of the second aspect; the processing module is used to perform other operations besides the receiving and / or sending related operations in the second aspect or any possible implementation of the second aspect.

[0022] In one possible implementation, the transceiver module includes a receiving module and / or a sending module. The receiving module is used to perform receiving-related operations, and the sending module is used to perform sending-related operations.

[0023] The transceiver module is used to perform receiving and / or sending related operations as performed in the first aspect or any possible implementation of the first aspect; the processing module is used to perform other operations besides receiving and / or sending related operations in the first aspect or any possible implementation of the first aspect. The processing module is used to obtain multiple IPs corresponding to the service domain name to be accessed; the transceiver module is used to send connection establishment requests and first data packets to at least one device corresponding to each of the multiple IPs, the first data packet being a data packet from the application data required to access the service domain name; the processing module is used to determine that a connection established based on any IP is successful upon receiving a response message returned by any device among the at least one device based on any IP among the multiple IPs, the response message including a connection establishment response to the connection establishment request and an acknowledgment packet for the first data packet; the transceiver module is used to send close messages to the devices corresponding to the remaining IPs among the multiple IPs, the close messages being used to close the connections established based on the remaining IPs.

[0024] In one possible implementation, the connection request carries a first identifier, and the first data packet carries a second identifier. The first identifier is used by the device to deduplicate connection requests with the same first identifier, and the second identifier is used by the device to deduplicate first data packets with the same request identifier.

[0025] In one possible implementation, the connection request and the first data packet are encapsulated in a message for transmission. The message also encapsulates a third identifier, which is used by the device to deduplicat messages with the same third identifier.

[0026] In one possible implementation, the first data packet is encrypted using a recovery key, which is a shared key determined during the first handshake between the device corresponding to the service domain name.

[0027] In one possible implementation, the transceiver module is further configured to send a second data packet to the device corresponding to any IP address based on any IP address, wherein the second data packet is a data packet following the first data packet.

[0028] The transceiver module is used to perform the receiving and / or sending related operations performed in the second aspect or any possible implementation of the second aspect; the processing module is used to perform other operations besides the receiving and / or sending related operations in the second aspect or any possible implementation of the second aspect. The transceiver module is used to receive a connection establishment request and a first data packet sent by a client based on any IP address, the first data packet being a data packet in the application data required to access the service domain name; if the connection establishment request and the first data packet are being processed for the first time, it returns a response message to the client based on any IP address, confirming that the connection established based on any IP address is successful; the response message includes a connection establishment response to the connection establishment request and an acknowledgment packet for the first data packet; or, if the connection establishment request and the first data packet are not being processed for the first time, it receives a close message sent by the client based on any IP address to close the connection established based on any IP address.

[0029] In one possible implementation, the connection request carries a first identifier, and the first data packet carries a second identifier. The first identifier is used by the device to deduplicate connection requests with the same first identifier, and the second identifier is used by the device to deduplicate first data packets with the same request identifier. The processing module is configured to determine that the connection request and the first data packet are being processed for the first time if the connection database does not contain either the first identifier or the second identifier, wherein the connection database records the identifier of the first-time processed connection request and the identifier of the first-time processed first data packet; and to determine that the connection request and the first data packet are not being processed for the first time if the connection database contains at least one of the first identifier or the second identifier.

[0030] In one possible implementation, the processing module is also used to add a first identifier and a second identifier to the connection database.

[0031] In one possible implementation, the connection request and the first data packet are encapsulated in a message for transmission. The message also encapsulates a third identifier, which is used by the device to deduplicat messages with the same third identifier. The processing module is used to determine that the connection request and the first data packet are being processed for the first time if the connection database does not contain the third identifier, and the connection database records the identifier of the message being processed for the first time. If the connection database contains the third identifier, it is determined that the connection request and the first data packet are not being processed for the first time.

[0032] In one possible implementation, the processing module is also used to add a third identifier to the connection database.

[0033] In one possible implementation, the first data packet is encrypted using a recovery key, which is a shared key determined during the first handshake with the client; the processing module is also used to decrypt the first data packet based on the recovery key.

[0034] Fourthly, a network device is provided, comprising: a processor coupled to a memory storing at least one program instruction or code, the at least one program instruction or code being loaded and executed by the processor to enable the network device to implement the connection establishment method as described in either the first or second aspect above.

[0035] Optionally, the processor may be one or more, and the memory may be one or more.

[0036] Optionally, the memory may be integrated with the processor, or the memory may be separated from the processor.

[0037] In the specific implementation process, the memory can be a non-transitory memory, such as read-only memory (ROM), which can be integrated with the processor on the same chip or set on different chips. This application does not limit the type of memory or the way the memory and processor are set.

[0038] Fifthly, a communication device is provided, comprising: a transceiver, a memory, and a processor. The transceiver, the memory, and the processor communicate with each other via an internal connection path. The memory stores instructions, and the processor executes the instructions stored in the memory to control the transceiver to receive signals and transmit signals. When the processor executes the instructions stored in the memory, the communication device performs the method of the first aspect or any possible implementation of the first aspect, or performs the method of the second aspect or any possible implementation of the second aspect.

[0039] In a sixth aspect, a system for establishing a connection is provided, the system comprising a client and at least one device;

[0040] The client is used to execute the method in the first aspect or any possible implementation of the first aspect, and any of the at least one device is used to execute the method in the second aspect or any possible implementation of the second aspect.

[0041] In a seventh aspect, a computer-readable storage medium is provided, the storage medium storing at least one instruction, the instruction being loaded and executed by a processor to cause a computer to implement the method of the first aspect or any possible implementation of the first aspect, or to implement the method of the second aspect or any possible implementation of the second aspect.

[0042] Eighthly, a computer program (product) is provided, the computer program (product) comprising: computer program code, which, when executed by a computer, causes the computer to perform the methods described in the preceding aspects.

[0043] In a ninth aspect, a chip is provided, including a processor for retrieving and executing instructions stored in a memory, causing a communication device on which the chip is mounted to perform the methods of the foregoing aspects.

[0044] In a tenth aspect, another chip is provided, comprising: an input interface, an output interface, a processor, and a memory, wherein the input interface, the output interface, the processor, and the memory are connected via an internal connection path, and the processor is used to execute code in the memory, wherein when the code is executed, the processor is used to perform the methods in the foregoing aspects.

[0045] It should be understood that the beneficial effects of the technical solutions of the second to tenth aspects of this application and the corresponding possible implementations can be referred to the above-described technical effects of the first aspect and its corresponding possible implementations, and will not be repeated here. Attached Figure Description

[0046] Figure 1 This is a schematic diagram of a 0-RTT connection establishment process provided in related technologies;

[0047] Figure 2 This is a schematic diagram of another 0-RTT connection establishment process provided in related technologies;

[0048] Figure 3 A schematic diagram illustrating the implementation environment of a method for establishing a connection, as provided in an embodiment of this application;

[0049] Figure 4 A flowchart illustrating a method for establishing a connection, as provided in an embodiment of this application;

[0050] Figure 5 A flowchart illustrating another method for establishing a connection provided in an embodiment of this application;

[0051] Figure 6 This application provides a schematic diagram of a connection establishment process.

