Network tunnel jitter suppression method based on TCP protocol

Abstract

The invention discloses a method for inhibiting jitter of a network tunnel based on a TCP (Transmission Control Protocol), which comprises the following steps of: deploying a VPN (Virtual Private Network) protocol and installing a server and a client under the architecture of Client / Server; and connecting the client and the server through a dialing parameter negotiation process and a tunnel data transmission process by adopting a TCP (Transmission Control Protocol) so as to package, encrypt and transmit a data packet. On the basis of packaging, encrypting and transmitting an IP data packet in a TCP protocol format, a three-way handshake mechanism and a four-way handshake mechanism of the TCP are reserved, and acknowledgement, response and retransmission mechanisms and corresponding complex congestion control algorithms are removed; high-efficiency, high-reliability and low-delay jitter transmission of a network data packet is realized through an FEC forward error correction code on a self-defined VPN protocol, and the method has good Internet environment adaptability.

Description

Technical Field

[0001] The invention relates to a method for suppressing network jitter, and in particular to a method for suppressing jitter based on a TCP protocol network tunnel. Background Art

[0002] A virtual private network, or VPN, is a private network established on a public network for encrypted communication. It is widely used in corporate networks. VPN gateways enable remote access by encrypting data packets and converting the destination addresses of data packets. VPNs can be classified in many ways, mainly by protocol; VPNs can be implemented in many ways, such as servers, hardware, and software.

[0003] To allow employees of branch offices to access the intranet resources of the headquarters or data center, the VPN solution is to set up a VPN server in the headquarters intranet; let the branch office's gateway connect to the VPN server through the Internet and enter the headquarters intranet through the VPN server. In order to ensure data security, the data between the VPN server and the branch office gateway is encrypted. With data encryption, it can be considered that the data is securely transmitted on a dedicated data link, just like assuming a dedicated network; but in fact, VPN uses the public link on the Internet, so VPN is a virtual private network, which is essentially a data communication tunnel encapsulated on the public network using encryption technology.

[0004] Virtual Private Network (VPN) protocols and their software are usually encapsulated and transmitted based on UDP or TCP protocols. VPN tunnels based on UDP (User Datagram Protocol) are usually designed to meet specific needs, especially in delay-sensitive application scenarios, such as video streaming or online games; however, the UDP protocol itself has some limitations, including unreliability and inability to adapt to the existing Internet environment; unreliability means that UDP is a connectionless protocol, it does not guarantee the delivery of data packets, and there is no retransmission mechanism. Once a data packet is lost during network transmission, the receiving end will not receive the data packet; inability to adapt to the existing Internet environment means that when a VPN based on UDP is running on the Internet, it will be subject to local network communication policies and traffic control restrictions, making it impossible to establish a VPN connection normally or the network transmission quality is poor. Before rectification, VPN tunnels based on the TCP transmission control protocol had problems of high latency, increased latency in weak network environments, and low transmission efficiency; high latency means that in order to ensure the reliable transmission of data packets, TCP uses technologies such as three-way handshakes, confirmation responses, and retransmission mechanisms. Although this ensures data integrity, it also introduces additional network round-trip time, resulting in higher latency; TCP will retransmit lost data packets, which improves the reliability of data transmission, but in environments with poor network conditions or high packet loss rates, frequent retransmissions will increase network load and further increase latency; because TCP has complex congestion control algorithms, these algorithms help prevent network congestion, but at the same time may cause data transmission rates to slow down. In a high-load network environment, TCP's congestion control may reduce data transmission efficiency. Summary of the invention

[0005] In order to solve the deficiencies of the above technologies, the present invention provides a method for suppressing jitter based on a TCP protocol network tunnel.

[0006] In order to solve the above technical problems, the technical solution adopted by the present invention is: a method for suppressing jitter based on a TCP protocol network tunnel, comprising the following steps: Step S1: deploy the virtual private network VPN protocol under the Client / Server architecture and install the server and client; Step S2: Using the TCP protocol, the client and the server are connected through a dial-up parameter negotiation process to encapsulate, encrypt and transmit data packets; the dial-up parameter negotiation connects the client and the server, including the following steps: Step S21: The client initiates a TCP connection to the server based on the standard TCP three-way handshake mechanism; Step S22: The server accepts the new connection and establishes a connection with the client; Step S23: After the connection is established, the client and the server negotiate the Client ID; Step S24: After the client completes the verification, it sends the client RSA public key, the server records the client RSA public key, and sends the server RSA public key; Step S25: The client records the server's RSA public key and sends the symmetric encryption algorithm. The server generates and encrypts the symmetric encryption key with RSA. Step S26: The server sends the RSA encrypted key to the client, and the client decrypts and records the symmetric encryption key; Step S27: the client sends error correction algorithm parameters, i.e., redundant parameters, the server records the error correction algorithm parameters, and sends repeated error correction algorithm parameters to the client; Step S28: The client verifies the error correction algorithm parameters replied by the server, sends a request after verification, and obtains an IP address message and sends it to the server; Step S29: The client and the server negotiate tunnel network parameters; the tunnel network parameters include the client tunnel IP address, subnet mask and the server tunnel IP address; Step S210: The client creates a virtual network card for the local tunnel and starts the tunnel data transmission process to enable the FEC forward error correction code to perform data damage redundancy calculation to restore the original data and suppress jitter; Step S211: the client initiates a TCP disconnect to the server based on the standard TCP four-way handshake, and the server ends the TCP communication.

[0007] Furthermore, in step S23, the client id negotiation is performed between the client and the server, including the following steps: Step S23-1: The client sends a Client ID message, the server processes the Client ID message, and initializes the data structure of the Client ID message; Step S23-2: The server sends a duplicate Client id message, and the client verifies the Client id message replied by the server; that is, checks whether the Client id message sent by the server is the value sent by the client before.

