A network packet processing method and device, electronic equipment and storage medium

Abstract

The present disclosure provides a network message processing method and device, electronic equipment and storage medium, comprising: obtaining a network message sent by a target client; obtaining a target connection object matched with the network message, and writing message data carried by the network message into the target connection object; determining a target transmission channel to which the target connection object belongs, and transmitting the message data in the target connection object to the target transmission channel for encapsulation to obtain a target data frame with structured information; determining a transmission type corresponding to the target data frame, and transmitting the target data frame to a server according to the transmission type. The present disclosure determines the target connection object corresponding to the network message and the target transmission channel to which the target connection object belongs in the VPN client, and can select a suitable target transmission channel for encapsulation processing according to the restrictions or requirements of the network environment, to adapt to the needs of complex network environment, thereby improving the stability and reliability of VPN in complex environment.

Description

Technical Field

[0001] This disclosure relates to the field of network communication, specifically to a method, apparatus, electronic device, and storage medium for processing network messages. Background Technology

[0002] In current encrypted tunnel scenarios, the client's network environment may have various limitations and problems, such as restrictions from enterprise internal firewalls, service quality restrictions imposed by operators on User Datagram Protocol (UDP), low network bandwidth, and high packet loss rates.

[0003] To address these issues, current solutions involve enabling clients to optimize network access by automatically selecting available transport layers. Among tunneling protocols, Virtual Private Networks (VPNs) are the most common. However, while single-mode VPNs work well in normal network conditions, their effectiveness is limited in complex network environments, failing to fully utilize available transport layer resources. Summary of the Invention

[0004] In view of this, embodiments of the present disclosure provide a method, apparatus, electronic device, and storage medium for processing network packets to solve the problem that single-mode VPNs are limited in operation in complex network environments and cannot fully utilize available transport layer resources.

[0005] In a first aspect, embodiments of this disclosure provide a method for processing network packets, the method being applied to a VPN client, the method comprising:

[0006] Obtain network packets sent by the target client, wherein the target client is a client that has established a connection with the VPN client;

[0007] Obtain the target connection object that matches the network packet, and write the packet data carried by the network packet into the target connection object;

[0008] Determine the target transmission channel to which the target connection object belongs, and transmit the message data in the target connection object to the target transmission channel for encapsulation to obtain a target data frame with structured information;

[0009] Determine the transmission type corresponding to the target data frame, and transmit the target data frame to the server according to the transmission type.

[0010] Secondly, embodiments of this disclosure provide a network packet processing apparatus, the apparatus comprising:

[0011] The acquisition module is used to acquire network packets sent by the target client, wherein the target client is a client that has established a connection with the VPN client;

[0012] The writing module is used to obtain a target connection object that matches the network packet and write the packet data carried by the network packet into the target connection object.

[0013] The processing module is used to determine the target transmission channel to which the target connection object belongs, and to transmit the message data in the target connection object to the target transmission channel for encapsulation to obtain a target data frame with structured information;

[0014] An execution module is used to determine the transmission type corresponding to the target data frame and transmit the target data frame to the server according to the transmission type.

[0015] Thirdly, embodiments of this disclosure provide an electronic device, including: a memory and a processor, which are communicatively connected to each other. The memory stores computer instructions, and the processor executes the computer instructions to perform the method described in the first aspect or any corresponding embodiment.

[0016] Fourthly, embodiments of this disclosure provide a computer-readable storage medium storing computer instructions for causing a computer to perform the methods described in the first aspect or any corresponding embodiment.

[0017] This disclosure identifies the target connection object corresponding to the network packet in the VPN client and determines the target transmission channel to which the target connection object belongs. Based on the limitations or requirements of the network environment, a suitable target transmission channel can be selected for encapsulation processing to adapt to the needs of complex network environments, thereby improving the stability and reliability of the VPN in complex environments. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the specific embodiments of this disclosure or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0019] Figure 1 This is a schematic diagram of a system architecture according to some embodiments of the present disclosure;

[0020] Figure 2 This is a flowchart illustrating a method for processing network packets according to some embodiments of this disclosure;

[0021] Figure 3 This is a flowchart illustrating a method for processing network packets according to some embodiments of this disclosure;

[0022] Figure 4 This is a schematic diagram of the structure of a VPN encrypted tunnel according to some embodiments of the present disclosure;

[0023] Figure 5 This is a schematic diagram of the structure of a data frame according to some embodiments of the present disclosure;

[0024] Figure 6 This is a timing diagram of network packet processing according to some embodiments of this disclosure;

[0025] Figure 7 This is a structural block diagram of a network packet processing apparatus according to an embodiment of the present disclosure;

[0026] Figure 8 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of this disclosure. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0028] Currently, common VPNs include IPSec, OpenVPN, and WireGuard. IPSec typically has two modes: transport mode and tunnel mode. Transport mode has limited use cases, such as being unusable in NAT (Network Address Translation) scenarios. Tunnel mode, on the other hand, has wider applications and better compatibility. In transport mode, UDP is typically used as the transport layer, which is a typical IP-in-IP working method.