[0052] Figure 7 This is a schematic diagram illustrating another connection establishment process provided in an embodiment of this application;

[0053] Figure 8 This is a schematic diagram of a connection establishment device provided in an embodiment of this application;

[0054] Figure 9This application provides a schematic diagram of the structure of a network device according to an embodiment of the present application.

[0055] Figure 10 This is a schematic diagram of the structure of another network device provided in an embodiment of this application;

[0056] Figure 11 This is a schematic diagram of the structure of a server provided in an embodiment of this application. Detailed Implementation

[0057] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0058] In communication technologies based on QUIC, because QUIC and TLS 1.3 are highly integrated, QUIC can use previously completed TLS handshake session information to perform TLS-encrypted transmission of application data through TLS session recovery. Combined with QUIC's connection establishment mechanism, synchronous transmission of application data and QUIC connection establishment can be achieved. In other words, the first HTTP / 3 request based on QUIC can achieve true 0-RTT application data transmission. For a detailed introduction to QUIC, please refer to Request for Comments (RFC) 9000; for a detailed introduction to TLS 1.3, please refer to RFC 8446. This application's embodiments will not elaborate further.

[0059] In this embodiment, 0-RTT refers to establishing a fast TLS 1.3 encrypted connection through session resumption, allowing data packet transmission and reception to begin at the start of the first RTT. 1-RTT refers to establishing a complete TLS 1.3 encrypted connection through a full handshake, with data packet transmission and reception only beginning at the start of the second RTT. The differences between the 1-RTT and 0-RTT request processes are illustrated using the example of a client establishing a connection and sending data to a device.

[0060] In a 1-RTT request process, the client first sends a connection request to the device, and the device sends a connection response to the client. After receiving the connection response, the client sends data to the device, and the device then sends a data confirmation response to the client. In a 0-RTT request process, the client directly sends a connection request and application data to the device, and the device also directly sends a connection response and a data confirmation response to the client. Here, the client refers to the program that provides local services to the client and is the party that actively initiates the connection. Optionally, the client can be a program running on a smartphone, personal computer, set-top box, or any other device that supports the IP network protocol.

[0061] In scenarios involving concurrent connection establishment using multiple IP addresses, a client can initiate connection establishment simultaneously using multiple IP addresses to improve the success rate. Taking the Happy Eyeballs algorithm as an example, the client simultaneously attempts to establish both an IPv4 (Internet Protocol version 4) connection and an IPv6 (Internet Protocol version 6) connection. If the IPv4 connection is established successfully first, the client immediately uses that IPv4 connection. If the IPv6 connection is established successfully within a certain timeframe (typically several hundred milliseconds), the client switches to the IPv6 connection, achieving a smooth transition from IPv4 to IPv6. Happy Eyeballs is an algorithm applied to dual-stack network environments; see RFC 6555 or RFC 8305 for a detailed description of the Happy Eyeballs algorithm.

[0062] For example, consider a client simultaneously establishing connections using both IP1 and IP2. See [link to example]. Figure 1 or Figure 2 The diagram illustrates the 0-RTT connection establishment process in related technologies. During the 0th RTT, the client simultaneously sends initial and 0-RTT data to both device 1 (IP1) and device 2 (IP2), notifying the application layer that the connection has been successfully established. If the connection based on IP1 is established first, the connection based on IP2 will be directly closed, meaning IP2 will not have a chance to establish a connection. Here, "initial" refers to the connection establishment message in the QUIC protocol, and it is also the first message sent by the client in the QUIC connection process. "Data" refers to the application data packets exchanged between the client and the device in the QUIC protocol; that is, "data" is not a control message.

[0063] Assuming both the communication network and device 1 are functioning normally, Figure 1 As shown, after receiving the initial and 0-RTT data packets, device 1 returns a handshake packet corresponding to the initial packet and an acknowledgment (ack) packet corresponding to the 0-RTT data packet to the client. Subsequently, the client uses device 1 corresponding to IP1 for subsequent data transmission and reception. For example, the client sends 1-RTT data to device 1 corresponding to IP1. Here, the handshake refers to the message in the QUIC protocol that transmits certificate or connection parameters between the client and device; the ack packet is a control message in the QUIC protocol that the client or device replies to the other party, acknowledging that the other party has received the data.

[0064] However, as Figure 2As shown, if IP1 fails—for example, if device 1 fails, or if the network connecting the client to device 1 fails—device 1 will not receive initial and 0-RTT data. Therefore, the connection based on IP1 will be closed, meaning the connection based on IP1 fails. Since the connection based on IP2 has already been closed, the client's overall connection attempt ultimately fails. In other words, the connection success rate is low in 0-RTT scenarios with multiple concurrent IP connections.

[0065] This application provides a method for establishing a connection, which can improve the connection success rate in 0-RTT scenarios with multiple IPs concurrently establishing connections. See also Figure 3 , Figure 3 This is a schematic diagram illustrating an implementation environment for a connection establishment method provided in this application. The implementation environment includes a client and devices. The client connects to multiple devices via wired or wireless means based on different IP addresses. Figure 3 The network path between the client and any device is simplified using IP1, IP2, and IP3. Optionally, different IPs may correspond to the same device; for example, IP1 and IP4 both correspond to device 1. Here, the client is the initiator of the connection request, and the device is the party responding to the client's connection request. Optionally, this implementation environment also includes a database, which is connected to multiple devices via wired or wireless means. The database is used to store connection request records from each device.

[0066] The device mentioned in the embodiments of this application refers to a device that interacts with a client to provide computing services. Optionally, the device may be a network device such as a switch or router, or a server, or a component of a network device or server, such as a single board or line card on a network device or server, or a functional module on a network device or server, or a chip used to implement the method of this application. The embodiments of this application do not impose specific limitations. When the device is a chip, the transceiver module used to implement the method may be, for example, the chip's interface circuit, and the processing module may be a processing circuit with processing functions within the chip. Connection methods between devices include, but are not limited to, direct connection via Ethernet cable or optical fiber.

[0067] For example, see the documentation for executing this method on a client side. Figure 4 , Figure 4 A flowchart illustrating a method for establishing a connection as provided in an embodiment of this application. This method can be applied to... Figure 3 In the implementation environment shown, for example, the client is Figure 3 The client shown. (As shown in the image) Figure 4 As shown, the method for establishing a connection includes the following steps 401-404.

[0068] Step 401: Obtain multiple IPs corresponding to the service domain name to be accessed.

[0069] In this embodiment, a domain name is the name of a computer or group of computers on the Internet, consisting of a string of names separated by dots, used to locate the device during data transmission. Compared to IP addresses, domain names can display information such as the name and nature of the address organization, making them easier to remember. Mapping domain names to IP addresses makes it easier for users to access the Internet without having to remember the numerical strings of IP addresses that can be directly read by machines. For example, the Domain Name System (DNS) includes a mapping between domain names and IP addresses for converting between them; DNS is also called a domain name server.

[0070] In one possible implementation, multiple IP addresses corresponding to the service domain name to be accessed are obtained through DNS resolution. Each IP address corresponds to one device; for example, as shown in Figure 3, IP1 corresponds to device 1, and IP2 corresponds to device 2. Optionally, different IP addresses can correspond to the same device; for example, IP1 and IP4 correspond to device 1, and IP2 corresponds to device 2. This application does not limit the number or type of the multiple IP addresses. Exemplarily, the multiple IP addresses may be any number of two or more IP addresses, and the type of the multiple IP addresses may be any one or both of IPv4 and IPv6.

