Method for realizing cross-network series connection of P2P system client and server through springboard

Abstract

The invention relates to a method for realizing cross-network series connection between a client and a server of a P2P system through a springboard, which is suitable for the conditions that the client and the server of the P2P system are positioned in two network environments, the networks are independent, the routing rule is complicated and the security requirement is strict, and can realize cross-network series connection transmission of data streams between the P2P server and the client by means of the springboard. A client side internal network does not need to be adjusted, a P2P service side network does not need to be adjusted, and server software does not need to be modified or newly deployed. The method is characterized in that service data are not coupled, two networks are connected in series for data transmission by modifying address data of an underlying transmission protocol and maintaining an address mapping relation table of transmission data, and the whole process is similar to the operations of receiving and transmitting data by a router, modifying network address information and maintaining an NAT port table.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet business, in particular to a method for realizing cross-network serial connection between a client and a server of a P2P system through a springboard. Background Art

[0002] Online audio and video live broadcast, P2P large file transfer, distance education, online conference, remote assistance and other systems all use P2P communication technology (point-to-point communication technology). When using the P2P system, the client machine and the server need to be able to connect directly. If they cannot be directly connected, the machines on both sides are required to successfully punch a hole through UDP (UDP, User Datagram Protocol) to indirectly achieve direct connection. Otherwise, the two sides cannot shake hands successfully. The core content of UDP punching is that the two connection points are bound to a port of their respective exit routers, thereby realizing point-to-point P2P data transmission.

[0003] Figure 1 This is a schematic diagram of the UDP hole punching process. Figure 1 As shown, Figure 1 In the China Audio and Video Live Broadcasting System, the client side in the first intranet (port 53126, corresponding to IP number 192.168.10.101) is bound to port 62135 of the first router (randomly generated port number, bound to IP number 180.168.70.123), and the server side in the second intranet (port number 56421, corresponding to IP number 10.2.50.202) is bound to port 33158 of the second router (randomly generated port number, bound to IP number 36.138.64.214). The hole is successfully punched, and data transmission is realized between the client machine inside the LAN (port number 53126, corresponding to IP number 192.168.10.101) and the external data stream server (port number 56421, corresponding to IP number 10.2.50.202). Figure 1 In the bottom right corner, NAT mapping (NAT, Network Address Translation) is used between the second intranet server (port number 30080, corresponding IP address 10.2.50.201) and the second router (port number 30080, corresponding IP address 36.138.64.214).

[0004] If the client machine and the P2P server are in two different networks, the existing technology needs to connect the two networks to meet the technical requirements of implementing P2P communication. To solve this problem, there are usually two solutions:

[0005] 1. Figure 2 This is a schematic diagram of the client and server being deployed on the same network. Figure 2As shown, the server is deployed in the intranet, and the P2P backend system and the client machine are in the same LAN. Figure 2 On the left side are four client machines, on the bottom right are the P2P backend system servers, and on the top and middle right are two data stream servers of the P2P backend system. In this case, if the P2P backend system and the client system belong to two completely unrelated industries, for example, the client is a network operator business, and the P2P system belongs to the law enforcement camera surveillance business. The operator only calls the audio and video business in an emergency, and the daily operation and maintenance of the audio and video equipment and software are managed by the manufacturer. In this case, deploying the audio and video system in the operator's internal network will bring many security management issues.

[0006] 2. Figure 3 This is a schematic diagram of adding routing to the intranet. To add network routing, add one or more cascade routers in the client LAN, so that the intranet client can be routed to the external network. Figure 3 As shown, Figure 3 Intranet is the office intranet Ethernet. An intranet router is added between the intranet and the exit router (i.e. the first router) to enable intranet devices to access external network devices (the first router is connected to the second router through the Internet, and the second router is connected to the P2P back-end system). Figure 3 On the left side are three client machines, on the bottom right are the P2P backend system servers, and on the top and middle right are two data stream servers of the P2P backend system. In this case, if the client locations are scattered throughout the province, as the client-side or server-side network becomes more and more complex, the security control of the network becomes more and more stringent, and the client's internal machines are not allowed to route out. If a whitelist method is set to allow a small number of machines to route, it will bring a huge daily operation and maintenance workload to the huge network, leaving potential security risks. Summary of the invention

[0007] The present invention aims at the insufficiency or defect in the prior art, and provides a method for realizing cross-network serial connection between a client and a server of a P2P system through a springboard. The method is applicable to the situation that the client and the server of the P2P system are located in two network environments, the networks are independent, the routing rules are complex, and the security requirements are strict. The method can realize cross-network serial transmission of audio and video data streams between the P2P server and the client by means of a springboard, and does not require adjustment of the internal network on the client side, the network on the P2P service side, or modification or new deployment of the server software. The present invention is characterized in that it is not coupled with business data, and by modifying the address data of the underlying transmission protocol, maintaining the address mapping relationship table of the transmission data, and connecting two networks in series for data transmission. The whole process is similar to the operation of a router sending and receiving data, modifying the network address information, and maintaining the NAT port table.