[0029] OpenVPN is a widely used VPN protocol that supports TCP and UDP as transport layer modes. When UDP is used as the transport layer, it also operates based on IP-in-IP. When TCP is used as the transport layer, it is mainly used for compatibility with restricted network environments, but its performance is poor and may exacerbate network quality degradation.

[0030] Furthermore, the WireGuard protocol is a simple and secure protocol that requires only one round-trip handshake (1-RTT) to establish a secure connection. However, WireGuard does not support TCP as a transport layer and also operates in IP-In-IP mode.

[0031] In summary, IPSec transport mode cannot be used in NAT scenarios. OpenVPN uses UDP as the transport layer based on an IP-in-IP working principle, and TCP as the transport layer for compatibility with restricted network environments, but its performance is poor. WireGuard does not support TCP as the transport layer.

[0032] Based on this, embodiments of this application provide a system architecture, such as... Figure 1 As shown, the system architecture includes a terminal device 101 and a server 102. The terminal device 101 deploys multiple application clients and a VPN client. The VPN client runs in the user space of the operating system on the terminal device 101, isolated from the kernel. It cannot directly access information and resources within the kernel, but needs to access and operate the network through interfaces provided by the kernel. Specifically, the client sends network packets normally. The VPN client detects and parses the network packets sent by the client, determines the target connection object corresponding to the network packet, and identifies the target transmission channel to which the target connection object belongs. Based on the limitations or requirements of the network environment, it can select a suitable target transmission channel for encapsulation processing to adapt to the needs of complex network environments.

[0033] According to embodiments of this disclosure, a method, apparatus, electronic device, and storage medium for processing network packets are provided. It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowcharts, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0034] This embodiment provides a method for processing network packets. Figure 2 This is a flowchart of a network packet processing method according to an embodiment of the present disclosure, such as... Figure 2 As shown, the process includes the following steps:

[0035] Step S11: Obtain network packets sent by the target client, where the target client is a client that has established a connection with the VPN client.

[0036] The method provided in this disclosure is applied to a VPN client in the above-described system architecture. The VPN client establishes connections with various application clients, and the specific connection process is as follows: The application client initiates a connection request, that is, when the application client is conducting network communication, it can establish a connection to communicate with the server. The connection request is a request sent by the application client to the server through the VPN client, indicating that the application wishes to establish a connection with the server for data transmission and interaction. In this disclosure embodiment, after receiving the connection request initiated by the client, the VPN client does not forward the connection request, but instead completes the handshake on behalf of the server, thus completing the connection between the VPN client and the client. It can be understood that a VPN client is a virtual private network implemented in software. In this scenario, the VPN client simulates the handshake behavior of the server, receives the connection request initiated by the application, and establishes a connection with the application.

[0037] After establishing connections with the clients of various applications, the VPN client can detect specified network ports or IP addresses to receive network packets sent by the target clients. This can be achieved through the network socket API provided by the operating system. Once the VPN client receives a network packet from the target client, it parses the packet to extract valid data. This includes operations such as header parsing, protocol parsing, and data segmentation. The specific parsing process depends on the network protocol used and the application requirements.

[0038] It's important to note that traditional VPN connections require configuration and management on the server side, including the generation and distribution of certificates and keys. However, when using a VPN client, the server doesn't need to handle handshakes and connection management; it only needs to receive connection requests from the VPN client. This reduces the server's burden and simplifies the configuration and management process. VPN clients allow users greater flexibility in managing and controlling connections. Users can choose to establish a connection with a target client based on their needs and network environment, and the VPN client can simulate the server's handshake process. This approach gives users better control over the connection establishment and termination process. Furthermore, using a VPN client to perform the handshake instead of the server reduces connection initialization time, thus improving connection establishment speed. Since the VPN client only needs to perform the handshake locally, without transmitting it over the network to the server, network latency and connection establishment time are reduced.