[0071] Step 402: Based on multiple IPs, send connection establishment requests and first data packets to at least one device corresponding to each IP. The first data packet is a data packet in the application data required to access the service domain name.

[0072] In this embodiment, after obtaining multiple IPs corresponding to the service domain name to be accessed, a connection request and a first data packet are sent to each device corresponding to each IP. That is, the number of times the client sends connection requests and the first data packet equals the number of IPs. For example, if the multiple IPs include IP1 and IP2, where IP1 corresponds to device 1 and IP2 corresponds to device 2, then a connection request and a first data packet are sent to device 1 based on IP1, and a connection request and a first data packet are sent to device 2 based on IP2. As another example, if the multiple IPs include IP1 and IP2, where IP1 corresponds to device 1 and IP2 also corresponds to device 1, then a connection request and a first data packet are sent to device 1 once based on IP1, and a second connection request and a first data packet are sent to device 1 again based on IP2.

[0073] The connection establishment request is used by the client to establish a connection with any device corresponding to any IP address. This connection is used to transmit application data required for accessing the service domain name. The application data required for accessing the service domain name includes multiple data packets arranged sequentially, with the first data packet being the first data packet among these multiple data packets. Since the first data packet is the first round of data packets sent by the client, it can also be called a 0-RTT data packet. Optionally, the connection establishment request and the first data packet can be sent separately and simultaneously, or they can be encapsulated in a single message and sent.

[0074] When the connection establishment request and the first data packet can be sent separately and simultaneously, the connection establishment request carries a first identifier, and the first data packet carries a second identifier. The first identifier is used by the device to deduplicate connection establishment requests with the same first identifier, and the second identifier is used by the device to deduplicate first data packets with the same request identifier. Therefore, by carrying the first identifier and the second identifier separately, duplicate connection establishment requests and the first data packet can be avoided from being processed repeatedly, improving the accuracy of processing connection establishment requests and the first data packet.

[0075] When the connection request and the first data packet are encapsulated in a single message, a third identifier is also encapsulated within the message. This third identifier is used by the device to deduplicate received messages with the same third identifier. Therefore, by including the third identifier in the packet, duplicate messages are avoided from being processed repeatedly, thus improving the accuracy of message processing.

[0076] This application does not limit the setting of the first and second identifiers. The first identifier only needs to be able to distinguish different connection request interfaces, and the second identifier only needs to be able to distinguish different first data packets. Similarly, this application does not limit the setting of the third identifier. The third identifier only needs to be able to distinguish different messages. For example, the first, second, or third identifier can be a string or number that will not or has a very low probability of being repeated in a short period of time. Short period of time can refer to a time period less than or equal to a time period threshold, which can be flexibly adjusted according to the application scenario. For example, if the time period threshold is 1 minute, then short period of time can refer to 1 minute.

[0077] In one possible implementation, the first data packet is encrypted using a recovery key, which is a shared key determined during the initial handshake with the device corresponding to the service domain name. That is, the client has already accessed the service domain name before this access and obtained the shared key determined during the initial handshake with the device corresponding to the service domain name. Therefore, encryption improves the security of the first data packet transmission, and because the recovery key is a shared key determined during the initial handshake with the device corresponding to the service domain name, the accuracy of the encryption and decryption process of the first data packet can be guaranteed.

[0078] Step 403: If a response message is received from any of the at least one device based on any of the multiple IPs, it is determined that the connection established based on any IP is successful. The response message includes a connection establishment response to the connection establishment request and an acknowledgment packet for the first data packet.

[0079] In this implementation, the connection request can be "initial," and the response to that request can be "handshake." The first data packet can be a 0-RTT packet, and the acknowledgment packet for that packet can be "ack." In one possible implementation, after confirming a successful connection establishment based on any IP address, a second data packet is sent to the device corresponding to that IP address. This second data packet follows the first packet and contains the subsequent application data required to access the service domain name. For example, the first data packet might be a 0-RTT packet, and the second packet a 1-RTT packet. In other words, after a successful connection establishment, subsequent data transmission can proceed through that connection.

[0080] Step 404: Send a close message to the device corresponding to each of the remaining IPs (excluding any one of the IPs) based on the remaining IPs. The close message is used to close the connection established based on the remaining IPs.

[0081] Once a connection is successfully established between any IP address and any device, other concurrent connection establishment tasks can be closed. For example, if multiple IP addresses include IP1, IP2, and IP3, and a response message is received based on IP1, then the remaining IP addresses are IP2 and IP3. A close message is then sent from IP2 to the device corresponding to IP2 to close the connection established based on IP2; similarly, a close message is sent from IP3 to the device corresponding to IP3 to close the connection established based on IP3.

[0082] exist Figure 4 The method shown addresses 0-RTT scenarios with concurrent multi-IP connection establishment. It only confirms successful connection establishment with any device based on any IP after receiving a response message from any device, and then closes other connection establishment tasks. This differs from the approach of automatically assuming connection success before receiving a response message from any device after initiating a connection based on any IP, and then closing connections based on other IPs. This solves the connection failure problem caused by prematurely closing connections based on other IPs before receiving a response message from any device, thus improving the connection success rate.

[0083] For example, to perform the method on any of the at least one devices, see [link to relevant documentation]. Figure 5 , Figure 5 A flowchart illustrating a method for establishing a connection as provided in an embodiment of this application. This method can be applied to... Figure 3 In the implementation environment shown, for example, any device is Figure 3 Any one of the devices shown, namely device 1, device 2, and device 3. Figure 5 As shown, the method for establishing a connection includes the following steps 501 and 502.

[0084] Step 501: Receive a connection request and a first data packet sent by any IP address from the client. The first data packet is a data packet from the application data required to access the service domain name.

[0085] The connection request is used to establish a connection between any device and the client based on any IP address. This connection is used to transmit application data required for accessing the service domain name. In this embodiment, for multiple connection requests and first data packets sent concurrently by the client, at least one device will process only one connection request and first data packet at a time. The next connection request and first data packet will only be processed after the processing of that connection request and first data packet is completed.

[0086] Optionally, for any service domain name, if any device begins processing a connection request for that service domain name, it will lock the processing thread for that service domain name to prevent other concurrent connection requests other than the one currently being processed from being processed. If any device completes processing a connection request for that service domain name, it will unlock the processing thread for that service domain name to allow any concurrent connection requests other than the one currently being processed to be processed.

[0087] Taking IP1 as an example, when any device corresponds to both IP1 and IP2, that device will receive a connection request and the first data packet from the client once based on IP1, and then receive the same request and data packet again based on IP2. If any device receives the connection request and data packet from the client first based on IP1, it will begin processing the request and packet received based on IP1 and lock the processing thread for that service domain name. This ensures that when the device receives the connection request and data packet from the client again based on IP2, processing will be paused because the processing thread for that service domain name is locked.

[0088] In one possible implementation, the first data packet is encrypted using a recovery key, which is a shared key determined during the initial handshake with the client. Therefore, the first data packet is decrypted using the recovery key before either device processes it, i.e., before returning a response message to the client based on either IP address.

