Multi-cluster traffic processing method and device, electronic equipment and storage medium

Abstract

The invention discloses a multi-cluster traffic processing method and device, electronic equipment and a storage medium, and the method comprises the steps: responding to an interaction request of encryption equipment and a target platform, and building an encryption channel of a unified access layer of the encryption equipment and the target platform; performing message load stripping on the encrypted channel to obtain equipment service data; analyzing according to the message feature of the plaintext data to obtain a unique device identifier of the encryption device, and establishing a device session at a target node of the unified access layer based on the unique device identifier; and querying and obtaining the equipment attribute information of the encryption equipment according to the equipment unique identifier, and carrying out service message interaction based on the equipment attribute information. According to the method, flexible scheduling and unified distribution of the traffic can be realized, so that DTLS security encryption equipment management and traffic forwarding requirements under a multi-cluster architecture of an Internet of Things platform are met, multi-cluster traffic processing can be realized, and the method can be widely applied to the technical field of data processing.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a multi-cluster traffic processing method, device, electronic device and storage medium. Background Art

[0002] DTLS (Datagram Transport Layer Security) is a datagram security transmission protocol used to provide secure data transmission on unreliable datagram transmission protocols (such as UDP). It is particularly suitable for implementing secure encrypted communications between resource-constrained terminals and platforms in the field of the Internet of Things. It has been widely used in smart utilities and the medical industry.

[0003] With the popularization of intelligence, the access and management of massive IoT devices have become the focus of attention, especially in the fields of public utilities and medical industries, where the secure transmission and storage of device data is particularly important. Therefore, whether from the perspective of achieving local management, the saturation of the total number of devices accessed on a single platform, or security considerations such as data isolation / exclusive resource use, the architectural design that enables the access and management of massive devices in multiple clusters has become an inevitable choice. However, compared to plaintext transmission devices, how to achieve flexible scheduling and unified distribution of DTLS secure encrypted device traffic between clusters has become a new challenge. . Summary of the invention

[0004] The present invention proposes a multi-cluster traffic processing method, device, electronic device and storage medium, aiming to solve one of the technical problems in the related art at least to a certain extent. The embodiments of the present invention can realize multi-cluster traffic processing.

[0005] On the one hand, an embodiment of the present invention provides a multi-cluster traffic processing method, including:

[0006] In response to an interaction request between the encryption device and the target platform, an encryption channel of a unified access layer between the encryption device and the target platform is established;

[0007] Stripping the encrypted channel of message payloads to obtain device service data; the device service data includes plaintext data, link information of the encrypted channel, and device source address information of the encrypted device;

[0008] The unique device identifier of the encryption device is obtained according to the message feature analysis of the plaintext data, and a device session is established at the target node of the unified access layer based on the unique device identifier; the device session is used to record the session record between the encryption device and the unified access layer; the session record includes device session information and first attribute information; the first attribute information includes link information, device source address information and node information of the target node;

[0009] The device attribute information of the encryption device is obtained by querying the unique identifier of the device, and business message interaction is performed based on the device attribute information; the device attribute information includes first attribute information and second attribute information, and the second attribute information includes cluster information of the cluster to which the encryption device belongs; the content of the business message interaction includes uplink business messages and downlink business messages.

[0010] Optionally, the method further comprises the following steps:

[0011] In response to a device management instruction of the corresponding cluster to the encryption device, calling a device routing maintenance service interface of the unified access layer according to the second attribute information of the encryption device;

[0012] Based on the call to the device routing maintenance service interface, information management operations are performed on the data information in the routing table of the unified access layer;

[0013] The device management instruction includes adding or deleting, and the information management operation correspondingly includes writing the second attribute information or deleting the second attribute information.

[0014] Optionally, the encryption device is pre-burned with a device docking address of the unified access layer; establishing an encryption channel between the encryption device and the unified access layer of the target platform includes the following steps:

[0015] Based on the device docking address, the encryption device and the access distribution service of the unified access layer are encrypted and authenticated to complete the establishment of the encryption channel;

[0016] Among them, the encryption authentication process includes encryption link establishment, secure transmission protocol handshake and certificate authentication.

[0017] Optionally, the method further comprises the following steps:

[0018] Record device session information and link information and device source address information thrown out by message payload stripping through the encrypted channel in the device session;

[0019] The device unique identifier, link information, device source address information, node information and device session information are written into the session table in the unified access layer.