[0039] Step S12: Obtain the target connection object that matches the network packet, and write the packet data carried by the network packet into the target connection object.

[0040] In this embodiment, the VPN client maintains a connection object pool to store established connection objects. Each connection object contains message transmission information and related historical message data. Therefore, when the VPN client receives a network packet, it first needs to find a matching target connection object from the connection object pool based on the network packet's transmission information. Once a target connection object is found, the message data carried by the network packet is written into the target connection object.

[0041] Step S13: Determine the target transmission channel to which the target connection object belongs, and transmit the message data in the target connection object to the target transmission channel for encapsulation to obtain a target data frame with structured information.

[0042] In this embodiment, a transport channel set is maintained in the VPN client to store established transport channels. Transport channels can be divided according to business requirements, such as based on application layer protocols or service types. Based on the object identifier of the target connection object, the VPN client can determine the target transport channel to which the target connection object belongs from the transport channel set. After determining the target transport channel, the packet data in the target connection object is transmitted to the corresponding target transport channel.

[0043] After receiving message data, the target transmission channel encapsulates the data according to the protocol or rules used by the channel, resulting in a target data frame with structured information. The encapsulation process may include adding a frame header, calculating a checksum, and performing data compression. Once the message data is encapsulated into a target data frame, depending on the application client's needs and the network environment, the target data frame can be stored locally or sent to the target device or system. This may involve storing it on a disk or sending it over a network.

[0044] Step S14: Determine the transmission type corresponding to the target data frame, and transmit the target data frame to the server according to the transmission type.

[0045] In this embodiment, the transmission type corresponding to the target data frame is determined based on the application client's requirements and design. The transmission type can be TCP, UDP, HTTP, etc., depending on the protocol and network transmission method used by the application client. Based on the determined transmission type, a suitable transmission method is selected for data transmission. For example, for TCP transmission, sockets can be used to establish a connection and transmit data; for HTTP transmission, the HTTP protocol can be used for data transmission. The target data frame is then transmitted to the server according to the selected transmission method.

[0046] The method provided in this disclosure determines the target connection object corresponding to the network packet on the VPN client and identifies the target transmission channel to which the target connection object belongs. It can select a suitable target transmission channel for encapsulation processing based on network environment limitations or requirements to adapt to the needs of complex network environments, thereby improving the stability and reliability of the VPN in complex environments. Furthermore, the VPN client replaces the server in performing the handshake with the client, completing the handshake process in microseconds. After the handshake is completed, the TCP packet data is transmitted to the service area through a tunnel instead of transmitting the original network packets. Therefore, the method provided in this disclosure can significantly reduce TCP handshake latency.

[0047] In summary, when establishing a connection using TCP in a traditional VPN, the handshake latency is also significant because SYN packets need to be reliably transmitted through the outer TCP layer. This can lead to substantial delays when the latency from the client to the server is high. However, the embodiments disclosed in this disclosure significantly reduce TCP handshake latency by having the client perform the handshake on behalf of the server and then transmitting the completed TCP handshake packet to the server via a tunnel.

[0048] Figure 3 This is a flowchart of a network packet processing method according to an embodiment of the present disclosure, such as... Figure 3 As shown, the process includes the following steps:

[0049] Step S21: Obtain network packets sent by the target client, where the target client is a client that has established a connection with the VPN client. See step S11 in the above embodiment for details, which will not be elaborated upon here.

[0050] Step S22: Obtain the target connection object that matches the network packet, and write the packet data carried by the network packet into the target connection object.

[0051] In this embodiment of the disclosure, obtaining a target connection object that matches a network packet and writing the packet data carried by the network packet into the target connection object includes the following steps A1-A3:

[0052] Step A1: Obtain the network transmission information carried in the network message.

[0053] In this embodiment of the disclosure, the network transmission information includes: source IP address, destination IP address, source port number, destination port number, and transmission protocol. The source IP address (SourceIPAddress) refers to the IP address of the host sending the message, used to identify the source of the message. The destination IP address (DestinationIPAddress) refers to the IP address of the host receiving the message, used to identify the destination of the message. The source port number (SourcePort) refers to the port number of the application client on the terminal device sending the message, used to identify the source port of the application client. The destination port number (DestinationPort) refers to the port number of the application client on the terminal device receiving the message, used to identify the destination port of the application client. The transmission protocol (Protocol) refers to the transmission protocol used by the message, such as TCP, UDP, or ICMP.