[0008] Furthermore, in step S26, the client decrypts and records the symmetric encryption key, including the following steps: Step S26-1: The client sends the encryption type requested by the client to the server; Step S26-2: The server generates a 32-byte key, a 12-byte initialization vector, and 16-byte additional information by using a random string according to the encryption type required by the client, and uses the server's RSA private key to encrypt the 32-byte key, the 12-byte initialization vector, and the 16-byte additional information; Step S26-3: The server sends the encryption parameters of AES-GCM or SM4 after the server RSA encryption to the client; Step S26-4: The client uses the server's RSA public key to decrypt the key Key, the initial vector IV and the additional information AAD.

[0009] Furthermore, in step S28, the client verifies the error correction algorithm parameters replied by the server, including the following steps: Step S28-1: The client sends redundant parameters to the server; Step S28-2: The server records redundant parameters; Step S28-3: The server responds to the client to confirm the redundant parameters; Step S28-4: The client checks whether the redundant parameter sent by the server is a value that has been sent before.

[0010] Furthermore, in step S29, the client and the server negotiate tunnel network parameters, including the following steps: Step S29-1: The client sends a network parameter request instruction to the server; Step S29-2: The server allocates a client tunnel IP address, a subnet mask, and a server tunnel IP address, and encrypts the client tunnel IP address, the subnet mask, and the server tunnel IP address based on the server RSA private key; Step S29-3: The server sends the ciphertext of the tunnel network parameters to the client; Step S29-4: The client decrypts and records the client tunnel IP address, subnet mask and server tunnel IP address.

[0011] Furthermore, in step S210, the tunnel data transmission process adopts a custom encapsulated TCP data packet and interaction process to become 7xETP; the structure of 7xETP includes a TCP header, which occupies 20 bytes; a 7xETP plaintext protocol header, which occupies 8 bytes; 7xETP encrypted data, including a 7xETP ciphertext protocol header, which occupies 4 bytes and original IP packet data; the original IP packet data includes 7xETP FEC parameters, which occupy 11 bytes and FEC fragments of indefinite length.

[0012] Furthermore, the tunnel data transmission process, that is, the client and the server are the sender and the receiver, reading, encapsulating and transmitting the data, includes the following steps: Step S210-1: the sending end reads the tunnel network card data packet and encapsulates the data packet read from the tunnel network card; Step S210-2: Determine the FEC (forward error correction) code parameters according to the network quality, and judge whether the FEC parameters need to be sliced; if the FEC parameters need to be sliced, split them into several data slices according to the length of the encrypted data, generate redundant data slices according to the forward error correction algorithm, and symmetrically encrypt the encapsulated data slices; if FEC slices are not required, directly symmetrically encrypt the encapsulated data; Step S210-3: the sending end encapsulates the TCP data packet and sends the TCP data packets one by one through the raw socket; the receiving end receives the TCP data packet through the raw socket; Step S210-4: After receiving the TCP data packet, the receiving end decapsulates the TCP data packet, and then decrypts the encapsulated data, and determines whether it is an FEC fragment based on the decrypted protocol parameters; if the decrypted protocol parameters are FEC fragments, the original data packet group is restored according to the forward error correction algorithm, and finally decapsulated to obtain the original network card data packet; if the decrypted protocol parameters are not FEC fragments, the encapsulated data is directly decapsulated to obtain the original network card data packet, and written into the tunnel network card data packet.

[0013] Further, after the sender reads data from the Linux virtual network card in step S210-1, the format of the data after encapsulation includes the magic number Magic Word of 2 bytes, i.e. 16 bits, which is fixedly set to "7x" to identify the characteristics of this protocol; the total length, i.e. the length of all data sent at one time, is 2 bytes, i.e. 16 bits; the local tunnel IP address, i.e. LocalTunnel IP, is 4 bytes, i.e. 32 bits, and the client tunnel IP address is obtained from the server during the negotiation process, and the server tunnel IP address is specified by the configuration file; the ciphertext Ciphertext is greater than the total length and less than 8 bytes, i.e. 64 bits, and the plaintext structure is encrypted by the encryption method negotiated between the client and the server, i.e. AES / SM4, and the key, initial vector and additional information in the encryption parameters; The plaintext format before encrypting the plaintext structure includes the message type Type, which is half a byte, i.e. 4 bits; the message header Header is 1 and a half byte, i.e. 12 bits, of which 1 bit indicates whether the current data packet is an FEC fragment, and the remaining bits are filled with 0 to represent a reserved field; the data length Date Length is 2 bytes, i.e. 16 bits, which is the length of the data content; the data content is variable in length. If FEC is not enabled, the data content is a standard IP data packet, i.e. the user IP length; if FEC is enabled and redundancy calculation is performed, the Reed Solomom algorithm is enabled to fragment the original data, and redundant data fragments are calculated based on the original fragments. The fragmented data is encrypted using the AES / SM4 encryption algorithm for each fragment, and then encapsulated again and sent to the peer end.

[0014] Furthermore, after FEC is turned on, the format of re-encapsulating the fragmented data includes a data packet sequence PacketSequence of 4 bytes, i.e. 42 bits, which is used to identify the historical group of fragments of the current data bit; the number of original fragments Number of Original Fragment is 1 byte, i.e. 8 bits, which is the number of original fragments in the current group of fragments; the total number of fragments is 1 byte, i.e. 8 bits, which is the total number of fragments in the current group of fragments, then the number of redundant fragments = the total number of fragments - the number of original fragments; the current fragment sequence Fragment Sequence is 1 byte, i.e. 8 bits, which is the sequence of the current fragment in the current group of fragments; the fragment data Fragment Size length is 2 bytes, i.e. 16 bits, which indicates the standard length of each fragment; the original data payload length Original Payload Length is 2 bytes, i.e. 16 bits, which is equal to the original data length restored by any original fragment of the current group; the fragment content is of variable length, depending on the data length of the fragment.

[0015] Furthermore, calculating redundant data fragments includes the following steps: Step B1: Read K IP packets from the virtual network card; Step B2: concatenate K IP packets into a whole segment of data; Step B3: Divide the entire data segment into K segments, i.e., K shards; Step B4: Calculate N redundant fragments by using the Reed Solomon algorithm; wherein the total number of fragments of the current packet is K+N.