[0020] Optionally, the first attribute information is stored in a session table of the unified access layer, and the second attribute information is stored in a routing table of the unified access layer; obtaining device attribute information of the encryption device according to the device unique identifier query includes the following steps:

[0021] When the content of the service message interaction is a downlink service message, the first attribute information is obtained by querying the session table according to the device unique identifier determined by the downlink service message;

[0022] The session table stores device unique identifiers and first attribute information corresponding to all encryption devices that establish device sessions in the unified access layer, and the device unique identifier and first attribute information corresponding to each encryption device are stored in the session table in the format of an associated data group;

[0023] When the content of the service message interaction is an uplink service message, the second attribute information is obtained by querying in the routing table according to the unique identifier of the device;

[0024] The routing table stores device unique identifiers and second attribute information corresponding to all encryption devices in the managed multi-clusters. The device unique identifier and second attribute information corresponding to each encryption device are stored in the routing table in the format of an associated data group.

[0025] Optionally, when the content of the service message interaction is a downlink service message, performing service message interaction on the encryption device and its cluster based on the device attribute information includes the following steps:

[0026] Forwarding the downlink service message to the first service node in the unified access layer through the encryption device; the target node represents the service node corresponding to the encryption device; the first service node represents any service node in the unified access layer;

[0027] Determine the second service node where the device session corresponding to the target encryption device is located based on the first attribute information; the target encryption device represents the device to which the downlink service message is sent;

[0028] The downlink service message is routed from the first service node to the second service node through a remote procedure call, and then the downlink service message is sent to the target encryption device through the device session and encryption channel corresponding to the target encryption device.

[0029] Optionally, when the content of the service message interaction is an uplink service message, performing service message interaction on the encryption device and its cluster based on the device attribute information includes the following steps:

[0030] Determine the cluster to which the encryption device belongs based on the second attribute information;

[0031] The uplink service message is transferred to the device access service of the cluster to which it belongs through a preset connection method, so that the cluster to which it belongs performs process analysis on the uplink service message; the preset connection method includes a dedicated line connection or an intra-cloud peer connection.

[0032] On the other hand, an embodiment of the present invention provides a multi-cluster traffic processing device, including:

[0033] The first module is used to establish an encryption channel of a unified access layer between the encryption device and the target platform in response to an interaction request between the encryption device and the target platform;

[0034] The second module is used to strip the message payload of the encrypted channel to obtain device service data; the device service data includes plaintext data, link information of the encrypted channel and device source address information of the encryption device;

[0035] The third module is used to obtain the unique device identifier of the encryption device according to the message feature analysis of the plaintext data, and establish a device session at the target node of the unified access layer based on the unique device identifier; the device session is used to record the session record between the encryption device and the unified access layer; the session record includes device session information and first attribute information; the first attribute information includes link information, device source address information and node information of the target node;

[0036] The fourth module is used to obtain the device attribute information of the encryption device according to the device unique identifier, and perform business message interaction based on the device attribute information; the device attribute information includes first attribute information and second attribute information, and the second attribute information includes cluster information of the cluster to which the encryption device belongs; the content of the business message interaction includes uplink business messages and downlink business messages.

[0037] Optionally, the device further comprises:

[0038] A fifth module is used to respond to the device management instruction of the cluster to the encryption device and call the device routing maintenance service interface of the unified access layer according to the second attribute information of the encryption device;

[0039] The sixth module is used to perform information management operations on the data information in the routing table of the unified access layer based on the call of the device routing maintenance service interface;

[0040] The device management instruction includes adding or deleting, and the information management operation correspondingly includes writing the second attribute information or deleting the second attribute information.

[0041] Optionally, the device further comprises:

[0042] The seventh module is used to record the device session information and the link information and device source address information thrown out by the encrypted channel through message payload stripping in the device session;

[0043] The eighth module is used to write the device unique identification, link information, device source address information, node information and device session information into the session table in the unified access layer.

[0044] On the other hand, an embodiment of the present invention provides an electronic device, including: a processor and a memory; the memory is used to store programs; the processor executes the program to implement the above multi-cluster traffic processing method.

[0045] On the other hand, an embodiment of the present invention provides a computer storage medium, in which a program executable by a processor is stored. When the program executable by the processor is executed by the processor, it is used to implement the above-mentioned multi-cluster traffic processing method.