[0008] The technical solution of the present invention is as follows:

[0009] A method for implementing cross-network serial connection between a P2P system client and a server through a springboard, characterized in that it includes the following steps:

[0010] Step 1: A jump server in the intranet used to isolate the external network is used as a proxy server, and a P2P system client in the intranet sends an application to connect to the P2P system server using the jump server address as the target address;

[0011] Step 2: After receiving the connection request, the jump server modifies the jump server address to the signaling server address and forwards the connection request to the signaling server;

[0012] Step 3, the signaling server sends an internal control signaling to the streaming media server at the P2P system server end according to the connection request;

[0013] Step 4, the streaming media server prepares the data stream port and returns the streaming media server data stream port address to the signaling server;

[0014] Step 5: The signaling server replies to the jump server that the connection request has been approved, and returns the streaming media server data stream port address to the jump server;

[0015] Step 6, the jump server establishes a mapping relationship between the received streaming media server data stream port address and the jump server address that uses the jump server as a proxy server, and replies to the client that the connection request has been approved;

[0016] Step 7: The client prepares the data stream port and applies for a streaming media channel with the jump server address as the target address;

[0017] Step 8, the jump server modifies the jump server address to the data stream port address of the streaming media server, and forwards the streaming media access application to the streaming media server;

[0018] Step 9: The streaming media server returns a handshake success to the jump server;

[0019] Step 10, the jump server modifies the jump server address in the streaming service target address to the client address, and returns a handshake success to the client, thereby realizing cross-network serial transmission of audio and video data streams between the streaming server and the client with the help of the jump server.

[0020] The jump server has dual network cards, which include an internal network card connected to the local area network and an external network card connected to the Internet. The jump server is connected to a first exit router on the client side, and the first exit router is connected to a second exit router on the server side through the Internet.

[0021] The jump server includes TCP and / or UDP transmission port forwarding function.

[0022] The jump server includes a STUN address and / or UDP hole punching address replacement function.

[0023] The jump server includes a data maintenance function for address mapping tables of the client and the server.

[0024] The jump server includes unpacking and packing functions in the address replacement operation.

[0025] The jump server includes a port range specifying function during port forwarding.

[0026] The jump server includes using a virtual IP to avoid single point failure problems.

[0027] The technical effects of the present invention are as follows: the present invention implements a cross-network serial connection method between a P2P system client and a server through a springboard. From the perspective of the client, a hole is punched between the client machine and the springboard machine, and from the perspective of the back-end server, a hole is punched between the server and the springboard machine. However, in fact, the springboard machine does not participate in any process of punching holes, but only transports data.

[0028] Among the existing technical means, either the backend P2P system is reinstalled and deployed in the customer's intranet environment, or the newly added routes of the intranet machine are exposed to the P2P extranet environment, or a new set of P2P backend cascade solutions are purchased and deployed or developed. In addition to being non-compliant with network security regulations, these solutions also bring hidden dangers to the subsequent network security operation and maintenance.

[0029] The present invention does not require adjustment of the deployment of the back-end P2P system, nor does it require changes to the existing client environment. It only requires adding a jump board machine and installing a forwarding tool in a complex client network environment. The network changes are small (only an export route needs to be added to the jump board machine in the intranet), thus meeting network security requirements to the greatest extent.

[0030] The technical advantages of the present invention are summarized as follows:

[0031] 1. Avoided network security risks and only added one jump server.

[0032] 2. Avoid large-scale transformation of the existing internal network and only need to maintain the routing of the jump server.

[0033] 3. No modification is required to the existing backend P2P system.

[0034] 4. No need to purchase a separate cascading solution for the backend P2P system.

[0035] 5. Avoid large-scale intranet environment adjustments, client machine security risks and other issues.

[0036] 6. The port range of the forwarding tool can be configured to facilitate the configuration of network security policies.