[0016] The present invention discloses a method for suppressing jitter based on TCP protocol network tunnel. By encapsulating, encrypting and transmitting IP data packets in TCP protocol format, the three-way handshake and four-way handshake mechanisms of TCP are retained, and the confirmation response, retransmission mechanism and corresponding complex congestion control algorithm are removed. The high-efficiency, high-reliability and low-delay jitter transmission of network data packets is achieved through FEC forward error correction code on a custom VPN protocol, and the method has good adaptability to the Internet environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a flow chart of the interaction process between the client and the server in the present invention.

[0018] Figure 2 It is a structural diagram of the TCP protocol adopted in the present invention.

[0019] Figure 3 It is a schematic diagram of the TCP three-way handshake mechanism in the present invention.

[0020] Figure 4 It is a schematic diagram of the TCP four-way handshake mechanism in the present invention.

[0021] Figure 5 It is a flow chart of the tunnel data transmission process in the present invention.

[0022] Figure 6 This is a diagram of the data encapsulation structure read by the sending end in the present invention.

[0023] Figure 7 This is a plaintext structure diagram before encryption in the present invention.

[0024] Figure 8 This is a structural diagram of FEC encapsulation data in the present invention.

[0025] Fig. 9 This is a structural diagram of the 7xETP protocol in the present invention. DETAILED DESCRIPTION

[0026] The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments.

[0027] The method for suppressing jitter based on TCP protocol network tunnel includes the following steps: Step S1: deploy the virtual private network VPN protocol under the Client / Server architecture and install the server and client; Step S2: Using the TCP protocol, the client and the server are connected through a dial-up parameter negotiation process to encapsulate, encrypt and transmit data packets; the dial-up parameter negotiation connects the client and the server, including the following steps: Step S21: The client initiates a TCP connection to the server based on the standard TCP three-way handshake mechanism; Step S22: The server accepts the new connection and establishes a connection with the client; Step S23: After the connection is established, the client and the server negotiate the Client ID; Step S24: After the client completes the verification, it sends the client RSA public key, the server records the client RSA public key, and sends the server RSA public key; Step S25: The client records the server's RSA public key and sends the symmetric encryption algorithm. The server generates and encrypts the symmetric encryption key with RSA. Step S26: The server sends the RSA encrypted key to the client, and the client decrypts and records the symmetric encryption key; Step S27: the client sends error correction algorithm parameters, i.e., redundant parameters, the server records the error correction algorithm parameters, and sends repeated error correction algorithm parameters to the client; Step S28: The client verifies the error correction algorithm parameters replied by the server, sends a request after verification, and obtains an IP address message and sends it to the server; Step S29: The client and the server negotiate tunnel network parameters; the tunnel network parameters include the client tunnel IP address, subnet mask and the server tunnel IP address; Step S210: The client creates a virtual network card for the local tunnel and starts the tunnel data transmission process to enable the FEC forward error correction code to perform data damage redundancy calculation to restore the original data and suppress jitter; Step S211: the client initiates a TCP disconnect to the server based on the standard TCP four-way handshake, and the server ends the TCP communication.

[0028] Specifically, in step S23, the client ID negotiation between the client and the server includes the following steps: Step S23-1: The client sends a Client ID message, the server processes the Client ID message, and initializes the data structure of the Client ID message; Step S23-2: The server sends a duplicate Client id message, and the client verifies the Client id message replied by the server; that is, checks whether the Client id message sent by the server is the value sent by the client before.

[0029] In step S26, the client decrypts and records the symmetric encryption key, including the following steps: Step S26-1: The client sends the encryption type requested by the client to the server; Step S26-2: The server generates a 32-byte key, a 12-byte initialization vector, and 16-byte additional information by using a random string according to the encryption type required by the client, and uses the server's RSA private key to encrypt the 32-byte key, the 12-byte initialization vector, and the 16-byte additional information; Step S26-3: The server sends the encryption parameters of AES-GCM or SM4 after the server RSA encryption to the client; Step S26-4: The client uses the server's RSA public key to decrypt the key Key, the initial vector IV and the additional information AAD.

[0030] In step S28, the client verifies the error correction algorithm parameters replied by the server, including the following steps: Step S28-1: The client sends redundant parameters to the server; Step S28-2: The server records redundant parameters; Step S28-3: The server responds to the client to confirm the redundant parameters; Step S28-4: The client checks whether the redundant parameter sent by the server is a value that has been sent before.

[0031] Furthermore, in step S29, the client and the server negotiate tunnel network parameters, including the following steps: Step S29-1: The client sends a network parameter request instruction to the server; Step S29-2: The server allocates a client tunnel IP address, a subnet mask, and a server tunnel IP address, and encrypts the client tunnel IP address, the subnet mask, and the server tunnel IP address based on the server RSA private key; Step S29-3: The server sends the ciphertext of the tunnel network parameters to the client; Step S29-4: The client decrypts and records the client tunnel IP address, subnet mask and server tunnel IP address.

[0032] In step S210, the tunnel data transmission process adopts a custom encapsulated TCP data packet and an interactive process, which becomes 7xETP; the structure of 7xETP includes a TCP header, which occupies 20 bytes; a 7xETP plaintext protocol header, which occupies 8 bytes; 7xETP encrypted data, including a 7xETP ciphertext protocol header, which occupies 4 bytes and original IP packet data; the original IP packet data includes the FEC parameters of 7xETP, which occupies 11 bytes and FEC fragments of indefinite length.

[0033] The tunnel data transmission process, that is, the client and the server are the sender and the receiver, read, encapsulate and transmit the data, including the following steps: Step S210-1: the sending end reads the tunnel network card data packet and encapsulates the data packet read from the tunnel network card; Step S210-2: Determine the FEC (forward error correction) code parameters according to the network quality, and judge whether the FEC parameters need to be sliced; if the FEC parameters need to be sliced, split them into several data slices according to the length of the encrypted data, generate redundant data slices according to the forward error correction algorithm, and symmetrically encrypt the encapsulated data slices; if FEC slices are not required, directly symmetrically encrypt the encapsulated data; Step S210-3: the sending end encapsulates the TCP data packet and sends the TCP data packets one by one through the raw socket; the receiving end receives the TCP data packet through the raw socket; Step S210-4: After receiving the TCP data packet, the receiving end decapsulates the TCP data packet, and then decrypts the encapsulated data, and determines whether it is an FEC fragment based on the decrypted protocol parameters; if the decrypted protocol parameters are FEC fragments, the original data packet group is restored according to the forward error correction algorithm, and finally decapsulated to obtain the original network card data packet; if the decrypted protocol parameters are not FEC fragments, the encapsulated data is directly decapsulated to obtain the original network card data packet, and written into the tunnel network card data packet.