[0054] Specifically, these five-tuple information can be extracted by parsing the header information of network packets. At different layers of the protocol stack, this information can be obtained through different protocol header fields. For example, using the TCP protocol at the transport layer, the source and destination port numbers can be obtained from the TCP header; using the IP protocol at the network layer, the source and destination IP addresses can be obtained from the IP header; and using the ICMP protocol at the network layer, the transport protocol information can be obtained from the ICMP header.

[0055] Step A2: Match the network transmission information with the transmission information stored in multiple connection objects to obtain the target connection object that matches the network transmission information.

[0056] In the embodiments disclosed herein, such as Figure 4 As shown, the VPN client has a protocol layer, which includes multiple connection objects. Each connection object corresponds to a packet data sequence; that is, Connection1 corresponds to packet data sequence 1, Connection2 corresponds to packet data sequence 2, and Connection3 corresponds to packet data sequence 3. The header of each packet data sequence stores transmission information. Therefore, the network transmission information of the current network packet can be matched with the transmission information in the headers of each packet data sequence, and the connection object corresponding to the successfully matched transmission information is taken as the target connection object.

[0057] It's important to note that the header of the packet data sequence stores transmission information, including the destination address (dip), source address (sip), source port (sport), and destination port (dport). This information helps the server determine which destination to send the packet data (payload). Compared to traditional VPNs, each IPv4 connection uses only about 32 bytes of additional control information, while traditional VPNs may incur at least 40 bytes of overhead per packet. This saves network bandwidth and improves transmission efficiency. The protocol mainly consists of a header and TLVs: the header contains connection information, such as sip, sport, dipp, and dport, used to identify the two parties in the connection and the direction of transmission. TLVs contain user session information, such as tokens, used to authenticate and authorize users to access specific resources or services.

[0058] In this way, by adding a small amount of control information to the header of the message data sequence of each connection object, effective management of data transmission is achieved while reducing additional overhead. The structure of the header and TLVs allows the protocol to flexibly support the transmission of various connection and session information, thereby improving the performance and efficiency of network transmission, while ensuring that data packets arrive at their destination accurately.

[0059] Step A3: Obtain the message data sequence from the target connection object and write the message data to the end of the message data sequence.

[0060] In the embodiments disclosed herein, such as Figure 4 As shown, the message data sequence corresponding to each connection object is stored in multiple blocks, and each block corresponds to one message data. Therefore, after determining the message data sequence of the target connection object, the message data is directly written to the end of the message data sequence. For example, the message data sequence corresponding to Connection2 is as follows: H2-C21-C22-C23-C23, where H2 is the header of the message data sequence, which stores transmission information. At this time, the message data carried by the current network packet needs to be written into the message data sequence. The message data sequence after writing the message data is H2-C21-C22-C23-C23-C24, where C24 contains the message data of the current network packet.

[0061] In this embodiment of the disclosure, the method further includes: creating an initial sequence when the network transmission information does not match the transmission information stored in each connection object; writing network transmission information at the beginning of the initial sequence and writing message data after the beginning of the initial sequence to obtain a message data sequence of the target connection object.

[0062] Specifically, the initial sequence is created first. Network transmission information (source IP address, destination IP address, source port number, destination port number, transmission protocol, etc.) is written to the beginning of the initial sequence according to specific rules. For example, this information can be arranged in a certain order, and the arranged data can be written sequentially into the initial sequence. Then, the message data to be sent is encoded according to the required format, and the encoded data is written sequentially into the initial sequence. The message data can be appended to the beginning of the initial sequence, or written at specific positions as needed, thus obtaining the message data sequence of the target connection object.

[0063] Step S23: Determine the target transmission channel to which the target connection object belongs, and transmit the message data in the target connection object to the target transmission channel for encapsulation to obtain a target data frame with structured information.

[0064] In this embodiment of the disclosure, determining the target transmission channel to which the target connection object belongs includes: obtaining multiple transmission channels that have been created, wherein each transmission channel contains multiple connection objects; and using the transmission channel containing the target connection object as the target transmission channel.

[0065] Specifically, VPN clients have a stream layer after the protocol layer, such as... Figure 4 As shown, the stream layer includes multiple data channels, such as data channel 1 (stream1) and data channel 2 (stream2). Data channel 1 contains connection objects 1 (Connection1), 2 (Connection2), and 3 (Connection3), while data channel 2 contains connection objects 4 (Connection4), 5 (Connection5), and 6 (Connection6). Therefore, the data channel containing the target connection object can be directly used as the target transmission channel. For example, if the current target connection object is connection object 2 (Connection2), then it can be determined that data channel 1 contains connection object 2, and data channel 1 can be directly used as the target transmission channel.