[0037] 7. The springboard forwarding tool is simple to implement and can use virtual IP at the same time to avoid single point failure problems (virtual IP is a virtual IP address). BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 This is a diagram of the UDP hole punching process. UDP is the User Datagram Protocol. Figure 2 The core content of UDP hole punching is that two connection points are respectively bound to a port of their respective exit routers, thereby realizing point-to-point P2P data transmission. Figure 2 In the Zhongyin video live broadcast system, the client side is bound to the router's port 62135, and the server side is bound to the router's port 33158. The hole is successfully punched, enabling data transmission between the client machine inside the LAN and the external data stream server.

[0039] Figure 2 This is a schematic diagram of the client and server being deployed on the same network. Figure 2 The server is deployed in the intranet, and the P2P backend system and the client machine are in the same LAN.

[0040] Figure 3 This is a schematic diagram of adding routing to the intranet. Figure 3 Add network routing in the client LAN and add one or more cascade routers in the client LAN, so that the intranet client can be routed to the external network.

[0041] Figure 4 The present invention is a schematic diagram of an application network structure involved in the method of realizing cross-network serial connection between a P2P system client and a server through a springboard. Figure 4 The invention includes a jump server in the intranet for isolating the external network, the jump server has dual network cards, the dual network cards include an internal network card connected to the local area network and an external network card connected to the Internet, the jump server is connected to a first exit router on the client side, and the first exit router is connected to a second exit router on the server side through the Internet. Figure 4 On the left side are three client machines, on the bottom right are the P2P backend system servers, and on the upper and middle right are two data stream servers of the P2P backend system.

[0042] Figure 5 The present invention is a flow chart of a method for realizing cross-network serial connection between a client and a server of a P2P system through a springboard. Figure 5The method includes step 1, wherein a jump server used to isolate the external network in the intranet is used as a proxy server, and a P2P system client in the intranet sends an application to connect to the P2P system server with the jump server address as the target address; step 2, after receiving the connection application, the jump server modifies the jump server address to the signaling server address and forwards the connection application to the signaling server; step 3, the signaling server sends an internal control signaling to the streaming media server at the P2P system server end according to the connection application; step 4, the streaming media server prepares the data stream port and returns the streaming media server data stream port address to the signaling server; step 5, the signaling server replies to the jump server that the connection application has been passed, and returns the streaming media server data stream port address to the jump server; step 6, The jump server establishes a mapping relationship between the received streaming media server data stream port address and the jump server address that uses the jump server as a proxy machine, and replies to the client that the connection application has been approved; step 7, the client prepares the data stream port, and applies for a streaming media channel with the jump server address as the target address; step 8, the jump server modifies the jump server address to the streaming media server data stream port address, and forwards the streaming media channel application to the streaming media server; step 9, the streaming media server returns a handshake success to the jump server; step 10, the jump server modifies the jump server address in the streaming media service target address to the client address, and returns a handshake success to the client, thereby realizing cross-network serial transmission of audio and video data streams between the streaming media server and the client with the help of the jump server.

[0043] Figure 6 It is a schematic diagram of the structure of the series connection tool involved in the method of realizing the cross-network series connection between the client and the server of the P2P system through a springboard in the implementation of the present invention. Figure 6 The jump board includes a jump board, in which a switching serial tool is embedded. The jump board is interconnected with client 1 to client n and a server respectively through the switching serial tool. DETAILED DESCRIPTION

[0044] Below is the attached figure ( Figure 1-Figure 6 ) and Examples illustrate the present invention.

[0045] Figure 1 This is a schematic diagram of the UDP hole punching process. Figure 2 This is a schematic diagram of the client and server being deployed on the same network. Figure 3 This is a schematic diagram of adding routing to the intranet. Figure 4 The present invention is a schematic diagram of an application network structure involved in the method of realizing cross-network serial connection between a P2P system client and a server through a springboard. Figure 5 The present invention is a flow chart of a method for realizing cross-network serial connection between a client and a server of a P2P system through a springboard. Figure 6 This is a schematic diagram of the structure of the series connection tool involved in the method of implementing the cross-network series connection between the client and the server of the P2P system through a springboard in the present invention. Figures 1 to 6 As shown, the present invention relates to the technical field of Internet business, and is used for a P2P (peer-to-peer) system in which the client and server belong to two networks, and a series connection is achieved through a jump board. When the client and server of the P2P system are located in two network environments, the networks are independent of each other, the routing rules are complex, and the security requirements are strict, the present invention provides a method that does not modify the P2P code, does not adjust the client environment, and does not adjust the server environment. It only needs to add a jump board with dual network cards, and deploy a switching series connection tool on the jump board to realize data transmission between the client and server of the P2P system across the network. The tool does not couple business data, and by modifying the address data of the underlying transmission protocol, maintaining the address mapping relationship table of the transmission data, and connecting two networks in series for data transmission. The whole process is similar to the operation of a router sending and receiving data, modifying the network address information, and maintaining the NAT port table.

