Data communication method and device, video protection equipment and storage medium

Abstract

The embodiment of the invention discloses a data communication method and device, video protection equipment and a storage medium, and relates to the technical field of communication, and the method comprises the steps: receiving a first request data packet sent by external network equipment through a first external network port; modifying the destination address of the first request data packet from the address of the camera to the address of the video protection device to obtain a target request data packet; sending the target request data packet to a kernel of the video protection equipment by using an internal network port, so that the kernel generates a target response data packet of the target request data packet; obtaining a target response data packet from the kernel by using an internal network port; modifying the source address of the target response data packet from the address of the video protection device to the address of the camera to obtain a first response data packet; the first response data packet is sent to the external network equipment by using the first external network port, the video protection equipment can multiplex the public network IP address of the camera, the connection mode of the camera does not need to be changed, and the deployment cost of the video protection equipment is reduced.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communication technology, and in particular, to a data communication method, apparatus, video protection equipment, and storage medium. Background Art

[0002] At present, when video protection equipment is deployed for cameras, there are two ways to deploy the video protection equipment: 1. Add a dedicated line to the existing link of the camera, connect the video protection equipment and the switch, and allocate a public Internet Protocol Address (IP address) to the video protection equipment, while keeping the public IP address of the camera unchanged, so as to realize communication control of the camera and the video protection equipment respectively through different dedicated lines; 2. Deploy a firewall at the front end of the camera and the video protection equipment, allocate a public IP address to the firewall, allocate a private IP address to the video protection equipment, and change the public IP address of the camera to the private IP address. At this time, the firewall realizes communication control of the camera and the video protection equipment through the Network Address Translation (NAT) technology, so as to prevent the exposure of the private IP address.

[0003] However, in the above-mentioned method of adding dedicated lines, it is difficult to allocate public IP addresses to a large number of video protection devices due to the limited resources of public IP addresses; and in the above-mentioned method of deploying firewalls, changing the public IP address of the camera to a private IP address will change the connection method of the camera, thereby increasing the deployment cost of the video protection equipment. Summary of the invention

[0004] The embodiments of the present application provide a data communication method, apparatus, video protection equipment and storage medium, which realize data communication functions and reduce the deployment cost of video protection equipment, so as to solve the problem in the prior art that it is difficult to allocate public IP addresses to a large number of video protection devices and increase the deployment cost of video protection equipment.

[0005] In a first aspect, an embodiment of the present application provides a data communication method, which is applied to a video protection device in a data communication system, wherein the data communication system also includes an external network device and a camera protected by the video protection device, the video protection device includes an external network port and an internal network port, the external network port includes a first external network port provided for the external network device, and the method includes:

[0006] Receive a first request data packet sent by an external network device using a first external network port;

[0007] The destination address of the first request data packet is modified from the address of the camera to the address of the video protection device to obtain a target request data packet;

[0008] Using the internal network port to send a target request data packet to the kernel of the video protection device, so that the kernel generates a target response data packet of the target request data packet;

[0009] Use the internal network port to obtain the target response data packet from the kernel;

[0010] Modify the source address of the target response data packet from the address of the video protection device to the address of the camera to obtain a first response data packet;

[0011] A first response data packet is sent to the external network device using the first external network port.

[0012] In an embodiment of the present application, the video protection device can use the first external network port to receive a first request data packet sent by an external network device, and modify the destination address of the first request data packet from the address of the camera to the address of the video protection device to obtain a target request data packet, and then use the internal network port to send the target request data packet to the kernel of the video protection device, so that the kernel generates a target response data packet for the target request data packet, and use the internal network port to obtain the target response data packet from the kernel, and then modify the source address of the target response data packet from the address of the video protection device to the address of the camera to obtain a first response data packet, and use the first external network port to send the first response data packet to the external network device. In the above technical scheme, by changing the destination address in the first request data packet from the address of the camera to the address of the video protection device, and changing the source address of the target response data packet from the address of the video protection device to the address of the camera, the video protection device can reuse the public IP address of the camera, without allocating a public IP address to the video protection device, thereby reducing the number of allocated public IP addresses, solving the problem of difficulty in allocating public IP addresses to a large number of video protection devices in the prior art, and keeping the IP address of the camera unchanged as the public IP address, without changing the connection method of the camera, solving the problem of increasing the deployment cost of the video protection device in the prior art, thereby reducing the deployment cost of the video protection device; and, by using the public IP address of the camera to communicate with external network devices, the video protection device has an address conversion function, which can avoid exposing the private IP address of the video protection device, making it difficult for external network devices to directly access the internal network structure of the video protection device, thereby increasing the security of the network.