[0046] The embodiment of the present invention establishes an encryption channel between the encryption device and the target platform at a unified access layer in response to an interaction request between the encryption device and the target platform; performs message load stripping on the encryption channel to obtain device service data; the device service data includes plaintext data, link information of the encryption channel and device source address information of the encryption device; obtains a device unique identifier of the encryption device based on message feature analysis of the plaintext data, and establishes a device session at a target node in the unified access layer based on the device unique identifier; the device session is used to record a session record between the encryption device and the unified access layer; the session record includes device session information and first attribute information; the first attribute information includes link information, device source address information and node information of the target node; obtains device attribute information of the encryption device based on the device unique identifier, and performs service message interaction based on the device attribute information; the device attribute information includes first attribute information and second attribute information, and the second attribute information includes cluster information of the cluster to which the encryption device belongs; the content of the service message interaction includes uplink service messages and downlink service messages. The embodiments of the present invention realize business message interaction by establishing an encrypted channel, message payload stripping, establishing device sessions and matching device attribute information, and sinking the DTLS encryption and decryption and session maintenance functions through a logically integrated unified access layer, thereby realizing flexible scheduling and unified distribution of traffic, thereby meeting the DTLS security encryption device management and traffic forwarding needs under the multi-cluster architecture of the Internet of Things platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The accompanying drawings are used to provide a further understanding of the technical solution of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the technical solution of the present invention and do not constitute a limitation on the technical solution of the present invention.

[0048] Figure 1 A schematic diagram of an implementation environment for multi-cluster traffic processing provided by an embodiment of the present invention;

[0049] Figure 2 A schematic diagram of a flow chart of a multi-cluster traffic processing method provided by an embodiment of the present invention;

[0050] Figure 3 A schematic diagram of an extended process of a multi-cluster traffic processing method provided by an embodiment of the present invention;

[0051] Figure 4 A schematic diagram of another extended flow chart of the multi-cluster traffic processing method provided in an embodiment of the present invention;

[0052] Figure 5A schematic diagram of an expanded process of querying device attribute information provided by an embodiment of the present invention;

[0053] Figure 6 A schematic diagram of a process flow of business message interaction provided by an embodiment of the present invention;

[0054] Figure 7 Another schematic diagram of a flow chart of a service message interaction provided by an embodiment of the present invention;

[0055] Figure 8 A schematic diagram of the architecture principle of multi-cluster traffic processing provided by an embodiment of the present invention;

[0056] Fig. 9 A schematic diagram of the structure of a multi-cluster traffic processing device provided by an embodiment of the present invention;

[0057] Fig.10 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0059] It should be noted that, although the functional modules are divided in the system schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the system or the order in the flowchart. The terms "first / S100", "second / S200", etc. in the specification, claims and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0060] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0061] To facilitate the understanding of the technical solution of the present invention, the technical feature terms that may appear in the embodiments of the present invention are first explained:

[0062] DTLS (Datagram Transport Layer Security): is a secure transmission protocol based on the UDP protocol. It provides security and data integrity protection similar to TLS (Transport Layer Security), while also having the advantages of the UDP protocol, such as low latency and support for multiplexing.

[0063] RPC (Remote Procedure Call) is a protocol for requesting services from a remote computer over a network. It allows a program to call a procedure or function in another address space (usually another machine on a shared network) without the programmer having to explicitly code the details of the remote call.

[0064] It is understandable that the multi-cluster traffic processing method provided in the embodiment of the present invention can be applied to any computer device with data processing computing capabilities, and this computer device can be various types of terminals or servers. When the computer device in the embodiment is a server, the server is an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. Optionally, the terminal is a smart phone, a tablet computer, a laptop computer, a desktop computer, etc., but is not limited to this.

[0065] like Figure 1 FIG. 1 is a schematic diagram of an implementation environment provided by an embodiment of the present invention. Figure 1 The implementation environment includes at least one terminal 102 and a server 101. The terminal 102 and the server 101 can be connected to a network wirelessly or wired to complete data transmission and exchange.

[0066] Server 101 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms.

[0067] In addition, the server 101 can also be a node server in the blockchain network. Blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, and encryption algorithm.

[0068] The terminal 102 may be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited thereto. The terminal 102 and the server 101 may be directly or indirectly connected via wired or wireless communication, which is not limited in the embodiment of the present invention.

[0069] Based on the example Figure 1 In the implementation environment shown, an embodiment of the present invention provides a multi-cluster traffic processing method. The following is an example of applying the multi-cluster traffic processing method to the terminal 102. It can be understood that the multi-cluster traffic processing method can also be applied to the server 101.

[0070] Reference Figure 2 , Figure 2 The flowchart of the multi-cluster traffic processing method applied to a terminal provided by an embodiment of the present invention, the execution subject of the multi-cluster traffic processing method can be any of the aforementioned computer devices (including a server or a terminal). Figure 2 , the method comprises the following steps:

[0071] S100, in response to an interaction request between the encryption device and the target platform, establishing an encryption channel of a unified access layer between the encryption device and the target platform;

[0072] It should be noted that the encryption device is pre-burned with the device docking address of the unified access layer; in some embodiments, establishing an encryption channel between the encryption device and the unified access layer of the target platform may include the following steps: based on the device docking address, performing an encryption authentication process on the access distribution service of the encryption device and the unified access layer to complete the establishment of the encryption channel; wherein the encryption authentication process includes encryption link establishment, secure transmission protocol handshake and certificate authentication.