[0066] In this embodiment of the disclosure, the method further includes: if no target connection object is contained in each transmission channel, obtaining the last created transmission channel; determining the number of connection objects in the last created transmission channel; if the number of objects does not reach a preset number, adding the target connection object to the last created transmission channel and using the last created transmission channel as the target transmission channel; or, if the number of objects reaches a preset number, creating the target transmission channel and adding the target connection object to the target transmission channel.

[0067] Specifically, the number of connected objects in the last transmission channel is determined, and it is checked whether the number of connected objects has reached a preset number: the number of connected objects is compared with the preset number. If the number has not reached the preset number, the target connected object is added to the last created transmission channel, that is, the target connected object is added to the last transmission channel. Depending on the specific implementation of the transmission channel, corresponding methods or properties can be used to add connected objects.

[0068] If the number of connected objects has reached the preset limit, a new transmission channel needs to be created, and the target connected object needs to be added to the new transmission channel. The specific implementation will vary depending on the network programming framework and language. An appropriate function or method can be used to create the transmission channel, and then the target connected object can be added to that channel. Depending on the specific implementation, tags, variables, or attributes can be used to record the target transmission channel. The last created transmission channel or the newly created target transmission channel is set as the target transmission channel for subsequent use.

[0069] In this embodiment of the disclosure, the message data in the target connection object is transmitted to the target transmission channel for encapsulation to obtain a target data frame with structured information, including: transmitting the message data in the target connection object to the target transmission channel; detecting the message structure information and message content of the message data through the target transmission channel; and using the object identifier and message structure information of the target connection object as the frame header and the message content as the frame content to obtain the target data frame.

[0070] Specifically, according to the protocol or specification used by the target transmission channel, and based on the corresponding data format requirements, a frame header is added to the beginning of the message data. The frame header includes the object identifier and identifier of the target connection object, version number, length, sequence number, and other message structure information. Next, according to protocol requirements, a checksum can be calculated to verify the integrity and correctness of the data. The checksum can be obtained by calculating the message data using a specific algorithm. Specific algorithms may include CRC (Cyclic Redundancy Check) and checksum fields. Then, according to protocol or specification requirements, the message data can be compressed to reduce the amount of transmitted data. Data compression can use various compression algorithms, such as LZ77, LZW, and DEFLATE. Finally, according to the protocol or specification requirements of the target transmission channel, the message data, after adding a frame header, calculating a checksum, and data compression (optional), is encapsulated to obtain a target data frame with structured information. Encapsulation may involve organizing and encoding the message data according to the protocol format. Once the message data is encapsulated into a target data frame, appropriate operations can be selected based on the application client's needs and the network environment.

[0071] In the embodiments disclosed herein, such as Figure 5 As shown, the structure of the target data frame includes: the object identifier (Connectionid) of the target connection object, message structure information, and a variable-length TLV. Variable-length TLV (Type-Length-Value) is a data encoding format used for data transmission in computer networks and communication protocols. It consists of a fixed-format identifier (Type), length (Length), and value (Value) used to represent and transmit different types of data. Variable-length TLV can flexibly handle different types of data, and the data length can be dynamically adjusted according to actual needs.

[0072] The Stream layer can be understood as a collection of streams, serving as the main carrier of the tunnel; all data is transmitted through these streams. Upon startup, some stream sessions are pre-established based on the configuration. A Connection is considered a virtual connection flowing within a stream, corresponding one-to-one with the application's connections; multiple connections reuse a single stream. The Connectionid occupies 2 bytes, and the maximum number of virtual connections is 64K-1. A Frame encapsulates the payload; each connection consists of multiple frames. Each frame contains a TLV (Time Limit Volume), with TLVsLength occupying 1 byte, and a maximum of 255 TLVs per frame.

[0073] It should be noted that, compared to traditional VPN solutions, this embodiment does not require an additional IP|UDP or IP|TCP header in each network packet; only 3 bytes need to be added to each data frame. This reduces packet size and saves network bandwidth. Furthermore, traditional VPNs using TCP as the transport layer can lead to drastic network degradation. However, this embodiment avoids using two layers of TCP at the transport layer; the data format is IP|TCP|payload (packet data). Therefore, only reliable packet data transmission is required, without exacerbating network quality degradation.

[0074] Step S24: Determine the transmission type corresponding to the target data frame, and transmit the target data frame to the server according to the transmission type.