[0013] In a second aspect, an embodiment of the present application provides a data communication device, which is applied to a video protection device in a data communication system, wherein the data communication system also includes an external network device and a camera protected by the video protection device, the video protection device includes an external network port and an internal network port, the external network port includes a first external network port provided for the external network device, and the device includes:

[0014] A receiving module, used for receiving a first request data packet sent by an external network device through a first external network port;

[0015] A first address conversion module, used to modify the destination address of the first request data packet from the address of the camera to the address of the video protection device, to obtain a target request data packet;

[0016] A first sending module is used to send a target request data packet to the kernel of the video protection device by using the internal network port, so that the kernel generates a target response data packet of the target request data packet;

[0017] The acquisition module is used to obtain the target response data packet from the kernel using the internal network port;

[0018] A second address conversion module is used to modify the source address of the target response data packet from the address of the video protection device to the address of the camera to obtain a first response data packet;

[0019] The second sending module is used to send a first response data packet to the external network device by using the first external network port.

[0020] In a third aspect, an embodiment of the present application provides a video protection device, the video protection device comprising:

[0021] at least one processor; and a memory communicatively coupled to the at least one processor;

[0022] The memory stores a computer program that can be executed by at least one processor, and the computer program is executed by at least one processor so that the at least one processor can execute the data communication method of any embodiment of the present application.

[0023] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a data communication method as in any embodiment of the present application.

[0024] The description of the second, third and fourth aspects in this application can refer to the detailed description of the first aspect; and the beneficial effects described in the second, third and fourth aspects can refer to the beneficial effect analysis of the first aspect, which will not be repeated here.

[0025] In this application, the name of the above-mentioned data communication device does not limit the device or functional module itself. In actual implementation, these devices or functional modules may appear with other names. As long as the functions of each device or functional module are similar to those of this application, they fall within the scope of the claims of this application and their equivalent technologies.

[0026] These and other aspects of the present application will become more apparent from the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0028] Figure 1 It is a flow chart of a data communication method provided by an embodiment of the present application;

[0029] Figure 2 is a structural diagram of a data communication system provided in an embodiment of the present application;

[0030] Figure 3 is another flowchart of the data communication method provided by an embodiment of the present application;

[0031] Figure 4 is another structural schematic diagram of the data communication system provided in an embodiment of the present application;

[0032] Figure 5 is a structural diagram of a data communication device provided in an embodiment of the present application;

[0033] Figure 6 It is a structural schematic diagram of the video protection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this application.

[0035] It should be noted that the terms "first", "second", "target", and "original" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including", "having", and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0036] Figure 1 This is a flow chart of a data communication method provided by an embodiment of the present application. This embodiment can be applied to a scenario where the address of a video protection device is protected when a camera is protected by a video protection device. A data communication method provided by this embodiment can be executed by a data communication device provided by an embodiment of the present application, and the device can be implemented by software and / or hardware. In a specific embodiment, the data communication device can be integrated in a video protection device in a data communication system.

[0037] In a specific embodiment, the structure of the data communication system can be as follows: Figure 2 As shown, Figure 2 The data communication system shown includes a video protection device, an external network device and a camera protected by the video protection device; wherein the video protection device may include a core, an external network port and an internal network port; the video protection device can communicate with the external network device and the camera respectively through the external network port, and can communicate with the core through the internal network port; wherein the external network device may include a video surveillance device and a video protection management device, etc.