[0073] Among them, in some embodiments, such as Figure 3 As shown, the method may also include the following steps: A100, in response to a device management instruction of the cluster to which it belongs to the encryption device, calling the device routing maintenance service interface of the unified access layer according to the second attribute information of the encryption device; A200, based on the call to the device routing maintenance service interface, performing information management operations on the data information in the routing table of the unified access layer; wherein the device management instruction includes adding or deleting, and the information management operation correspondingly includes writing the second attribute information or deleting the second attribute information.

[0074] For example, in some specific implementations, the encryption information such as PSK and certificate of the DTLS device is sunk to the unified access layer, and the unified access layer implements encryption and decryption, link maintenance, and session maintenance of all DTLS devices, which can be specifically implemented as follows:

[0075] 1) When adding or deleting devices, each cluster will synchronously call the device routing maintenance service interface of the unified access layer with the device unique identification, cluster information and device encryption information (including but not limited to PSK / PSKID, etc.), write or delete the routing table of the unified access layer, and perform global unified maintenance.

[0076] 2) All DTLS devices are programmed with the device docking address of the unified access layer. When the device interacts with the platform, it must first establish an encrypted link, perform DTLS handshake and certificate authentication with the unified access layer access distribution service to complete the establishment of an encrypted transmission channel.

[0077] S200, stripping the message payload from the encrypted channel to obtain device service data;

[0078] The device service data includes plaintext data, link information of the encryption channel, and device source address information of the encryption device;

[0079] Exemplarily, in some specific implementations, after the DTLS encrypted channel is established, the application side message is stripped of its message payload, and the decrypted plaintext data, encrypted channel link information, device source address information, etc. are thrown out.

[0080] S300, obtaining a unique device identifier of the encryption device according to the message feature analysis of the plaintext data, and establishing a device session at a target node of the unified access layer based on the unique device identifier;

[0081] The device session is used to record the session record between the encryption device and the unified access layer; the session record includes the device session information and the first attribute information; the first attribute information includes the link information, the device source address information and the node information of the target node;

[0082] Among them, in some embodiments, such as Figure 4 As shown, the method may also include the following steps: B100, recording the device session information and the link information and device source address information thrown out by the encrypted channel through message payload stripping in the device session; B200, writing the device unique identifier, link information, device source address information, node information and device session information into the session table in the unified access layer.

[0083] For example, in some specific implementations, after the unified access layer separates the device service data, the unique device identifier is obtained according to the message feature analysis, and the corresponding relationship between the unique device identifier and the source address of the device and the DTLS encrypted session is recorded to complete the uplink and downlink decoupling of the device traffic, which can be specifically implemented as follows:

[0084] 1) According to the plaintext data message characteristics thrown out by the encrypted channel (including but not limited to login message ep; heartbeat message path; business message token, etc.), parse the device unique identifier (including but not limited to IMEI) carried in the message.

[0085] 2) Establish and maintain a device session based on the device's unique identifier, and record the link information and device source address information thrown out by the encrypted channel in the device session.

[0086] 3) Key information such as the device unique identification, device session information, encrypted channel link information, device source address information, node information, etc. are synchronously written into the session table, and refreshed in real time each time a new device uplink service message is received.

[0087] S400, obtaining device attribute information of the encryption device according to the device unique identifier, and performing service message interaction based on the device attribute information;

[0088] The device attribute information includes first attribute information and second attribute information, and the second attribute information includes cluster information of the cluster to which the encryption device belongs; and the content of the service message interaction includes uplink service messages and downlink service messages.

[0089] It should be noted that the first attribute information is stored in the session table of the unified access layer, and the second attribute information is stored in the routing table of the unified access layer; in some embodiments, such as Figure 5 As shown, obtaining device attribute information of an encryption device by querying based on a unique device identifier may include the following steps: S411. When the content of a business message interaction is a downlink business message, querying in a session table based on a unique device identifier determined by the downlink business message to obtain first attribute information; the session table stores device unique identifiers and first attribute information corresponding to all encryption devices that establish device sessions in a unified access layer, and the device unique identifier and first attribute information corresponding to each encryption device are stored in the session table in the format of an associated data group; S412. When the content of a business message interaction is an uplink business message, querying in a routing table based on a unique device identifier to obtain second attribute information; the routing table stores device unique identifiers and second attribute information corresponding to all encryption devices in the managed multi-clusters, and the device unique identifier and second attribute information corresponding to each encryption device are stored in the routing table in the format of an associated data group.