[0089] Step 502: If the connection request and the first data packet are being processed for the first time, return a response message to the client based on any IP address to confirm that the connection established based on any IP address is successful. The response message includes a connection response to the connection request and an acknowledgment packet for the first data packet. Alternatively, if the connection request and the first data packet are not being processed for the first time, receive a close message sent by the client based on any IP address to close the connection established based on any IP address.

[0090] In this embodiment, the processing method for the received connection request and the first data packet is as follows: First, it is determined whether the received connection request and the first data packet are being processed for the first time. If it is the first time, a response message is returned to the client based on any IP address. If it is not the first time, no response message is returned to the client based on any IP address. If no response message is returned to the client based on any IP address, a close message sent by the client based on any IP address will be received. The connection established based on any IP address will be closed according to the close message, for example, by discarding the connection request and the first data packet received based on any IP address.

[0091] This application does not limit the method used to determine whether the received connection request and the first data packet are being processed for the first time. For example, at least one device is connected to a connection database, which records the identifiers of connection requests and the first data packet that have been processed for the first time. Then, by checking whether the connection database includes the identifiers carried in the received connection request and the first data packet, it is determined whether the received connection request and the first data packet are being processed for the first time.

[0092] If the connection request carries a first identifier and the first data packet carries a second identifier, the connection database records the identifier of the first connection request processed and the identifier of the first data packet processed. The method for determining whether the received connection request and the first data packet are processed for the first time is as follows: if the connection database does not contain either the first or second identifier, it is determined that the connection request and the first data packet are processed for the first time; if the connection database contains at least one of the first or second identifier, it is determined that the connection request and the first data packet are not processed for the first time.

[0093] In this scenario, after returning a response message to the client based on any IP address, a first identifier and a second identifier are added to the connection establishment database. The connection establishment database records the first identifier of the first processed connection request and the second identifier of the first data packet. Therefore, by checking whether the connection establishment database contains the first and second identifiers, it can be accurately determined whether the received connection request and the first data packet are being processed for the first time.

[0094] When the connection request and the first data packet are encapsulated in a message and transmitted, and the message also encapsulates a third identifier, the connection database records the identifier of the first processed message. The method for determining whether the received connection request and the first data packet are processed for the first time is as follows: if the connection database does not contain the third identifier, it is determined that the connection request and the first data packet are processed for the first time; if the connection database contains the third identifier, it is determined that the connection request and the first data packet are not processed for the first time.

[0095] In this scenario, after returning a response message to the client based on any IP address, the process also includes adding a third identifier to the connection database. The connection database records the third identifier of the first processed message, and by checking whether the database contains this third identifier, it can be accurately determined whether the received message is the first processed message.

[0096] exist Figure 5 In the method shown, for 0-RTT scenarios with concurrent multi-IP connection establishment, the connection request and the first data packet are processed only if it is determined that they are being processed for the first time. This avoids duplicate processing of repeatedly sent connection requests and the first data packet, improving the accuracy of connection request and first data packet processing.

[0097] Taking multiple IPs, including IP1 and IP2, where IP1 corresponds to device 1 and IP2 corresponds to device 2, as an example, the connection establishment method provided in this application embodiment will be illustrated. See also Figure 6 Under normal network conditions between the client and device 1 and device 2, the connection establishment process includes, but is not limited to, the following steps 61-66.

[0098] Step 61: The client obtains the two IP addresses corresponding to the current device domain name through DNS resolution, denoted as IP1 and IP2. The client sends initial and 0-RTT data to device 1 via IP1, and simultaneously sends the same initial and 0-RTT data to device 2 via IP2. The initial or 0-RTT data sent via IP1 and the initial or 0-RTT data sent via IP2 carry the same unique request identifier.

[0099] Step 62: After receiving the initial and 0-RTT data sent by the client, device 1 queries the database based on the unique request identifier carried in the initial or 0-RTT data to determine whether the current request has been processed. Since there is no record for this unique request identifier in the database, step 63 is executed.

[0100] Step 63: Device 1 determines that this is the first time it will process the request, and will process it as a normal response, that is, return a handshake and ack packet to the client, and record the current unique request identifier in the database.

[0101] Step 64: After receiving the initial and 0-RTT data sent by the client, device 2 queries the database based on the unique request identifier carried in the initial or 0-RTT data. Since a record with this unique request identifier already exists in the database, step 65 is executed.

[0102] In step 65, device 2 determines that the current request has been processed and ignores the initial and 0-RTT data, that is, it does not return handshake and ack packets to the client.

[0103] In step 66, the client receives the handshake and ack packets returned by device 1, confirming the successful connection establishment of IP1. The client then sends a close message to device 2 to close the IP2 connection. In the 0-RTT scenario, multiple concurrent IP connection establishments have concluded, and the connection and data transmission / reception were successfully established through IP1.

[0104] exist Figure 6 In scenarios where devices corresponding to multiple IPs can receive client requests normally, the client adds a unique request identifier in the initial or 0-RTT data for request deduplication. This allows the device to perform deduplication based on the unique request identifier, preventing the same request from being processed multiple times and thus avoiding other problems caused by duplicate request processing.

[0105] If the network between the client and either device 1 or device 2 is abnormal, or if either device 1 or device 2 is unable to process or respond to the client's request, this embodiment will be described using a device 1 failure as an example. The connection establishment process for a device 2 failure is similar to that for a device 1 failure and will not be repeated here. See [link to documentation] Figure 7 In a scenario where device 1 is malfunctioning and device 2 is functioning normally, the connection establishment process includes, but is not limited to, the following steps 71-74.

[0106] Step 71: The client obtains the two IP addresses corresponding to the current device domain name through DNS resolution, still denoted as IP1 and IP2. The client sends initial and 0-RTT data to device 1 via IP1, and simultaneously sends the same initial and 0-RTT data to device 2 via IP2. The initial or 0-RTT data sent via IP1 and the initial or 0-RTT data sent via IP2 carry the same unique request identifier.

[0107] Step 72: After receiving the initial and 0-RTT data sent by the client, device 2 queries the database based on the unique request identifier carried in the initial or 0-RTT data to determine whether the current request has been processed. Since there is no record for this unique request identifier in the database, step 73 is executed.

[0108] Among them, due to network or device 1 malfunction, device 1 did not receive the client's request or was unable to process the client's request.

[0109] Step 73: Device 2 determines that it is processing the request for the first time, and processes it as a normal response, that is, returns a handshake and ack packet to the client, and records the current unique request identifier in the database.

[0110] Step 74: The client receives the handshake and ack packets returned by device 2, confirming the successful connection establishment of IP2. Then, the client sends a close message to device 1 to close the IP1 connection. In a 0-RTT scenario, multiple concurrent IP connection establishments have concluded, and the connection and data transmission / reception were successfully established through IP2.

[0111] Therefore, the client does not terminate concurrent tasks upon receiving a notification of successful 0-RTT connection establishment at the underlying level. Instead, the client only stops establishing connections with concurrent IPs when it actually receives a response packet from the device, rather than assuming a successful connection and closing other concurrent IP connections upon successful 0-RTT packet transmission. This ensures successful 0-RTT connection establishment. It prevents situations where network or device malfunctions cause some requests to fail and close other IP connections, leading to connection failures that should have succeeded, thus improving the connection success rate.