[0075] In this embodiment of the disclosure, determining the transmission type corresponding to the target data frame includes: parsing the target data frame to obtain the target protocol type corresponding to the target data frame; and determining the transmission type corresponding to the target protocol type according to the preset mapping relationship between protocol types and transmission types.

[0076] Specifically, transmission types include reliable and unreliable transmission. Reliable transmission protocols such as TLS, MTLS, and Quic provide reliable data transmission mechanisms, including packet retransmission, flow control, and congestion control, to ensure data integrity and reliability. Unreliable transmission protocols such as DTLS do not provide similar retransmission and congestion control mechanisms, and transmitted packets may be lost or out of order. The choice of transmission type depends on the specific scenario and requirements. If the data frame is UDP, an unreliable transmission protocol is generally preferred because UDP itself is an unreliable protocol, and UDP has a fast transmission speed, suitable for real-time transmission or scenarios requiring low latency. A reliable transmission protocol should only be considered when an unreliable transmission protocol is unavailable. If the traffic is TCP, a reliable transmission protocol must be used. TCP is a connection-oriented reliable transmission protocol that provides mechanisms such as ordered data delivery, data acknowledgment and retransmission, flow control, and congestion control to ensure data reliability.

[0077] This allows for flexible and automatic switching, selecting the appropriate transmission type based on traffic type and requirements to adapt to different scenarios. For User Datagram Protocol (UDP) traffic, an unreliable transmission protocol is preferred, while for Transmission Control Protocol (TCP) traffic, a reliable transmission protocol is used. This enables flexible and automatic protocol adaptation to meet the needs of different application scenarios.

[0078] In addition, after determining the transmission type, the VPN client can also initiate connection probes at the User Datagram Protocol (UDP) layer and the Transmission Control Protocol (TCP) layer to test their connectivity and latency. Probing is divided into active probing and passive probing, as detailed below:

[0079] ① Passive Probe: Dynamically records the current data buffer sending rate at runtime, and adjusts the weighting of the UDP and TCP layers based on this rate when allocating new traffic.

[0080] ②Active detection situation:

[0081] Scenario 1: UDP layer is down, TCP layer is up. In this case, TCP is dynamically selected as the transport layer, meaning the program will primarily use the TCP protocol for data transmission.

[0082] Scenario 2: TCP layer fails, UDP layer succeeds. Accordingly, UDP is dynamically selected as the transport layer, meaning the UDP protocol is primarily used for data transmission.

[0083] Scenario 3: Both TCP and UDP layers are accessible. In this case, traffic will be dynamically allocated to both the TCP and UDP layers as transport layers, and passive probing will be initiated. This means the program will utilize both TCP and UDP layers for data transmission simultaneously, adjusting the traffic allocation ratio between them based on the results of passive probing.

[0084] During operation, passive probing can record the current streambuffer's sending rate in real time. When new traffic is allocated, the ratio between the TCP and UDP layers is adjusted based on the sending rate obtained from passive probing to achieve more optimized data transmission.

[0085] Therefore, when the underlying TCP / UDP network performance is detected, the optimal transport layer can be automatically selected without modifying the application's interface.

[0086] This embodiment also provides a timing diagram of a network packet processing method, such as... Figure 6 As shown, the process includes:

[0087] Step 1: When an application client (such as a browser or other application) on a terminal device wants to access the application server, it initiates a request. The purpose of this request is to establish a TCP connection with the server for data communication. To establish this connection, the application client constructs a TCP connection request, which includes necessary information such as the source and destination IP addresses and port numbers. The constructed TCP connection request is then sent to the terminal device's kernel.

[0088] Step 2: The kernel, the core of the operating system, is responsible for managing and controlling the device's hardware resources, including network connectivity. When the kernel receives a connection request from an application client, it processes and verifies the request. The kernel checks the source and destination of the request to ensure it is legitimate and does not pose a threat to device security. If the request is legitimate, the kernel sends a connection request.

[0089] Step 3: A VPN client will be installed on the terminal device. When the kernel receives a connection request, the VPN client will detect this request and respond to the application client's connection request on behalf of the server. The VPN client will simulate the server's behavior and perform a handshake with the application client to establish a secure connection. During the handshake process, the VPN client and the application client will exchange encryption keys and authentication information to ensure the security and reliability of the connection.

[0090] Step 4: The VPN client and application client complete a handshake. The VPN client sends an acknowledgment to the kernel, indicating that the connection has been successfully established. Upon receiving the acknowledgment, the kernel sends it back to the application client, informing it that the connection has been successfully established. At this point, a secure connection is established between the application client and the VPN client, allowing for data transmission and communication.