[0090] Among them, in some embodiments, such as Figure 6As shown, when the content of the business message interaction is a downlink business message, the business message interaction is performed on the encryption device and its cluster based on the device attribute information, which may include the following steps: S421, forwarding the downlink business message to the first service node in the unified access layer through the encryption device; the target node represents the service node corresponding to the encryption device; the first service node represents any service node in the unified access layer; S422, determining the second service node where the device session corresponding to the target encryption device is located based on the first attribute information; the target encryption device represents the device to which the downlink business message is sent; S423, routing the downlink business message from the first service node to the second service node through a remote procedure call, and then sending the downlink business message to the target encryption device through the device session corresponding to the target encryption device and the encryption channel.

[0091] Among them, in some embodiments, such as Figure 7 As shown, when the content of the business message interaction is an uplink business message, the business message interaction is performed between the encryption device and the cluster to which it belongs based on the device attribute information, which can include the following steps: S431. Determine the cluster to which the encryption device belongs based on the second attribute information; S432. Transfer the uplink business message to the device access service of the cluster to which it belongs through a preset connection method, so that the cluster to which it belongs performs process analysis on the uplink business message; the preset connection method includes a dedicated line connection or a peer-to-peer connection within the cloud.

[0092] For example, in some specific implementations, the cluster affiliation information and the corresponding access address of the device can be queried and obtained according to the unique identifier of the device, and the uplink and downlink interaction and distribution of the service data of the device and the service cluster can be realized through a dedicated line or a peer-to-peer connection in the cloud, which can be specifically realized as follows:

[0093] 1) For device uplink service messages:

[0094] ① Query the routing table according to the unique identifier of the device, and obtain the cluster information and access address that the device should transfer based on the cluster information pre-written in the table.

[0095] ② The plaintext data messages thrown out of the encrypted channel are transferred to the device access service of the corresponding cluster through dedicated lines or peer-to-peer connections within the cloud, and the device access service performs corresponding business message parsing and process processing.

[0096] 2) For device downlink service messages:

[0097] ① The device access module of each cluster forwards the message to be sent to the device to any access distribution service node (i.e., service node) of the unified access layer.

[0098] ② After receiving the downlink message, the access distribution service obtains the unique device identifier based on the message characteristics (including but not limited to the message path or token, etc.), and queries the session table to obtain the corresponding node information, session information, link information, device source address, etc.

[0099] ③Route the downlink message to the node where the device session is located through RPC, and encrypt it through the DTLS channel through the original device session and link and send it to the device.

[0100] In order to explain the principle of the technical solution of the present invention in detail, the overall process of the present invention is described below in combination with some specific embodiments. It is easy to understand that the following is an explanation of the technical principle of the present invention and cannot be regarded as a limitation of the present invention.

[0101] First of all, it should be explained that the existing technical solutions are:

[0102] The existing multi-cluster processing mode of the Internet of Things is mostly for multi-cluster access processing of IoT devices based on the TCP protocol (such as MQTT or HTTP protocol).

[0103] The existing multi-cluster processing is mostly for devices to access different clusters based on their regions. Due to different access addresses, they cannot be mass-produced when leaving the factory and need to be re-burned according to the actual situation;

[0104] Alternatively, the device may additionally implement the function of dynamically receiving the address assigned by the platform, and the platform may dynamically assign the access cluster address, thereby increasing the additional development cost and resource consumption of the device.

[0105] In view of this, the present invention provides a method to divide the access interaction between DTLS devices and platforms into two parts: encrypted link maintenance and business data interaction. The DTLS encryption and decryption and session maintenance functions are decentralized, and business data is transmitted through dedicated lines, peer-to-peer connections in the cloud and other secure transmission methods to achieve flexible scheduling and unified distribution of traffic, thereby meeting the needs of DTLS secure encryption device management and traffic forwarding under the multi-cluster architecture of the IoT platform. Specifically, refer to Figure 8 , the solution of the present invention can be implemented as follows:

[0106] 1. The PSK, certificate and other encryption information of the DTLS device are transferred to the unified access layer, which implements encryption and decryption, link maintenance and session maintenance of all DTLS devices:

[0107] 1) When adding or deleting devices, each cluster will synchronously call the device routing maintenance service interface of the unified access layer with the device unique identification, cluster information and device encryption information (including but not limited to PSK / PSKID, etc.), write or delete the routing table of the unified access layer, and perform global unified maintenance.

[0108] 2) All DTLS devices are programmed with the device docking address of the unified access layer. When the device interacts with the platform, it must first establish an encrypted link, perform DTLS handshake and certificate authentication with the unified access layer access distribution service to complete the establishment of an encrypted transmission channel.