[0034] In step S210-1, after the sender reads data from the Linux virtual network card, the format of the data after encapsulation includes the magic number Magic Word, which is 2 bytes, i.e., 16 bits, and is fixedly set to "7x" to identify the characteristics of this protocol; the total length TotalLength, i.e., the length of all data sent at one time, is 2 bytes, i.e., 16 bits; the local tunnel IP address, i.e., the Local Tunnel IP, is 4 bytes, i.e., 32 bits, and the client tunnel IP address is obtained from the server during the negotiation process, and the server tunnel IP address is specified by the configuration file; the ciphertext Ciphertext is greater than the total length and less than 8 bytes, i.e., 64 bits, and the plaintext structure is encrypted by the encryption method negotiated between the client and the server, i.e., AES / SM4, and the key, initial vector, and additional information in the encryption parameters; The plaintext format before encrypting the plaintext structure includes the message type Type, which is half a byte, i.e. 4 bits; the message header Header is 1 and a half byte, i.e. 12 bits, of which 1 bit indicates whether the current data packet is an FEC fragment, and the remaining bits are filled with 0 to represent a reserved field; the data length Date Length is 2 bytes, i.e. 16 bits, which is the length of the data content; the data content is variable in length. If FEC is not enabled, the data content is a standard IP data packet, i.e. the user IP length; if FEC is enabled and redundancy calculation is performed, the Reed Solomom algorithm is enabled to fragment the original data, and redundant data fragments are calculated based on the original fragments. The fragmented data is encrypted using the AES / SM4 encryption algorithm for each fragment, and then encapsulated again and sent to the peer end.

[0035] After FEC is turned on, the format of re-encapsulating the fragmented data includes the packet sequence Packet Sequence of 4 bytes, i.e. 42 bits, which is used to identify the historical fragment number of the current data bit; the number of original fragments Number of Original Fragment is 1 byte, i.e. 8 bits, which is the number of original fragments in the current group of fragments; the total number of fragments is 1 byte, i.e. 8 bits, which is the total number of fragments in the current group of fragments, then the number of redundant fragments = the total number of fragments - the number of original fragments; the current fragment sequence Fragment Sequence is 1 byte, i.e. 8 bits, which is the sequence of the current fragment in the current group of fragments; the fragment data Fragment Size length is 2 bytes, i.e. 16 bits, which indicates the standard length of each fragment; the original data payload length Original Payload Length is 2 bytes, i.e. 16 bits, which is equal to the original data length restored by any original fragment of the current packet; the fragment content is of variable length, depending on the data length of the fragment.

[0036] Calculating redundant data shards includes the following steps: Step B1: Read K IP packets from the virtual network card; Step B2: concatenate K IP packets into a whole segment of data; Step B3: Divide the entire data segment into K segments, i.e., K shards; Step B4: Calculate N redundant fragments by using the Reed Solomon algorithm; wherein the total number of fragments of the current packet is K+N.

[0037] This embodiment provides a method for suppressing jitter based on a TCP protocol network tunnel, and provides a connection between an enterprise headquarters and a branch office, so that employees of the branch office can access the intranet resources of the headquarters or data center.

[0038] In the Client / Server architecture, the CPE equipment at the corporate headquarters is installed with server software, and the CPE equipment at the branch offices is installed with client software. No PC client or mobile phone or tablet APP is provided. The server software can monitor a TCP port through a normal socket for the VPN dial-up process and parameter negotiation, and the interaction with the client complies with the standard TCP protocol; it reads and writes data segments of a specific TCP port through a raw socket for the VPN data transmission process. This TCP port is used for special processing and cannot be monitored by calling the system listen.

[0039] The specific deployment includes: the client operating environment is set to the Linux operating system of CentOS or Ubuntu distribution; the dependent libraries are ibuuid, pcre, libuv, OpenSSL, OpenFEC, libconfig++, and log4cpp; it is recommended to copy the package content to the / usr / local / abyss-client directory; among them, abyss-client is the executable file, config is the configuration file directory, abyss-client.conf is the main configuration file, log4cpp.conf is the log configuration file; log is the log file directory.

[0040] The server's operating environment is set to the Linux operating system of CentOS or Ubuntu distribution; the dependent libraries are libuuid, pcre, libuv, OpenSSL, OpenFEC, libconfig++, and log4cpp; it is recommended to copy the package content to the / usr / local / abyss-server directory; where abyss-server: executable file, config is the configuration file directory, abyss-server.conf is the main configuration file; log4cpp.conf is the log configuration file; log is the log file directory.

[0041] Using TCP protocol, the client and server are connected through the dial-up parameter negotiation process; the dial-up parameter negotiation process enables the server to record client-related information for subsequent data forwarding; the client and server exchange RSA encryption keys; the client and server negotiate AES / SM4 encryption keys; the client and server negotiate the necessary parameters of the FEC algorithm; and the server assigns an IP address to the client. The client and server are connected through the dial-up parameter negotiation process, such as Figure 1 The flowchart of the client-server interaction process in the method for suppressing jitter based on TCP protocol network tunnel is shown, which includes the following steps: Step A1: The client initiates a TCP connection to the server based on the standard TCP three-way handshake; Figure 2As shown in the structure diagram of the TCP protocol used in the method of suppressing jitter based on the TCP protocol network tunnel, in this process, the structure of the TCP protocol used is that the message type Type is 1 byte, that is, 8 bits; the message length Length is 4 bytes, that is, 32 bits, which describes the length of the message content that needs to be read later; the message content Body varies according to different message types. When the Type value in the message type is 0x01, the message type is to notify the Client ID; when the Type value in the message type is 0x02, the message type is to exchange the RSA encryption public key; when the Type value in the message type is 0x03, the SM4 encryption key is exchanged; when the Type value in the message type is 0x04, the message type is error correction configuration information; when the Type value in the message type is 0x05, the message type is to distribute IP addresses.