[0091] Step 5: The application client uses the kernel for network communication, transmitting network packets containing IP (Internet Protocol), TCP (Transmission Control Protocol), and payload to the kernel.

[0092] Step 6: The kernel sends network packets.

[0093] Step 7: The VPN client detects the network packets sent by the kernel, obtains the target connection object that matches the network packet, and writes the packet data carried by the network packet into the target connection object; determines the target transmission channel to which the target connection object belongs, and transmits the packet data in the target connection object to the target transmission channel for encapsulation to obtain a target data frame with structured information.

[0094] Step 8: After the VPN obtains the target data frame with structured information, it determines the transmission type corresponding to the target data frame and transmits the target data frame to the server according to the transmission type.

[0095] This disclosure identifies the target connection object corresponding to the network packet in the VPN client and determines the target transmission channel to which the target connection object belongs. Based on the limitations or requirements of the network environment, a suitable target transmission channel can be selected for encapsulation processing to adapt to the needs of complex network environments, thereby improving the stability and reliability of the VPN in complex environments.

[0096] This embodiment also provides a network packet processing apparatus for implementing the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that performs a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0097] This embodiment provides a network packet processing device, such as... Figure 7 As shown, it includes:

[0098] The acquisition module 51 is used to acquire network packets sent by the target client, wherein the target client is a client that has established a connection with the VPN client;

[0099] The writing module 52 is used to obtain the target connection object that matches the network packet and write the packet data carried by the network packet into the target connection object.

[0100] Processing module 53 is used to determine the target transmission channel to which the target connection object belongs, and to transmit the message data in the target connection object to the target transmission channel for encapsulation to obtain a target data frame with structured information;

[0101] The execution module 54 is used to determine the transmission type corresponding to the target data frame and transmit the target data frame to the server according to the transmission type.

[0102] In this embodiment of the disclosure, the writing module 52 is used to obtain network transmission information carried by network packets; match the network transmission information with the transmission information stored in multiple connection objects to obtain a target connection object that matches the network transmission information; obtain the packet data sequence in the target connection object, and write the packet data to the end of the packet data sequence.

[0103] In this embodiment of the present disclosure, the apparatus further includes: a first creation module, configured to create an initial sequence when the network transmission information does not match the transmission information stored in each connection object; write network transmission information at the beginning of the initial sequence, and write message data after the beginning of the initial sequence to obtain a message data sequence of the target connection object.

[0104] In this embodiment of the disclosure, the processing module 53 is used to obtain multiple currently created transmission channels, wherein each transmission channel contains multiple connection objects; and to use the transmission channel containing the target connection object as the target transmission channel.

[0105] In this embodiment of the present disclosure, the apparatus further includes: a second creation module, configured to: obtain the last created transmission channel when no target connection object is contained in each transmission channel; determine the number of connection objects in the last created transmission channel; add the target connection object to the last created transmission channel and use the last created transmission channel as the target transmission channel when the number of objects does not reach a preset number; or, create the target transmission channel and add the target connection object to the target transmission channel when the number of objects reaches the preset number.

[0106] In this embodiment of the disclosure, the processing module 53 is used to transmit the message data in the target connection object to the target transmission channel; detect the message structure information and message content of the message data through the target transmission channel; and use the object identifier and message structure information of the target connection object as the frame header and the message content as the frame content to obtain the target data frame.

[0107] In this embodiment of the disclosure, the execution module is used to parse the target data frame to obtain the target protocol type corresponding to the target data frame; and determine the transmission type corresponding to the target protocol type according to the mapping relationship between the preset protocol type and the transmission type.

[0108] This disclosure identifies the target connection object corresponding to the network packet in the VPN client and determines the target transmission channel to which the target connection object belongs. Based on the limitations or requirements of the network environment, a suitable target transmission channel can be selected for encapsulation processing to adapt to the needs of complex network environments, thereby improving the stability and reliability of the VPN in complex environments.

[0109] Please see Figure 8 , Figure 8 This is a schematic diagram of the structure of an electronic device provided in an optional embodiment of this disclosure, such as... Figure 8 As shown, the electronic device includes one or more processors 10, memory 20, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other via different buses and can be mounted on a common motherboard or otherwise as required. The processors can process instructions executed within the electronic device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple electronic devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system).