[0109] 3) After the DTLS encrypted channel is established, the application-side message is stripped of its payload, and the decrypted plaintext data, encrypted channel link information, device source address information, etc. are thrown out.

[0110] 2. After the unified access layer separates the device service data, it obtains the unique device identifier based on the message characteristics and records the corresponding relationship between the device's source address and the DTLS encrypted session, completing the uplink and downlink decoupling of the device traffic:

[0111] 1) According to the plaintext data message characteristics thrown out by the encrypted channel (including but not limited to login message ep; heartbeat message path; business message token, etc.), parse the device unique identifier (including but not limited to IMEI) carried in the message.

[0112] 2) Establish and maintain a device session based on the device's unique identifier, and record the link information and device source address information thrown out by the encrypted channel in the device session.

[0113] 3) Key information such as the device unique identification, device session information, encrypted channel link information, device source address information, node information, etc. are synchronously written into the session table, and refreshed in real time each time a new device uplink service message is received.

[0114] 3. According to the unique device identifier, query and obtain the device's cluster affiliation information and corresponding access address, and realize the uplink and downlink interaction and distribution of the device's business data and the business cluster through dedicated lines or peer-to-peer connections within the cloud:

[0115] 1) For device uplink service messages:

[0116] ① Query the routing table according to the unique identifier of the device, and obtain the cluster information and access address that the device should transfer based on the cluster information pre-written in the table.

[0117] ② The plaintext data messages thrown out of the encrypted channel are transferred to the device access service of the corresponding cluster through dedicated lines or peer-to-peer connections within the cloud, and the device access service performs corresponding business message parsing and process processing.

[0118] 2) For device downlink service messages:

[0119] ① The device access module of each cluster forwards the message to be sent to the device to any access distribution service node (i.e., service node) of the unified access layer.

[0120] ② After receiving the downlink message, the access distribution service obtains the unique device identifier based on the message characteristics (including but not limited to the message path or token, etc.), and queries the session table to obtain the corresponding node information, session information, link information, device source address, etc.

[0121] ③Route the downlink message to the node where the device session is located through RPC, and encrypt it through the DTLS channel through the original device session and link and send it to the device.

[0122] In summary, the present invention has been developed in the corresponding IoT platform AIoT general component service, and has been put into use and achieved excellent results; the method of the present invention supports multiple protocols of the IoT platform (including but not limited to: DTLS equipment, LWM2M protocol equipment, CoAP protocol equipment, UDP protocol equipment, etc.) and multiple business scenarios; the present invention is easy to implement and promote, and can be extended to other industries and systems, including but not limited to: traditional telecommunications industry, smart cities, smart homes, industry & agriculture, smart medical care, Internet of Vehicles, etc. Compared with the prior art, the present invention includes at least the following beneficial effects:

[0123] The present invention provides a multi-cluster access interaction mode of a DTLS encryption device based on the UDP protocol.

[0124] The device only needs to burn the same unified access cluster address, avoiding secondary burning; at the same time, there is no need for the device to additionally develop a dynamic receiving address function, avoiding additional resource consumption.

[0125] The solution of the present invention saves equipment development costs and production cycles, avoids additional business interactions, and effectively improves customer perception.

[0126] On the other hand, Fig. 9 As shown, an embodiment of the present invention provides a multi-cluster traffic processing device 900, including:

[0127] The first module 901 is used to establish an encryption channel of a unified access layer between the encryption device and the target platform in response to an interaction request between the encryption device and the target platform;

[0128] The second module 902 is used to strip the message payload of the encrypted channel to obtain device service data; the device service data includes plaintext data, link information of the encrypted channel and device source address information of the encryption device;

[0129] The third module 903 is used to obtain a unique device identifier of the encryption device according to the message feature analysis of the plaintext data, and establish a device session at the target node of the unified access layer based on the unique device identifier; the device session is used to record the session record between the encryption device and the unified access layer; the session record includes device session information and first attribute information; the first attribute information includes link information, device source address information and node information of the target node;

[0130] The fourth module 904 is used to obtain the device attribute information of the encryption device according to the device unique identifier, and perform business message interaction based on the device attribute information; the device attribute information includes first attribute information and second attribute information, and the second attribute information includes cluster information of the cluster to which the encryption device belongs; the content of the business message interaction includes uplink business messages and downlink business messages.

[0131] In some embodiments, the apparatus may further include:

[0132] A fifth module is used to respond to the device management instruction of the cluster to the encryption device and call the device routing maintenance service interface of the unified access layer according to the second attribute information of the encryption device;

[0133] The sixth module is used to perform information management operations on the data information in the routing table of the unified access layer based on the call of the device routing maintenance service interface;

[0134] The device management instruction includes adding or deleting, and the information management operation correspondingly includes writing the second attribute information or deleting the second attribute information.