[0042] Step A2: The server accepts the new connection and the client connection is established; Step A3: After the connection is established, the client and the server negotiate the Client ID; Step A31: The client sends a Client ID message, the server processes the Client ID message, and initializes the data structure of the Client ID message; Step A32: The server sends a duplicate Client ID message, and the client verifies the Client ID message replied by the server, that is, verifies whether the Client ID message sent by the server is the value sent by the client before; Step A4: After the client completes the verification, it sends the client RSA public key, the server records the client RSA public key, and sends the server RSA public key; Step A5: The client records the server's RSA public key and sends the symmetric encryption algorithm. The server generates and encrypts the symmetric encryption key with RSA. Step A6: The server sends the RSA encrypted key to the client, and the client decrypts and records the symmetric encryption key; Step A61: The client sends the encryption type requested by the client to the server; 0x01 is AES-GCM, 0x02 is SM4; Step A62: The server generates a 32-byte key, a 12-byte initialization vector, and 16-byte additional information by using a random string according to the encryption type required by the client, and uses the server's RSA private key to encrypt the 32-byte key, the 12-byte initialization vector, and the 16-byte additional information; Step A63: The server sends the encryption parameters of AES-GCM or SM4 encrypted by RSA of the server to the client; Step A64: The client uses the server's RSA public key to decrypt the key Key, the initial vector IV and the additional information AAD.

[0043] Step A7: the client sends error correction algorithm parameters, i.e., redundant parameters, the server records the error correction algorithm parameters, and sends repeated error correction algorithm parameters to the client; Step A8: The client verifies the error correction algorithm parameters replied by the server, sends a request after verification, and obtains an IP address message and sends it to the server; Step A81: The client sends redundant parameters to the server; 1 byte for FEC mode to be changed. 0x00 means forcibly turning off FEC. 0x01 means adjusting FEC parameters according to network quality. 0x02 means forcibly turning on FEC. The number of original packets is 5 and the number of redundant packets is 1. Step A82: The server records redundant parameters; Step A83: The server responds to the client to confirm the redundant parameters; Step A84: The client checks whether the redundant parameter sent by the server is the value that has been sent before.

[0044] Step A9: The client and the server negotiate tunnel network parameters; the tunnel network parameters include the client tunnel IP address, subnet mask and the server tunnel IP address; Step A91: The client sends a network parameter request instruction to the server; Step A92: The server allocates a client tunnel IP address, a subnet mask, and a server tunnel IP address, and encrypts the client tunnel IP address, the subnet mask, and the server tunnel IP address based on the server RSA private key; Step A93: The server sends the ciphertext of the tunnel network parameters to the client; Step A94: The client decrypts and records the client tunnel IP address, subnet mask, and server tunnel IP address Step A10: The client creates a virtual network card for the local tunnel and starts the tunnel data transmission process; The client configures tunnel network parameters based on the virtual network card of the Linux tun driver.

[0045] The tunnel data transmission process uses custom encapsulated TCP packets and interactive processes, known as 7xETP; Fig. 9As shown in the structural diagram of the 7xETP protocol in the method for suppressing jitter based on the TCP protocol network tunnel, the complete structure of 7xETP includes a TCP header of 20 bytes; a 7xETP plaintext protocol header of 8 bytes; 7xETP encrypted data of variable length; 7xETP encrypted data includes a 7xETP ciphertext protocol header of 4 bytes, and original IP packet data of variable length; original IP packet data includes 7xETP FEC parameters of 11 bytes, and FEC fragments of variable length.

[0046] The tunnel data transmission process is a composite protocol from the transport layer to the application layer. The protocol structure of the transport layer retains the structure of the TCP protocol header unchanged; the three-way handshake mechanism of the standard TCP protocol is retained and independently implemented, so that the intermediate network devices in the network transmission process, mainly firewalls, can correctly establish sessions and ensure that data communication can proceed normally; the four-wave mechanism of the standard TCP protocol is retained and independently implemented, so that the intermediate network devices in the network transmission process, mainly firewalls, can correctly destroy conversations and avoid unexpected failures of intermediate devices; the TCP confirmation response is retained, which can circumvent the detection mechanism of the intermediate network devices and avoid the intermediate devices actively discarding data packets because they think that the receiving windows at both ends are full; at the same time, no timeout detection is performed on the TCP confirmation response, the timeout retransmission mechanism is canceled, and the forward error correction code is enabled as an error correction means in the TCP data part, and the original data packet is restored through data damage redundancy calculation instead of the retransmission mechanism; the TCP sliding window mechanism and the corresponding congestion mechanism are also canceled.

[0047] like Figure 3 As shown in the schematic diagram of the TCP three-way handshake mechanism in the method for suppressing jitter based on the TCP protocol network tunnel, the three-way handshake mechanism of the standard TCP protocol includes: in the initial state, both the client and the server are in the CLOSED closed state; the client is destined to open the connection, and the server is passively opened.

[0048] The first handshake is when the client establishes a transmission control block TCB, and is always ready to accept the client process's connection request. At this time, the server enters the LISTEN listening state, and sets the TCP message flag SYN to 1, randomly generates a sequence number value seq=x, and saves it in the sequence number (Sequence Number) field of the TCP header, indicating the port of the server that the client intends to connect to. The server establishes a passive TCB open and sends the data packet to the server. After sending, the client enters the SYN_SENT state and waits for confirmation from the server. The second handshake is when the server receives the data packet and knows that the client requests to establish a connection from the flag SYN=1. The server sets the TCP message flags SYN and ACK to 1, ack=x+1, randomly generates a sequence number value seq=y, and sends the data packet to the client to confirm the connection request. The server enters the SYN_RCVD state.