[0112] The above describes the method for establishing a connection according to the embodiments of this application. Corresponding to the above method, the embodiments of this application also provide an apparatus for establishing a connection. Figure 8 This is a schematic diagram of a connection establishment device provided in an embodiment of this application, based on... Figure 8 The following modules are shown. Figure 8 The device shown for establishing a connection is capable of performing... Figure 4-7 All or part of the operations performed. It should be understood that the device may include more additional modules than those shown, or may omit some of the modules shown; this application embodiment does not impose limitations in this regard. Figure 8 As shown, the device includes a transceiver module 801 and a processing module 802.

[0113] Transceiver module 801 is used to perform... Figure 4 The receiving and / or sending related operations performed in the method shown are handled by the processing module 802. Figure 4Other operations besides the receiving and / or sending related operations in the method shown; or, transceiver module 801, for performing Figure 5 Other operations besides the receive and / or send related operations in the method shown are executed by the processing module 802. Figure 5 Other operations performed in the method shown, besides the receive and / or send-related operations.

[0114] In one possible implementation, the transceiver module 801 includes a receiving module and / or a sending module. The receiving module is used to perform receiving-related operations, and the sending module is used to perform sending-related operations.

[0115] In the transceiver module 801, it is used to perform... Figure 4 The receiving and / or sending related operations performed in the method shown are handled by the processing module 802. Figure 4 In the case of other operations performed in the method shown, besides the receiving and / or sending related operations.

[0116] Processing module 802 is used to obtain multiple IPs corresponding to the service domain name to be accessed; transceiver module 801 is used to send connection establishment requests and first data packets to at least one device corresponding to the multiple IPs based on the multiple IPs respectively, wherein the first data packet is a data packet in the application data required to access the service domain name; processing module 802 is used to determine that the connection established based on any IP is successful when receiving a response message returned by any device based on any IP among the multiple IPs, wherein the response message includes a connection establishment response to the connection establishment request and an acknowledgment packet for the first data packet; transceiver module 801 is used to send close messages to the devices corresponding to the remaining IPs based on the remaining IPs other than any one IP, wherein the close messages are used to close the connections established based on the remaining IPs.

[0117] In one possible implementation, the connection request carries a first identifier, and the first data packet carries a second identifier. The first identifier is used by the device to deduplicate connection requests with the same first identifier, and the second identifier is used by the device to deduplicate first data packets with the same request identifier.

[0118] In one possible implementation, the connection request and the first data packet are encapsulated in a message for transmission. The message also encapsulates a third identifier, which is used by the device to deduplicat messages with the same third identifier.

[0119] In one possible implementation, the first data packet is encrypted using a recovery key, which is a shared key determined during the first handshake between the device corresponding to the service domain name.

[0120] In one possible implementation, the transceiver module 801 is further configured to send a second data packet to the device corresponding to any IP address based on any IP address, wherein the second data packet is a data packet following the first data packet.

[0121] In the transceiver module 801, it is used to perform... Figure 5 The processing module 802 is used to perform operations other than the receive and / or send-related operations performed in the method shown. Figure 5 In cases where other operations besides the receiving and / or sending related operations are performed in the method shown.

[0122] The transceiver module 801 is used to receive a connection request and a first data packet sent by a client based on any IP address. The first data packet is a data packet in the application data required to access the service domain name. If the connection request and the first data packet are being processed for the first time, the transceiver module returns a response message to the client based on any IP address to confirm that the connection established based on any IP address is successful. The response message includes a connection response to the connection request and an acknowledgment packet for the first data packet. Alternatively, if the connection request and the first data packet are not being processed for the first time, the transceiver module receives a close message sent by the client based on any IP address to close the connection established based on any IP address.

[0123] In one possible implementation, the connection request carries a first identifier, and the first data packet carries a second identifier. The first identifier is used by the device to deduplicate connection requests with the same first identifier, and the second identifier is used by the device to deduplicate first data packets with the same request identifier. The processing module 802 is configured to determine that the connection request and the first data packet are being processed for the first time if the connection database does not contain either the first identifier or the second identifier. The connection database records the identifier of the connection request being processed for the first time and the identifier of the first data packet being processed for the first time. If the connection database contains at least one of the first identifier or the second identifier, the connection request and the first data packet are not being processed for the first time.

[0124] In one possible implementation, the processing module 802 is further configured to add a first identifier and a second identifier to the connection database.

[0125] In one possible implementation, the connection request and the first data packet are encapsulated in a message for transmission. The message also encapsulates a third identifier, which is used by the device to deduplicat messages with the same third identifier. The processing module 802 is used to determine that the connection request and the first data packet are being processed for the first time if the connection database does not contain the third identifier, and the connection database records the identifier of the message being processed for the first time. If the connection database contains the third identifier, it is determined that the connection request and the first data packet are not being processed for the first time.

[0126] In one possible implementation, the processing module 802 is also used to add a third identifier to the connection database.

[0127] In one possible implementation, the first data packet is encrypted using a recovery key, which is a shared key determined during the first handshake with the client; the processing module 802 is also used to decrypt the first data packet based on the recovery key.

[0128] It should be understood that the above Figure 8 The provided device, in implementing its functions, is only illustrated by the division of the above-described functional modules. In practical applications, the functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. Furthermore, the device and method embodiments provided in the above embodiments belong to the same concept, and their specific implementation processes are detailed in the method embodiments, and will not be repeated here.

[0129] See Figure 9 , Figure 9 A schematic diagram of the structure of a network device 2000 provided in an exemplary embodiment of this application is shown. Figure 9 The network device 2000 shown is used to perform the above. Figure 4 The operation involved in establishing a connection as shown in Figure 5. The network device 2000 is, for example, a switch, a router, etc., and the network device 2000 can be implemented using a general bus architecture.

[0130] like Figure 9 As shown, the network device 2000 includes at least one processor 2001, a memory 2003, and at least one communication interface 2004.

[0131] Processor 2001 may be, for example, a general-purpose central processing unit (CPU), a digital signal processor (DSP), a network processor (NP), a graphics processing unit (GPU), a neural-network processing unit (NPU), a data processing unit (DPU), a microprocessor, or one or more integrated circuits for implementing the embodiments of this application. For example, processor 2001 includes application-specific integrated circuits (ASICs), programmable logic devices (PLDs), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. A PLD may be, for example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), generic array logic (GAL), or any combination thereof. It can implement or execute the various logic blocks, modules, and circuits described in connection with the embodiments of this invention. A processor may also be a combination that implements computational functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0132] Optionally, the network device 2000 also includes a bus. The bus is used to transfer information between the various components of the network device 2000. The bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 9 The symbol is represented by only one line, but this does not mean that there is only one bus or one type of bus.

[0133] Memory 2003 may be, for example, read-only memory (ROM) or other types of static storage devices capable of storing static information and instructions; random access memory (RAM) or other types of dynamic storage devices capable of storing information and instructions; electrically erasable programmable read-only memory (EEPROM); compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.); magnetic disk storage media or other magnetic storage devices; or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. Memory 2003 may exist independently and be connected to processor 2001 via a bus. Memory 2003 may also be integrated with processor 2001.