[0046] The present invention only needs to add a jump server to the client-side intranet and deploy a series connection tool, and does not need to adjust the client-side internal network, the P2P service-side network, or modify or newly deploy server software.

[0047] The newly added jump server in the intranet is equipped with dual network cards, which can communicate with the intranet client machines at the same time and can also be routed to the external network P2P system at the same time.

[0048] Theoretically, the jump board machine has solved the problem of physical line transmission across the network. The key is to find a suitable jump board forwarding series connection tool. Ordinary forwarding tools (such as nginx proxy server) can only realize data transparent transmission of fixed ports, while the UDP hole punching technology used in the P2P system has dynamic and random ports. The key is that the hole punching is technically a direct handshake between the client machine and the server machine, and the data does not pass through the proxy forwarding machine. Therefore, the present invention focuses on developing a jump board forwarding series connection tool. The tool meets the communication technology requirements of the P2P system, and is particularly required to meet the communication technology requirements of UDP hole punching.

[0049] When using this tool, there is no need to adjust the network environment on a large scale. Since there is a jump server to isolate the external network, it will not cause security issues on the internal network and will not increase the operation and maintenance costs of the subsequent network and P2P equipment.

[0050] P2P systems generally include signaling servers and data stream servers. The entire communication process includes the handshake process between the client and the signaling service, such as: exchanging SDP (Session Description Protocol), exchanging Candidates, heartbeats, etc. (candidate, a candidate string, is used to specify the candidate's network connection information), and also includes data stream transmission after UDP hole punching is successful. The springboard series connection tool supports the entire communication process, does not modify business information, but only adjusts the data flow direction, and will not cause business inconsistency problems.

[0051] After using the jump-board serial tool, the client does not directly shake hands with the server, but with the jump-board machine. After receiving the handshake signal, the jump-board machine modifies the handshake machine address information, retains other information, and then forwards it to the server. Similarly, the jump-board machine receives the data from the server, and according to the port mapping relationship, modifies it back to the real client machine information and returns it to the client. The whole process is completely similar to the operation of a router sending and receiving data, modifying network address information, and maintaining the NAT port table (NAT, Network Address Translation).

[0052] The detailed process is as follows:

[0053] 1. Modify the client configuration information in advance and change the addresses of the signaling server and STUN server to the jump machine address (STUN, Session Traversal Utilities for NAT, NAT, Network Address Translation).

[0054] 2. Start the signaling and STUN ports of the serial tool to receive data transmitted by the client.

[0055] 3. Unpack the received client signaling information, replace the stun server address, repack it and send it to the signaling server. This work is similar to the network address replacement in the router.

[0056] 4. Receive the information returned by the signaling server, unpack it, and obtain the streaming server parameters according to the candidate parameter value (candidate, candidate string, used to specify the candidate's network connection information).

[0057] 5. Add the mapping data between the client and the streaming media server, which is similar to the NAT address mapping table in the router.

[0058] 6. According to the security policy planning scope, start the streaming proxy port to forward streaming data.

[0059] 7. The proxy STUN port receives the data from the server, unpacks it, replaces the server information (MAP-Address, mapping address) in the MAP-Address attribute, repacks it and sends it to the client machine.

[0060] 8. Other data packets are forwarded along the original route.

[0061] The main work of this tool is to forward data. It does not have any real STUN, handshake, negotiation, decoding and other business processes. It basically only serves to forward data. It only replaces the address of the handshake packet containing special marks.

[0062] In addition, if the original P2P system, the data flow service port is randomly configured, then it is not conducive to the intranet security policy configuration. In the forwarding series tool, the proxy port can be used in a specified range, which is convenient for network security policy management.

[0063] From the client's perspective, it is the client machine that is drilling a hole with the jump server, and from the backend server's perspective, it is the server that is drilling a hole with the jump server. However, in fact, the jump server does not participate in any process of drilling a hole, it only moves data.