[0049] The third handshake is that after the client receives the confirmation, it checks whether ack is x+1 and ACK is 1. If correct, the flag ACK is set to 1, ack=y+1, and the data packet is sent to the server. The server checks whether ack is y+1, ACK is 1, and seq=x+1. If correct, the connection is successfully established, the client and server enter the ESTABLISHED state, and the three-way handshake is completed. Then the client and server can start transmitting data.

[0050] like Figure 4 As shown in the schematic diagram of the TCP four-way handshake mechanism in the method of suppressing jitter based on the TCP protocol network tunnel, the standard TCP protocol four-way handshake mechanism includes: after the data transmission is completed, both parties can release the connection; initially, the client and the server are in the ESTABLISHED state, the client actively closes, and the server passively closes; The first wave is for the client to send a connection release message and stop sending data. The release data message header, FIN=1, its sequence number is seq=u, that is, the sequence number of the last byte of the previously transmitted data plus 1. At this time, the client enters the FIN-WAIT-1 state, that is, the termination wait 1 state.

[0051] The second wave is when the server receives the connection release message and sends a confirmation message, ACK=1, ack=u+1, and carries its own sequence number seq=v. At this time, the server enters the CLOSE-WAIT closing waiting state.

[0052] After the third wave, the client receives the confirmation request from the server. The client will enter the FIN-WAIT-2 state, waiting for the server to send a connection release message. After the server sends the last data, it sends a connection release message to the client. The server enters the LAST-ACK state, waiting for the client's confirmation.

[0053] The fourth wave is when the client receives the connection release message from the server and must send a confirmation, ACK=1, ack=w+1, and its own column number is seq=u+1. At this time, the client enters the TIME-WAIT state, but the TCP connection has not been terminated yet. It must be after 2MSL, which is the long message life. When the client revokes the corresponding TCB, the client will enter the CLOSED state. After receiving the confirmation message, the server will immediately enter the CLOSED state. At this point, the TCP connection is disconnected, and the four waves are completed.

[0054] like Figure 5 As shown in the flowchart of the tunnel data transmission process in the method for suppressing jitter based on the TCP protocol network tunnel, the tunnel data transmission process, disguised as TCP format can help customers bypass UDP shielding, the client and the server are the sender and the receiver, and read, encapsulate and transmit the data, including the following steps: Step A101: The sending end reads the tunnel network card data packet and encapsulates the data packet read from the tunnel network card; Figure 6 As shown in the data encapsulation structure diagram read by the sender in the method of suppressing jitter in the TCP protocol network tunnel, after the sender reads the data from the Linux virtual network card, the structure of the data after encapsulation includes: the magic number Magic Word is 2 bytes, that is, 16 bits, and is fixedly set to "7x" to identify the characteristics of this protocol; the total length Total Length, that is, the length of all data sent at one time is 2 bytes, that is, 16 bits; the local tunnel IP address, that is, the Local Tunnel IP, is 4 bytes, that is, 32 bits, and the client tunnel IP address is obtained from the server during the negotiation process. The server tunnel IP address is specified by the configuration file; the ciphertext Ciphertext is greater than the total length and less than 8 bytes, that is, 64 bits, and the plaintext structure is encrypted by the encryption method negotiated by the client and the server, that is, AES / SM4, and the key, initial vector and additional information in the encryption parameters; like Figure 7As shown in the plaintext structure diagram before encryption in the method for suppressing jitter in a TCP protocol network tunnel, the plaintext format before encryption of the plaintext structure includes the message type Type is half a byte, that is, 4 bits. When the Type value is 0x06, the message type is payload content payload; when the Type value is 0x07, the message type is heartbeat HB Echo; when the Type value is 0x08, the message type is heartbeat response HB Echo Reply; the message header Header is 1 half byte, that is, 12 bits, of which 1 bit is whether the current data packet is FEC fragmentation, and the remaining bits are filled with 0 to represent the reserved field; the data length Date Length is 2 bytes, that is, 16 bits, which is the length of the data content; the data content is variable in length. If FEC is not enabled, the data content is a standard IP packet, that is, the user IP length; if FEC is enabled and redundancy calculation is performed, Reed is enabled The Solomom algorithm fragments the original data and calculates redundant fragments based on the original fragments. It encrypts the fragmented data using the AES / SM4 encryption algorithm for each fragment, encapsulates it again, and sends it to the peer end.

[0055] Step A102: Determine the FEC (forward error correction) code parameters according to the network quality, and judge whether the FEC parameters need to be sliced; if the FEC parameters need to be sliced, split them into several data slices according to the length of the encrypted data, generate redundant data slices according to the forward error correction algorithm, and symmetrically encrypt the encapsulated data slices; if FEC slices are not required, directly symmetrically encrypt the encapsulated data; Figure 8 As shown in the structure diagram of FEC encapsulated data in the method for suppressing jitter in a TCP protocol network tunnel, the structure of the data after FEC encapsulation includes: a packet sequence Packet Sequence of 4 bytes, i.e., 32 bits, which is used to identify the historical group of fragments of the current data bit; the number of original fragments Number of Original Fragment is 1 byte, i.e., 8 bits, which is the number of original fragments in the current group of fragments; the total number of fragments is 1 byte, i.e., 8 bits, which is the total number of fragments in the current group of fragments, then the number of redundant fragments = the total number of fragments - the number of original fragments; the current fragment sequence FragmentSequence is 1 byte, i.e., 8 bits, which is the sequence of the current fragment in the current group of fragments; the length of the fragment data FragmentSize is 2 bytes, i.e., 16 bits, which indicates the standard length of each fragment; the original data load length OriginalPayload Length is 2 bytes, i.e., 16 bits, which is the original data length restored by any original fragment of the current group; the fragment content is of indefinite length, depending on the data length of the fragment.

[0056] The calculation of redundant shards includes the following steps: Step B1: Read K IP packets from the virtual network card; Step B2: concatenate K IP packets into a whole data segment, the format of which is the length of IP packet No. 1 (2 Byte) + the content of IP packet No. 1 + the length of IP packet No. 2 (2 Byte) + the content of IP packet No. 2 + ... + the length of IP packet No. K (2 Byte) + the content of IP packet No. K; Step B3: Divide the entire data segment into K segments, i.e., K shards; Step B4: Calculate N redundant fragments by using the Reed Solomon algorithm; wherein the total number of fragments of the current packet is K+N.