[0110] Processor 10 may be a central processing unit, a network processor, or a combination thereof. Processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GDA), or any combination thereof.

[0111] The memory 20 stores instructions executable by at least one processor 10 to cause the at least one processor 10 to perform the method shown in the above embodiments.

[0112] The memory 20 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the electronic device as displayed on a mini-program landing page. Furthermore, the memory 20 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some alternative embodiments, the memory 20 may optionally include memory remotely located relative to the processor 10, and these remote memories can be connected to the electronic device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0113] The memory 20 may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as flash memory, hard disk or solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0114] The electronic device also includes a communication interface 30 for communicating with other devices or communication networks.

[0115] This disclosure also provides a computer-readable storage medium in which the methods described in this disclosure can be implemented in hardware or firmware, or implemented as recordable on a storage medium, or implemented as computer code originally stored on a remote storage medium or a non-transitory machine-readable storage medium and subsequently stored on a local storage medium after being downloaded over a network. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium may be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium may also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code that, when accessed and executed by the computer, processor, or hardware, implements the methods shown in the above embodiments.

[0116] Although embodiments of the present disclosure have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the present disclosure, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A method for processing network packets, characterized in that, The method is applied to a VPN client, and the method includes: Obtain network packets sent by the target client, wherein the target client is a client that has established a connection with the VPN client; Obtaining a target connection object that matches the network packet and writing the packet data carried by the network packet into the target connection object includes: obtaining network transmission information carried by the network packet; matching the network transmission information with transmission information stored in multiple connection objects to obtain a target connection object that matches the network transmission information; obtaining a packet data sequence in the target connection object and writing the packet data to the end of the packet data sequence; Determine the target transmission channel to which the target connection object belongs, and transmit the message data in the target connection object to the target transmission channel for encapsulation to obtain a target data frame with structured information; Determine the transmission type corresponding to the target data frame, and transmit the target data frame to the server according to the transmission type.

2. The method according to claim 1, characterized in that, The method further includes: An initial sequence is created when the network transmission information does not match the transmission information stored in each connection object; The network transmission information is written at the beginning of the initial sequence, and the message data is written after the beginning of the initial sequence to obtain the message data sequence of the target connection object.

3. The method according to claim 1, characterized in that, Determining the target transmission channel to which the target connection object belongs includes: Retrieve multiple currently created transmission channels, wherein each transmission channel contains multiple connection objects; The transmission channel containing the target connection object is designated as the target transmission channel.

4. The method according to claim 3, characterized in that, The method further includes: If the target connection object is not included in any of the transmission channels, obtain the last created transmission channel; Determine the number of objects connected to the last created transmission channel; If the number of objects does not reach the preset number, the target connection object is added to the last created transmission channel, and the last created transmission channel is used as the target transmission channel; or, if the number of objects reaches the preset number, the target transmission channel is created, and the target connection object is added to the target transmission channel.

5. The method according to claim 1, characterized in that, The step of transmitting the message data from the target connection object to the target transmission channel for encapsulation to obtain a target data frame with structured information includes: Transmit the message data in the target connection object to the target transmission channel; The message structure information and message content of the message data are detected through the target transmission channel. The target data frame is obtained by using the object identifier of the target connection object and the message structure information as the frame header and the message content as the frame content.

6. The method according to claim 1, characterized in that, Determining the transmission type corresponding to the target data frame includes: Parse the target data frame to obtain the target protocol type corresponding to the target data frame; Based on the mapping relationship between preset protocol types and transmission types, the transmission type corresponding to the target protocol type is determined.

7. A network packet processing apparatus, characterized in that, The device includes: The acquisition module is used to acquire network packets sent by the target client, wherein the target client is a client that has established a connection with the VPN client; The writing module is used to obtain a target connection object that matches the network packet, and write the packet data carried by the network packet into the target connection object; the writing module is used to obtain network transmission information carried by the network packet; match the network transmission information with the transmission information stored in multiple connection objects to obtain a target connection object that matches the network transmission information; obtain the packet data sequence in the target connection object, and write the packet data to the end of the packet data sequence; The processing module is used to determine the target transmission channel to which the target connection object belongs, and to transmit the message data in the target connection object to the target transmission channel for encapsulation to obtain a target data frame with structured information; An execution module is used to determine the transmission type corresponding to the target data frame and transmit the target data frame to the server according to the transmission type.

8. An electronic device, characterized in that, include: A memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, the processor executing the computer instructions to perform the method of any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing a computer to perform the method of any one of claims 1 to 6.

Images