[0135] In some embodiments, the apparatus may further include:

[0136] The seventh module is used to record the device session information and the link information and device source address information thrown out by the encrypted channel through message payload stripping in the device session;

[0137] The eighth module is used to write the device unique identification, link information, device source address information, node information and device session information into the session table in the unified access layer.

[0138] The contents of the method embodiments of the present invention are all applicable to the device embodiments. The functions specifically implemented by the device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0139] On the other hand, an embodiment of the present invention further provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above sensitive information method when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0140] It can be understood that the contents of the above method embodiments are all applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0141] like Fig.10 As shown, Fig.10 A specific example of the hardware structure of an electronic device 1000 according to an embodiment is shown. The electronic device 1000 includes:

[0142] The processor 1001 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention.

[0143] The memory 1002 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1002 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 1002, and the processor 1001 calls and executes the network node population optimization method of the embodiment of the present invention;

[0144] Input / output interface 1003, used to implement information input and output;

[0145] The communication interface 1004 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.);

[0146] A bus 1005 , which transmits information between various components of the device (e.g., the processor 1001 , the memory 1002 , the input / output interface 1003 , and the communication interface 1004 );

[0147] The processor 1001 , the memory 1002 , the input / output interface 1003 and the communication interface 1004 are connected to each other in communication within the device via the bus 1005 .

[0148] The electronic device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0149] The contents of the method embodiments of the present invention are all applicable to the electronic device embodiments. The functions specifically implemented by the electronic device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0150] Another aspect of an embodiment of the present invention further provides a computer-readable storage medium, wherein the storage medium stores a program, and the program is executed by a processor to implement the above method.

[0151] It should be noted that the computer-readable medium shown in the embodiment of the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (Compact Disc Read to Only Memory, CD to ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0152] The contents of the method embodiments of the present invention are all applicable to the computer-readable storage medium embodiments. The functions specifically implemented by the computer-readable storage medium embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0153] The embodiment of the present invention also discloses a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device can read the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the above method.

[0154] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0155] It should be noted that, although several modules of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0156] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD to ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation of the present invention.

[0157] In some selectable embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the present invention is provided by way of example, for the purpose of providing a more comprehensive understanding of technology. The disclosed method is not limited to the operation and logic flow presented herein. Selectable embodiments are expected, wherein the order of various operations is changed and the sub-operation of a part for which is described as a larger operation is performed independently.

[0158] In addition, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise specified, one or more of the functions and / or features can be integrated into a single physical device and / or software module, or one or more functions and / or features can be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the present invention. More specifically, in view of the properties, functions and internal relationships of the various functional modules in the device disclosed herein, the actual implementation of the module will be understood within the conventional skills of the engineer. Therefore, those skilled in the art can implement the present invention set forth in the claims without excessive experimentation using ordinary techniques. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0159] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0160] The logic and / or steps represented in the flowchart or otherwise described herein, for example, may be considered as an ordered list of executable instructions for implementing logical functions, and may be embodied in any computer-readable medium for use by an instruction execution device, apparatus or device (such as a computer-based device, a device including a processor, or other device that can fetch instructions from an instruction execution device, apparatus or device and execute the instructions), or in conjunction with such instruction execution device, apparatus or device. For purposes of this specification, "computer-readable medium" may be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution device, apparatus or device, or in conjunction with such instruction execution device, apparatus or device.

[0161] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0162] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution device. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0163] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0164] Although the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

[0165] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the embodiments. Those skilled in the art can make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of the present invention.

Claims

1. A multi-cluster traffic processing method, characterized in that: The following steps are involved: In response to an interaction request between the encryption device and the target platform, establishing an encryption channel of a unified access layer between the encryption device and the target platform; Stripping the encrypted channel of the message payload to obtain device service data; the device service data includes plaintext data, link information of the encrypted channel and device source address information of the encryption device; The unique device identifier of the encryption device is obtained according to the message feature analysis of the plaintext data, and a device session is established at the target node of the unified access layer based on the unique device identifier; the device session is used to record the session record between the encryption device and the unified access layer; the session record includes device session information and first attribute information; the first attribute information includes the link information, the device source address information and the node information of the target node; The device attribute information of the encryption device is obtained by querying the unique identifier of the device, and business message interaction is performed based on the device attribute information; the device attribute information includes the first attribute information and the second attribute information, and the second attribute information includes the cluster information of the cluster to which the encryption device belongs; the content of the business message interaction includes uplink business messages and downlink business messages.