[0057] By setting a redundancy algorithm, during network transmission, when the number of consecutive packet losses is less than or equal to N, the original data can still be decrypted; the theoretical packet loss resistance rate is calculated to be N / (K+N)*100%, and there is no need for an ARQ-like mechanism to confirm the response, which will not increase the data transmission delay.

[0058] The original data restored from any original shard of the current group includes the following steps: Step C1: accept the fragment, and the current group will temporarily store the fragment; Step C2: When the number of any fragments in the current group is greater than or equal to K, the original data can be solved by the Reed Solomon algorithm.

[0059] Step A103: the sending end encapsulates the TCP data packet and sends the TCP data packets one by one through the raw socket; the receiving end receives the TCP data packet through the raw socket; Step A104: After receiving the TCP data packet, the receiving end decapsulates the TCP data packet, and then decrypts the encapsulated data, and determines whether it is an FEC fragment based on the decrypted protocol parameters; if the decrypted protocol parameters are FEC fragments, the original data packet group is restored according to the forward error correction algorithm, and finally decapsulated to obtain the original network card data packet; if the decrypted protocol parameters are not FEC fragments, the encapsulated data is directly decapsulated to obtain the original network card data packet, and written into the tunnel network card data packet.

[0060] Step A11: The client initiates a TCP disconnect to the server based on the standard TCP four-way handshake, and the server ends the TCP communication.

[0061] By encapsulating, encrypting and transmitting IP data packets in the TCP protocol format, the TCP three-way handshake and four-way handshake mechanisms are retained, the confirmation response, retransmission mechanism and the corresponding complex congestion control algorithm are removed, and the FEC forward error correction code is used on the customized VPN protocol to achieve high-efficiency, high-reliability and low-latency jitter transmission of network data packets, and it has good adaptability to the Internet environment.

[0062] High security means that the parameter negotiation process is encrypted through asymmetric encryption algorithms, namely RSA and SM2, and network data packets are encapsulated, encrypted and transmitted through symmetric encryption algorithms, namely AES and SM4. Ensure compliance with international and domestic requirements for secure transmission of network data packets; Good adaptability to the Internet environment means that given the widespread use of the TCP protocol in other applications, it is less restricted by local network communication policies and traffic control and has good adaptability to the network environment.

[0063] Low-latency jitter refers to avoiding the extra network round trip time in a packet loss environment by removing the TCP protocol's confirmation response, retransmission mechanism, and corresponding complex congestion control algorithm, achieving low-latency jitter comparable to that of the UDP protocol.

[0064] High reliability means that by introducing FEC (forward error correction code) at the application layer, limited redundant calculation and group transmission of a group of network data packets can be achieved in a packet loss environment, thus achieving high reliability of data packet transmission.

[0065] The above implementation modes are not limitations of the present invention, and the present invention is not limited to the above examples. Changes, modifications, additions or substitutions made by technicians in this technical field within the scope of the technical solution of the present invention also belong to the protection scope of the present invention.

Claims

1. Method for suppressing jitter in TCP protocol network tunnel. It is characterized in that The following steps are involved: Step S1: deploy the virtual private network VPN protocol under the Client / Server architecture and install the server and client; Step S2: Using the TCP protocol, the client and the server are connected through a dial-up parameter negotiation process to encapsulate, encrypt and transmit data packets; The dial-up parameter negotiation connects the client and the server, including the following steps: Step S21: The client initiates a TCP connection to the server based on the standard TCP three-way handshake mechanism; Step S22: The server accepts the new connection and establishes a connection with the client; Step S23: After the connection is established, the client and the server negotiate the Client ID; Step S24: After the client completes the verification, it sends the client RSA public key, the server records the client RSA public key, and sends the server RSA public key; Step S25: The client records the server's RSA public key and sends the symmetric encryption algorithm. The server generates and encrypts the symmetric encryption key with RSA. Step S26: The server sends the RSA encrypted key to the client, and the client decrypts and records the symmetric encryption key; Step S27: the client sends error correction algorithm parameters, i.e., redundant parameters, the server records the error correction algorithm parameters, and sends repeated error correction algorithm parameters to the client; Step S28: The client verifies the error correction algorithm parameters replied by the server, sends a request after verification, and obtains an IP address message and sends it to the server; Step S29: The client and the server negotiate tunnel network parameters; the tunnel network parameters include the client tunnel IP address, subnet mask and the server tunnel IP address; Step S210: The client creates a virtual network card for the local tunnel and starts the tunnel data transmission process to enable the FEC forward error correction code to perform data damage redundancy calculation to restore the original data and suppress jitter; Step S211: the client initiates a TCP disconnect to the server based on the standard TCP four-way handshake, and the server ends the TCP communication.

2. The method for suppressing jitter based on TCP protocol network tunnel according to claim 1, Features: In step S23, the client and the server perform Client ID negotiation, including the following steps: Step S23-1: The client sends a Client id message, the server processes the Client id message, and initializes the data structure of the Client id message; Step S23-2: The server sends a duplicate Client id message, and the client verifies the Client id message replied by the server; that is, checks whether the Client id message sent by the server is the value sent by the client before.

3. The method for suppressing jitter based on TCP protocol network tunnel according to claim 1, Features: In step S26, the client decrypts and records the symmetric encryption key, including the following steps: Step S26-1: The client sends the encryption type requested by the client to the server; Step S26-2: The server generates a 32-byte key, a 12-byte initialization vector, and 16-byte additional information by using a random string according to the encryption type required by the client, and uses the server's RSA private key to encrypt the 32-byte key, the 12-byte initialization vector, and the 16-byte additional information; Step S26-3: The server sends the encryption parameters of AES-GCM or SM4 after the server RSA encryption to the client; Step S26-4: The client uses the server's RSA public key to decrypt the key Key, the initial vector IV and the additional information AAD.