[0134] The communication interface 2004 uses any transceiver-like device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), or wireless local area networks (WLAN). The communication interface 2004 can include wired and wireless communication interfaces. Specifically, the communication interface 2004 can be an Ethernet interface, a Fast Ethernet (FE) interface, a Gigabit Ethernet (GE) interface, an Asynchronous Transfer Mode (ATM) interface, a WLAN interface, a cellular network communication interface, or a combination thereof. The Ethernet interface can be an optical interface, an electrical interface, or a combination thereof. In this embodiment, the communication interface 2004 can be used by the network device 2000 to communicate with other devices.

[0135] In a specific implementation, as one example, the processor 2001 may include one or more CPUs, such as... Figure 9The CPUs shown are CPU0 and CPU1. Each of these processors can be a single-core CPU or a multi-core CPU. A processor here can refer to one or more devices, circuits, and / or processing cores used to process data (e.g., computer program instructions).

[0136] In a specific implementation, as one example, the network device 2000 may include multiple processors, such as... Figure 9 The processors shown are 2001 and 2005. Each of these processors can be a single-core CPU or a multi-core CPU. Here, "processor" can refer to one or more devices, circuits, and / or processing cores used to process data (such as computer program instructions).

[0137] In a specific implementation, as one example, the network device 2000 may further include output devices and input devices. The output device communicates with the processor 2001 and can display information in various ways. For example, the output device may be a liquid crystal display (LCD), a light-emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector, etc. The input device communicates with the processor 2001 and can receive user input in various ways. For example, the input device may be a mouse, keyboard, touchscreen device, or sensor device, etc.

[0138] In some embodiments, the memory 2003 stores program code 2010 for executing the solution of this application, and the processor 2001 can execute the program code 2010 stored in the memory 2003. That is, the network device 2000 can implement the connection establishment method provided in the method embodiment through the processor 2001 and the program code 2010 in the memory 2003. The program code 2010 may include one or more software modules. Optionally, the processor 2001 itself may also store program code or instructions for executing the solution of this application.

[0139] In a specific embodiment, the network device 2000 of this application embodiment can correspond to the client in the above-described method embodiments. The processor 2001 in the network device 2000 reads the instructions in the memory 2003, causing... Figure 9 The network device 2000 shown can perform all or part of the operations performed by the client in the above method embodiments.

[0140] For example, the network device 2000 in this application embodiment can correspond to any of the devices in the above-described method embodiments. The processor 2001 in the network device 2000 reads instructions from the memory 2003, causing... Figure 9 The network device 2000 shown can perform all or part of the operations performed by any device in the above method embodiments.

[0141] Network device 2000 can also correspond to the above. Figure 8 The connection establishment apparatus shown is implemented using software from the network device 2000 for each functional module. In other words, the functional modules included in the connection establishment apparatus are generated by the processor 2001 of the network device 2000 reading the program code 2010 stored in the memory 2003.

[0142] in, Figure 4 The steps of the connection establishment method shown in Figure 5 are completed by the integrated logic circuitry of the hardware in the processor of the network device 2000 or by instructions in the form of software. The steps of the method disclosed in the embodiments of this application can be directly implemented by the hardware processor, or by a combination of hardware and software modules in the processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. Since the storage medium is located in memory, the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method; to avoid repetition, these will not be described in detail here.

[0143] See Figure 10 , Figure 10 This invention provides a schematic diagram of the structure of a network device 2100 according to another exemplary embodiment of the present application. Figure 10 The network device 2100 shown is used to perform the above. Figure 4 The network device 2100 may be any of the operations involved in establishing a connection as shown in Figure 5. The network device 2100 may be, for example, a switch, a router, etc., and may be implemented using a general bus architecture.

[0144] like Figure 10 As shown, the network device 2100 includes a main control board 2110 and an interface board 2130.

[0145] The main control board, also known as the main processing unit (MPU) or route processor card, is used to control and manage the various components in the network device 2100, including routing calculation, device management, device maintenance, and protocol processing functions. The main control board 2110 includes a central processing unit 2111 and a memory 2112.

[0146] Interface board 2130 is also called a line processing unit (LPU), linecard, or service board. Interface board 2130 provides various service interfaces and implements packet forwarding. Service interfaces include, but are not limited to, Ethernet interfaces, POS (Packet over SONET / SDH) interfaces, etc., with Ethernet interfaces including, for example, Flexible Ethernet Clients (FlexE Clients). Interface board 2130 includes: a central processing unit 2131, a network processor 2132, a forwarding table entry memory 2134, and a physical interface card (PIC) 2133.

[0147] The central processing unit 2131 on the interface board 2130 is used to control and manage the interface board 2130 and communicate with the central processing unit 2111 on the main control board 2110.

[0148] Network processor 2132 is used to implement packet forwarding processing. Network processor 2132 can be in the form of a forwarding chip. The forwarding chip can be a network processor (NP). In some embodiments, the forwarding chip can be implemented using an application-specific integrated circuit (ASIC) or a field-programmable gate array (FPGA). Specifically, network processor 2132 forwards received packets based on the forwarding table stored in forwarding table entry memory 2134. If the destination address of the packet is the address of network device 2100, the packet is sent to the CPU (such as central processing unit 2131) for processing; if the destination address of the packet is not the address of network device 2100, the next hop and outgoing interface corresponding to the destination address are looked up in the forwarding table according to the destination address, and the packet is forwarded to the outgoing interface corresponding to the destination address. Uplink packet processing may include: packet ingress interface processing, forwarding table lookup; downlink packet processing may include: forwarding table lookup, etc. In some embodiments, the central processing unit can also perform the functions of the forwarding chip, such as implementing software forwarding based on a general-purpose CPU, thus eliminating the need for a forwarding chip on the interface board.

[0149] The physical interface card 2133 is used to implement physical layer interfacing functions. Raw traffic enters the interface board 2130 through this card, and processed packets are sent out from the physical interface card 2133. The physical interface card 2133, also called a daughter card, can be installed on the interface board 2130. It is responsible for converting photoelectric signals into packets, performing validity checks on the packets, and forwarding them to the network processor 2132 for processing. In some embodiments, the central processing unit 2131 can also perform the functions of the network processor 2132, such as implementing software forwarding based on a general-purpose CPU, thus eliminating the need for the network processor 2132 in the physical interface card 2133.

[0150] Optionally, network device 2100 includes multiple interface boards. For example, network device 2100 also includes interface board 2140, which includes: a central processing unit 2141, a network processor 2142, a forwarding table entry memory 2144, and a physical interface card 2143. The functions and implementation methods of each component in interface board 2140 are the same as or similar to those in interface board 2130, and will not be described in detail here.

[0151] Optionally, network device 2100 also includes a switching fabric board 2120. The switching fabric board 2120 can also be referred to as a switch fabric unit (SFU). When network device 2100 has multiple interface boards, the switching fabric board 2120 is used to complete data exchange between the interface boards. For example, interface boards 2130 and 2140 can communicate through the switching fabric board 2120.

[0152] The main control board 2110 and the interface boards are coupled. For example, the main control board 2110, interface boards 2130 and 2140, and the switching network board 2120 communicate with each other via a system bus connected to the system backplane. In one possible implementation, an inter-process communication (IPC) channel is established between the main control board 2110 and interface boards 2130 and 2140, and communication between the main control board 2110 and interface boards 2130 and 2140 is achieved through the IPC channel.