2. The multi-cluster traffic processing method according to claim 1, characterized in that: The method further comprises the following steps: In response to a device management instruction of the cluster to which it belongs to for an encryption device, calling a device routing maintenance service interface of the unified access layer according to the second attribute information of the encryption device; Based on the call of the device routing maintenance service interface, perform information management operations on the data information in the routing table of the unified access layer; The device management instruction includes adding or deleting, and the information management operation correspondingly includes writing the second attribute information or deleting the second attribute information.

3. The multi-cluster traffic processing method according to claim 1, characterized in that: The encryption device is pre-burned with the device docking address of the unified access layer; the establishment of an encryption channel between the encryption device and the unified access layer of the target platform includes the following steps: Based on the device docking address, an encryption authentication process is performed on the encryption device and the access distribution service of the unified access layer to complete the establishment of the encryption channel; The encryption authentication process includes encryption link establishment, secure transmission protocol handshake and certificate authentication.

4. The multi-cluster traffic processing method according to claim 1, characterized in that: The method further comprises the following steps: Recording the device session information and the link information and the device source address information thrown out by the encrypted channel through the message payload stripping in the device session; The device unique identifier, the link information, the device source address information, the node information and the device session information are written into a session table in the unified access layer.

5. The multi-cluster traffic processing method according to claim 1, characterized in that: The first attribute information is stored in a session table of the unified access layer, and the second attribute information is stored in a routing table of the unified access layer; and obtaining the device attribute information of the encryption device according to the device unique identifier query includes the following steps: When the content of the service message interaction is the downlink service message, querying the session table according to the device unique identifier determined by the downlink service message to obtain the first attribute information; The session table stores the device unique identifiers and the first attribute information corresponding to all the encryption devices that establish the device session in the unified access layer, and the device unique identifier and the first attribute information corresponding to each encryption device are stored in the session table in the format of an associated data group; When the content of the service message interaction is the uplink service message, querying the routing table according to the unique identifier of the device to obtain the second attribute information; The routing table stores the device unique identifiers and the second attribute information corresponding to all the encryption devices in the managed multi-cluster, and the device unique identifier and the second attribute information corresponding to each encryption device are stored in the routing table in the format of an associated data group.

6. The multi-cluster traffic processing method according to claim 1, characterized in that: When the content of the service message interaction is the downlink service message, performing service message interaction on the encryption device and the cluster to which it belongs based on the device attribute information includes the following steps: forwarding the downlink service message to a first service node in the unified access layer through the encryption device; the target node represents a service node corresponding to the encryption device; the first service node represents any service node in the unified access layer; Determine, based on the first attribute information, a second service node where the device session corresponding to a target encryption device is located; the target encryption device represents a device to which the downlink service message is sent; The downlink service message is routed from the first service node to the second service node through a remote procedure call, and then the downlink service message is sent to the target encryption device through the device session and the encryption channel corresponding to the target encryption device.

7. The multi-cluster traffic processing method according to claim 1, characterized in that: When the content of the service message interaction is the uplink service message, performing service message interaction on the encryption device and the cluster to which it belongs based on the device attribute information includes the following steps: Determine the cluster to which the encryption device belongs based on the second attribute information; The uplink service message is transferred to the device access service of the cluster to which it belongs through a preset connection method, so that the cluster to which it belongs performs process analysis on the uplink service message; the preset connection method includes a dedicated line connection or an intra-cloud peer connection.

8. A multi-cluster traffic processing device, characterized in that: include: The first module is used to establish an encryption channel of a unified access layer between the encryption device and the target platform in response to an interaction request between the encryption device and the target platform; The second module is used to strip the message payload of the encrypted channel to obtain device service data; the device service data includes plaintext data, link information of the encrypted channel and device source address information of the encryption device; The third module is used to obtain the unique device identifier of the encryption device according to the message feature analysis of the plaintext data, and establish a device session at the target node of the unified access layer based on the unique device identifier; the device session is used to record the session record between the encryption device and the unified access layer; the session record includes device session information and first attribute information; the first attribute information includes the link information, the device source address information and the node information of the target node; The fourth module is used to obtain the device attribute information of the encryption device according to the device unique identifier, and perform business message interaction based on the device attribute information; the device attribute information includes the first attribute information and the second attribute information, and the second attribute information includes the cluster information of the cluster to which the encryption device belongs; the content of the business message interaction includes uplink business messages and downlink business messages.

9. An electronic device, characterized in that: including a processor and a memory; The memory is used to store programs; The processor executes the program to implement the method according to any one of claims 1 to 7.

10. A computer storage medium storing a program executable by a processor, characterized in that: The program executable by the processor is used to implement the method according to any one of claims 1 to 7 when executed by the processor.

Images