4. The method for suppressing jitter based on TCP protocol network tunnel according to claim 1, Features: In step S28, the client verifies the error correction algorithm parameters replied by the server, including the following steps: Step S28-1: The client sends redundant parameters to the server; Step S28-2: The server records redundant parameters; Step S28-3: The server responds to the client to confirm the redundant parameters; Step S28-4: The client checks whether the redundant parameter sent by the server is a value that has been sent before.

5. The method for suppressing jitter based on TCP protocol network tunnel according to claim 1, Features: In step S29, the client and the server negotiate tunnel network parameters, including the following steps: Step S29-1: The client sends a network parameter request instruction to the server; Step S29-2: The server allocates a client tunnel IP address, a subnet mask, and a server tunnel IP address, and encrypts the client tunnel IP address, the subnet mask, and the server tunnel IP address based on the server RSA private key; Step S29-3: The server sends the ciphertext of the tunnel network parameters to the client; Step S29-4: The client decrypts and records the client tunnel IP address, subnet mask and server tunnel IP address.

6. The method for suppressing jitter based on TCP protocol network tunnel according to claim 1, Features: The tunnel data transmission process in step S210 uses a custom encapsulated TCP data packet and an interactive process to become 7xETP; the structure of 7xETP includes a TCP header, which occupies 20 bytes; 7xETP plaintext protocol header, occupies 8 bytes; 7xETP encrypted data, including 7xETP ciphertext protocol header, occupies 4 bytes and original IP packet data; original IP packet data includes 7xETP FEC parameters, occupies 11 bytes and FEC fragments of indefinite length.

7. The method for suppressing jitter based on TCP protocol network tunnel according to claim 6, Features: The tunnel data transmission process, that is, the client and the server are the sending end and the receiving end respectively, reads, encapsulates and transmits the data, includes the following steps: Step S210-1: The sending end reads the tunnel network card data packet and encapsulates the data packet read from the tunnel network card; Step S210-2: Determine the FEC (forward error correction) code parameters according to the network quality, and judge whether the FEC parameters need to be sliced; if the FEC parameters need to be sliced, split them into several data slices according to the length of the encrypted data, generate redundant data slices according to the forward error correction algorithm, and symmetrically encrypt the encapsulated data slices; if FEC slices are not required, directly symmetrically encrypt the encapsulated data; Step S210-3: the sending end encapsulates the TCP data packet and sends the TCP data packets one by one through the raw socket; the receiving end receives the TCP data packet through the raw socket; Step S210-4: After receiving the TCP data packet, the receiving end decapsulates the TCP data packet, and then decrypts the encapsulated data, and determines whether it is an FEC fragment based on the decrypted protocol parameters; if the decrypted protocol parameters are FEC fragments, the original data packet group is restored according to the forward error correction algorithm, and finally decapsulated to obtain the original network card data packet; if the decrypted protocol parameters are not FEC fragments, the encapsulated data is directly decapsulated to obtain the original network card data packet, and written into the tunnel network card data packet.

8. The method for suppressing jitter based on TCP protocol network tunnel according to claim 7, Features: In step S210-1, after the sender reads data from the Linux virtual network card, the format of the data after encapsulation includes the magic number MagicWord of 2 bytes, i.e., 16 bits, which is fixedly set to "7x" to identify the characteristics of this protocol; the total length, i.e., the length of all data sent at one time, is 2 bytes, i.e., 16 bits; the local tunnel IP address, i.e., the Local Tunnel IP, is 4 bytes, i.e., 32 bits, and the client tunnel IP address is obtained from the server during the negotiation process, and the server tunnel IP address is specified by the configuration file; the ciphertext Ciphertext is greater than the total length and less than 8 bytes, i.e., 64 bits, and the plaintext structure is encrypted by the encryption method negotiated between the client and the server, i.e., AES / SM4, and the key, initial vector, and additional information in the encryption parameters; The plaintext format before encrypting the plaintext structure includes the message type Type, which is half a byte, i.e. 4 bits; the message header Header is 1 and a half byte, i.e. 12 bits, of which 1 bit indicates whether the current data packet is an FEC fragment, and the remaining bits are filled with 0 to represent a reserved field; the data length Date Length is 2 bytes, i.e. 16 bits, which is the length of the data content; the data content is variable in length. If FEC is not enabled, the data content is a standard IP data packet, i.e. the user IP length; if FEC is enabled and redundancy calculation is performed, the Reed Solomom algorithm is enabled to fragment the original data, and redundant data fragments are calculated based on the original fragments. The fragmented data is encrypted using the AES / SM4 encryption algorithm for each fragment, and then encapsulated again and sent to the peer end.

9. The method for suppressing jitter based on TCP protocol network tunnel according to claim 8, Features: After the FEC is turned on, the format of re-encapsulating the fragmented data includes a packet sequence Packet Sequence of 4 bytes, i.e. 42 bits, which is used to identify the historical group of fragments of the current data bit; the number of original fragments Number of OriginalFragment is 1 byte, i.e. 8 bits, which is the number of original fragments in the current group of fragments; the total number of fragments is 1 byte, i.e. 8 bits, which is the total number of fragments in the current group of fragments, then the number of redundant fragments = the total number of fragments - the number of original fragments; the current fragment sequence Fragment Sequence is 1 byte, i.e. 8 bits, which is the sequence of the current fragment in the current group of fragments; the fragment data Fragment Size length is 2 bytes, i.e. 16 bits, which indicates the standard length of each fragment; the original data payload length Original Payload Length is 2 bytes, i.e. 16 bits, which is equal to the original data length restored by any original fragment of the current group; the fragment content is of variable length, depending on the data length of the fragment.

10. The method for suppressing jitter based on TCP protocol network tunnel according to claim 9, Features: Calculating the redundant data fragments includes the following steps: Step B1: Read K IP packets from the virtual network card; Step B2: concatenate K IP packets into a whole segment of data; Step B3: Divide the entire data segment into K segments, i.e., K fragments; Step B4: Calculate N redundant fragments using the Reed Solomon algorithm; wherein the total number of fragments of the current packet is K+N.

Images