[0153] Logically, network device 2100 includes a control plane and a forwarding plane. The control plane includes a main control board 2110 and a central processing unit 2111, while the forwarding plane includes various components that perform forwarding, such as a forwarding table entry memory 2134, a physical interface card 2133, and a network processor 2132. The control plane performs functions such as router operation, generating forwarding tables, processing signaling and protocol messages, and configuring and maintaining the status of network devices. The control plane distributes the generated forwarding tables to the forwarding plane. In the forwarding plane, the network processor 2132 forwards messages received by the physical interface card 2133 based on the forwarding tables distributed by the control plane. The forwarding tables distributed by the control plane can be stored in the forwarding table entry memory 2134. In some embodiments, the control plane and the forwarding plane can be completely separated and not on the same network device.

[0154] It's worth noting that a network device may have one or more main control boards, including a primary and a backup main control board. It may also have one or more interface boards; the more powerful the network device's data processing capabilities, the more interface boards it provides. Each interface board may also have one or more physical interface cards. A switching board may or may not exist; multiple boards can share the load and provide redundancy. In a centralized forwarding architecture, the network device may not need a switching board, as the interface boards handle the entire system's business data processing. In a distributed forwarding architecture, the network device can have at least one switching board, which enables data exchange between multiple interface boards, providing high-capacity data exchange and processing capabilities. Therefore, the data access and processing capabilities of a distributed architecture network device are greater than those of a centralized architecture network device. Alternatively, the network device can also be a single board, without a switching board. The functions of the interface board and the main control board are integrated on this one board. In this case, the central processing unit (CPU) on the interface board and the CPU on the main control board can be combined into a single CPU to perform the combined functions. This type of network device has lower data exchange and processing capabilities (e.g., low-end switches or routers). The specific architecture adopted depends on the specific network deployment scenario, and no restrictions are imposed here.

[0155] In a specific embodiment, network device 2100 corresponds to the above. Figure 8 The apparatus for establishing a connection is shown. In some embodiments, Figure 8 The transceiver module 801 in the connection establishment device shown is equivalent to the physical interface card 2133 in the network device 2100, and the processing module 802 is equivalent to the central processing unit 2111 or network processor 2132 in the network device 2100.

[0156] Figure 11This is a schematic diagram of a server structure provided in an embodiment of this application. The server 1100 can vary considerably due to different configurations or performance. It may include one or more processors 1101 and one or more memories 1102. The one or more memories 1102 store at least one computer program, which is loaded and executed by the one or more processors 1101 to enable the server to implement the connection establishment methods provided in the various method embodiments described above. Of course, the server 1100 may also have wired or wireless network interfaces, a keyboard, and input / output interfaces for input and output. The server 1100 may also include other components for implementing device functions, which will not be elaborated here.

[0157] This application also provides a system for establishing a connection, which includes a client and at least one device. For example, the client is... Figure 9 The network device shown is 2000 or Figure 10 The network device 2100 shown has at least one device as follows: Figure 9 The network device shown is 2000 or Figure 10 The network device 2100 shown. The method for establishing a connection performed by the client and at least one device is described above. Figure 4-7 The relevant descriptions of the embodiments shown will not be repeated here.

[0158] This application also provides a communication device, which includes a transceiver, a memory, and a processor. The transceiver, the memory, and the processor communicate with each other via an internal connection path. The memory stores instructions, and the processor executes the instructions stored in the memory to control the transceiver to receive and transmit signals. When the processor executes the instructions stored in the memory, it causes the processor to perform a method required by a client or any device.

[0159] It should be understood that the aforementioned processor can be a CPU, or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. General-purpose processors can be microprocessors or any conventional processor. It is worth noting that the processor can be a processor supporting Advanced Reduced Instruction Set Computing (RISC) machines (ARM) architecture.

[0160] Furthermore, in an alternative embodiment, the memory described above may include read-only memory and random access memory, and provide instructions and data to the processor. The memory may also include non-volatile random access memory. For example, the memory may also store device type information.

[0161] The memory can be volatile or non-volatile, or may include both. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which serves as an external cache. Many forms of RAM are available by way of example, but not limitation. Examples include static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0162] This application also provides a computer-readable storage medium storing at least one instruction, which is loaded and executed by a processor to enable the computer to implement any of the above-described methods for establishing a connection.

[0163] This application also provides a computer program (product) that, when executed by a computer, causes the processor or computer to perform the corresponding steps and / or processes in the above method embodiments.

[0164] This application also provides a chip, including a processor, for calling and executing instructions stored in a memory, causing a communication device with the chip installed to perform any of the connection establishment methods described above.

[0165] This application embodiment also provides another chip, including: an input interface, an output interface, a processor, and a memory. The input interface, output interface, processor, and memory are connected through an internal connection path. The processor is used to execute code in the memory. When the code is executed, the processor is used to execute any of the above-mentioned connection establishment methods.

[0166] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions according to this application are generated, in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk), etc.

[0167] Those skilled in the art will recognize that the method steps and modules described in conjunction with the embodiments disclosed herein can be implemented in software, hardware, firmware, or any combination thereof. To clearly illustrate the interchangeability of hardware and software, the steps and components of each embodiment have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0168] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0169] When implemented using software, it can be implemented wholly or partially as a computer program product. This computer program product includes one or more computer program instructions. As an example, the methods of this application embodiment can be described in the context of machine-executable instructions, such as program modules that execute on a device on a real or virtual processor of the target. Generally, program modules include routines, programs, libraries, objects, classes, components, data structures, etc., which perform specific tasks or implement specific abstract data structures. In various embodiments, the functionality of program modules can be combined or divided among the described program modules. The machine-executable instructions for the program modules can execute within a local or distributed device. In a distributed device, the program modules can reside on both local and remote storage media.

[0170] Computer program code used to implement the methods of the embodiments of this application may be written in one or more programming languages. This computer program code may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus, such that when executed by the computer or other programmable data processing apparatus, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a computer, partially on a computer, as a standalone software package, partially on a computer and partially on a remote computer, or entirely on a remote computer or server.

[0171] In the context of the embodiments of this application, computer program code or related data may be carried by any suitable carrier to enable a device, apparatus, or processor to perform the various processes and operations described above. Examples of carriers include signals, computer-readable media, etc.

[0172] Examples of signals may include electrical, optical, radio, sound, or other forms of propagation signals, such as carrier waves, infrared signals, etc.

[0173] A machine-readable medium can be any tangible medium that contains or stores programs for or relating to an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. More detailed examples of machine-readable storage media include electrical connections with one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0174] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and modules described above can be found in the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0175] In the embodiments provided in this application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the couplings or direct couplings or communication connections shown or discussed may be indirect couplings or communication connections through some interfaces, devices, or modules, or they may be electrical, mechanical, or other forms of connection.

[0176] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of the embodiments of this application, depending on actual needs.

[0177] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0178] If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0179] In this application, the terms "first," "second," etc., are used to distinguish identical or similar items that have substantially the same function and purpose. It should be understood that there is no logical or temporal dependency between "first," "second," and "nth," nor does it limit the quantity or order of execution. It should also be understood that although the following description uses the terms "first," "second," etc., to describe various elements, these elements should not be limited by the terms. These terms are merely used to distinguish one element from another. For example, without departing from the scope of various examples, a first image can be referred to as a second image, and similarly, a second image can be referred to as a first image. Both the first image and the second image can be images, and in some cases, they can be separate and distinct images.