[0064] The core key content of the jump server forwarding tool includes two parts:

[0065] 1. Forwarding data as is: Following the handshake process, establish a peer connection with both ends and then forward data. The forwarding process includes data transmitted by TCP and UDP protocol ports (TCP, Transmission Control Protocol).

[0066] 2. Replace the address data forwarding: This process needs to intercept the handshake data when the handshake is established and forward the data, readjust it to the address information of the proxy machine, and then forward it. During the replacement process, it is necessary to follow the unpacking and packaging process of the original transmission protocol. For example, it includes: TCP / IP protocol (IP, Internet Protocol, Internet Protocol), Websocket protocol (Websocket, network socket two-way communication), STUN protocol, SDP protocol, etc. (SDP, Session Description Protocol, Session Description Protocol).

[0067] The features of the jump server forwarding tool are as follows:

[0068] 1. A springboard transfer and serialization tool to achieve P2P data transmission across networks.

[0069] 2. The tool includes port forwarding capabilities for both TCP and UDP transports.

[0070] 3. The STUN address and UDP hole punching address replacement function in the tool.

[0071] 4. The address mapping table data maintenance function of the client and server in the tool.

[0072] 5. The unpacking and packing functions included in the address replacement operation.

[0073] 6. The port range specification function included in the port forwarding.

[0074] The contents not described in detail in the specification of the present invention belong to the prior art known to the professional and technical personnel in the field. It is pointed out here that the above description helps those skilled in the art to understand the invention, but does not limit the protection scope of the invention. Any equivalent replacement, modification and / or simplification of the above description without departing from the essence of the invention falls within the protection scope of the invention.

Claims

1. A method for realizing cross-network serial connection between a P2P system client and a server through a springboard, characterized in that: The following steps are involved: Step 1: A jump server in the intranet used to isolate the external network is used as a proxy server, and a P2P system client in the intranet sends an application to connect to the P2P system server using the jump server address as the target address; Step 2: After receiving the connection request, the jump server modifies the jump server address to the signaling server address and forwards the connection request to the signaling server; Step 3, the signaling server sends an internal control signaling to the streaming media server at the P2P system server end according to the connection request; Step 4, the streaming media server prepares the data stream port and returns the streaming media server data stream port address to the signaling server; Step 5: The signaling server replies to the jump server that the connection request has been approved, and returns the streaming media server data stream port address to the jump server; Step 6, the jump server establishes a mapping relationship between the received streaming media server data stream port address and the jump server address that uses the jump server as a proxy server, and replies to the client that the connection request has been approved; Step 7: The client prepares the data stream port and applies for a streaming media channel with the jump server address as the target address; Step 8, the jump server modifies the jump server address to the data stream port address of the streaming media server, and forwards the streaming media access application to the streaming media server; Step 9: The streaming media server returns a handshake success to the jump server; Step 10, the jump server modifies the jump server address in the streaming service target address to the client address, and returns a handshake success to the client, thereby realizing cross-network serial transmission of audio and video data streams between the streaming server and the client with the help of the jump server.

2. The method for realizing cross-network serial connection between a P2P system client and a server through a springboard according to claim 1, characterized in that: The jump server has dual network cards, which include an internal network card connected to the local area network and an external network card connected to the Internet. The jump server is connected to a first exit router on the client side, and the first exit router is connected to a second exit router on the server side through the Internet.

3. The method for realizing cross-network serial connection between a P2P system client and a server through a springboard according to claim 1, characterized in that: The jump server includes TCP and / or UDP transmission port forwarding function.

4. The method for realizing cross-network serial connection between a P2P system client and a server through a springboard according to claim 1, characterized in that: The jump server includes a STUN address and / or UDP hole punching address replacement function.

5. The method for realizing cross-network serial connection between a P2P system client and a server through a springboard according to claim 1, characterized in that: The jump server includes a data maintenance function for address mapping tables of the client and the server.

6. The method for realizing cross-network serial connection between a P2P system client and a server through a springboard according to claim 1, characterized in that: The jump server includes unpacking and packing functions in the address replacement operation.

7. The method for realizing cross-network serial connection between a P2P system client and a server through a springboard according to claim 1, characterized in that: The jump server includes a port range specifying function during port forwarding.

8. The method for realizing cross-network serial connection between a P2P system client and a server through a springboard according to claim 1, characterized in that: The jump server includes using a virtual IP to avoid single point failure problems.

Images