[0180] It should also be understood that, in the various embodiments of this application, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0181] In this application, the term "at least one" means one or more, and the term "multiple" means two or more. For example, multiple second messages refer to two or more second messages. The terms "system" and "network" are often used interchangeably in this document.

[0182] It should be understood that the terminology used in the description of the various examples herein is for the purpose of describing particular examples only and is not intended to be limiting. As used in the description of the various examples and the appended claims, the singular forms “a” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0183] It should also be understood that the term "and / or" as used herein refers to and covers any and all possible combinations of one or more of the associated listed items. The term "and / or" describes an association between related objects, indicating that three relationships can exist; for example, A and / or B can represent: A alone, A and B simultaneously, or B alone. Additionally, the character " / " in this application generally indicates that the preceding and following related objects are in an "or" relationship.

[0184] It should also be understood that the term “comprising” (also referred to as “includes”, “including”, “comprises” and / or “comprising”) as used in this specification specifies the presence of the stated features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0185] It should also be understood that the terms “if” and “if” can be interpreted as meaning “when” or “upon”, or “in response to determination” or “in response to detection”. Similarly, depending on the context, the phrases “if determination…” or “if detection [the stated condition or event]” can be interpreted as meaning “when determination…”, or “in response to determination…”, or “when detection [the stated condition or event]” or “in response to detection [the stated condition or event]”.

[0186] It should be understood that determining B based on A does not mean determining B solely based on A; B can also be determined based on A and / or other information.

[0187] It should also be understood that the phrases "an embodiment," "an embodiment," and "a possible implementation" used throughout the specification mean that a specific feature, structure, or characteristic related to an embodiment or implementation is included in at least one embodiment of this application. Therefore, the phrases "in an embodiment," "an embodiment," or "a possible implementation" appearing throughout the specification do not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments.

[0188] The above description is only an optional embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the principles of this application should be included within the protection scope of this application.

Claims

1. A method of establishing a connection, characterized by The method comprises: Obtaining a plurality of Internet Protocol (IP) corresponding to a service domain name to be accessed; Based on the plurality of IP, respectively send a connection request and a first data packet to at least one device corresponding to the plurality of IP, the first data packet is a data packet in the application data required to be transmitted for accessing the service domain name; In the case of receiving a response message returned by any one of the at least one device based on any one of the plurality of IP, it is determined that the connection based on the any one IP is successful, and the response message includes a connection response to the connection request and an acknowledgement packet to the first data packet; Based on the remaining IP except the any one IP in the plurality of IP, respectively send a close message to the device corresponding to the remaining IP, the close message is used to close the connection established based on the remaining IP.

2. The method of claim 1, wherein, The first identification is carried in the connection request, and the second identification is carried in the first data packet, the first identification is used for the device to de-duplicate the received connection request with the same first identification, and the second identification is used for the device to de-duplicate the received first data packet with the same request identification.

3. The method of claim 1, wherein, The connection request and the first data packet are encapsulated in a message for transmission, and the third identification is also encapsulated in the message, the third identification is used for the device to de-duplicate the received message with the same third identification.

4. The method according to any of claims 1 to 3, characterized in that, The first data packet is encrypted using a recovery key, and the recovery key is a shared key determined when the device corresponding to the service domain name performs a first handshake.

5. The method according to any of claims 1 to 4, characterized in that, After determining that the connection based on the any one IP is successful, the method further comprises: Based on the any one IP, a second data packet is sent to the device corresponding to the any one IP, and the second data packet is a data packet after the first data packet.

6. A method of establishing a connection, characterized by The method comprises: Based on any IP, receiving a connection request and a first data packet sent by a client, the first data packet is a data packet in the application data required to be transmitted for accessing a service domain name; In the case of first processing of the connection request and the first data packet, a response message is returned to the client based on the any IP, it is determined that the connection based on the any IP is successful, and the response message includes a connection response to the connection request and an acknowledgement packet to the first data packet; or In the case of non-first processing of the connection request and the first data packet, a close message sent by the client is received based on the any IP to close the connection established based on the any IP.

7. The method of claim 6, wherein, The first identification is carried in the connection request, and the second identification is carried in the first data packet, the first identification is used for the device to de-duplicate the received connection request with the same first identification, and the second identification is used for the device to de-duplicate the received first data packet with the same request identification; After receiving the connection request and the first data packet sent by the client based on any IP, the method further comprises: If the first identification and the second identification are not included in the connection database, it is determined that the connection request and the first data packet are first processed, and the connection database records the identification of the first processed connection request and the identification of the first processed first data packet; If at least one of the first identifier or the second identifier is included in a connection building database, it is determined that the connection building request and the first data packet are non-first-time processing.

8. The method of claim 7, wherein, After the any IP returns the response message to the client, the method further includes: The first identifier and the second identifier are added in the connection building database.

9. The method of claim 6, wherein, The connection building request and the first data packet are encapsulated in a packet, and a third identifier is also encapsulated in the packet, the third identifier being used by a device to remove duplicates of the received packet with the same third identifier. After the any IP receives the connection building request and the first data packet sent by the client, the method further includes: If the third identifier is not included in a connection building database, it is determined that the connection building request and the first data packet are first-time processing, and the connection building database records identifiers of packets that are first-time processing. If the third identifier is included in the connection building database, it is determined that the connection building request and the first data packet are non-first-time processing.

10. The method of claim 9, wherein, After the any IP returns the response message to the client, the method further includes: The third identifier is added in the connection building database.

11. The method according to any of claims 6-10, characterized by, The first data packet is encrypted using a recovery key, and the recovery key is a shared key determined when the first handshake is performed with the client. Before the any IP returns the response message to the client, the method further includes: The first data packet is decrypted based on the recovery key.

12. An apparatus for establishing a connection, characterized by The apparatus includes: The transceiver module is configured to perform the receiving and / or sending operations in the method of any one of claims 1-5, and the processing module is configured to perform other operations in addition to the receiving and / or sending operations in the method of any one of claims 1-5; or The transceiver module is configured to perform the receiving and / or sending operations in the method of any one of claims 6-11, and the processing module is configured to perform other operations in addition to the receiving and / or sending operations in the method of any one of claims 6-11.

13. A network device, comprising: The network device includes a processor coupled with a memory, and the memory stores at least one program instruction or code, which is loaded and executed by the processor to enable the network device to implement the connection building method of any one of claims 1-11.

14. A system for establishing a connection, characterized by The connection building system includes a client and at least one device. The client is configured to implement the connection building method of any one of claims 1-5, and any one of the at least one device is configured to implement the connection building method of any one of claims 6-11.

15. A computer-readable storage medium, characterized in that, The computer storage medium stores at least one instruction, which is loaded and executed by a processor to enable a computer to implement the connection building method of any one of claims 1-5, or to enable a computer to implement the connection building method of any one of claims 6-11.

16. A computer program product, characterised in that, The computer program product comprises computer program code to be loaded and executed by a computer to cause the computer to implement the method of establishing a connection according to any one of claims 1-5, or to cause the computer to implement the method of establishing a connection according to any one of claims 6-11.

Images