[0038] Optionally, the external network port of the video protection device may include a first external network port provided for the external network device. In this case, the video protection device can be communicatively connected with the external network device through the first external network port.

[0039] Optionally, an IP address can be pre-assigned to the camera, in which case the IP address is a public IP address (ie, the public IP address of the camera remains unchanged), and an IP address can be pre-assigned to the video protection device, in which case the IP address is a private IP address.

[0040] Combine the following Figure 2 The data communication system shown in the figure is used to illustrate a data communication method provided by an embodiment of the present application. The execution subject of the method can be a video protection device in the data communication system. Figure 1 The data communication method of this embodiment includes but is not limited to the following steps:

[0041] S110: Receive a first request data packet sent by an external network device through a first external network port.

[0042] The first request data packet is a data packet initiated by an external network device (such as a video monitoring device and a video protection management device, etc.) and sent to the video protection device through the network. Exemplarily, the first request data packet may be a status query data packet.

[0043] Specifically, the first external network port can be used to receive a first request data packet sent by an external network device. For example, a specific network port (referred to as a target network port) can be monitored in real time on the first external network port to receive data packets from the external network device, wherein the target network port is a port for receiving request data packets and response data packets sent by the external network device to the video protection device, and there can be multiple target network ports; when the external network device sends a request data packet to the target network port, the video protection device can use the first external network port to capture the request data packet sent by the external network device to the target network port in real time, and determine the request data packet as the first request data packet.

[0044] Optionally, after receiving the first request data packet, the first request data packet may be verified, including verifying the integrity and checksum of the first request data packet, etc., to ensure that the first request data packet has not been tampered with or damaged during transmission.

[0045] S120: Modify the destination address of the first request data packet from the address of the camera to the address of the video protection device to obtain a target request data packet.

[0046] The destination address is the final address to which the first request data packet should be sent in the network; the destination address may be an IP address. The target request data packet is a data packet obtained after performing destination address conversion on the first request data packet.

[0047] Specifically, since the IP address pre-assigned to the camera is a public IP address, and the IP address pre-assigned to the video protection device is a private IP address, in order to prevent the private IP address of the video protection device from being exposed, the video protection device can reuse the public IP address of the camera when communicating with an external network device. Therefore, the source IP address in the data packet sent by the video protection device to the external network device is the public IP address of the camera, and the destination IP address in the data packet sent by the external network device to the video protection device is the public IP address of the camera.

[0048] Therefore, after obtaining the first request data packet, the first request data packet can be parsed, and when it is determined that the target device corresponding to the first request data packet (that is, the device actually accessed by the first request data packet) is a video protection device, the destination address is extracted from the first request data packet. At this time, the destination address is the address of the camera (that is, the public IP address of the camera). Since the target device corresponding to the first request data packet at this time is the video protection device, it is necessary to modify the destination address of the first request data packet from the address of the camera to the address of the video protection device, that is, to modify the destination IP address of the first request data packet from the public IP address of the camera to the private IP address of the video protection device.

[0049] After the destination address of the first request data packet is modified from the address of the camera to the address of the video protection device, the port number corresponding to the destination port field (recorded as the external port number) can be extracted from the first request data packet, and the preset port mapping table is queried based on the external port number to query the internal port number corresponding to the external port number, and then the field content of the destination port in the first request data packet is modified to the internal port number, and the first request data packet is repackaged to ensure that other fields (such as source IP address, source port and data content, etc.) remain unchanged to obtain the target request data packet. Among them, the preset port mapping table is a pre-set mapping table used for port conversion between the public network and the private network, that is, mapping the specific port requested by the external network to the port in the internal network; the preset port mapping table can store the mapping relationship between the external port number and the internal port number; the external port number is the port number used by the external network device when sending a data packet, that is, the field content of the destination port in the first request data packet; the internal port number is the port number used by the video protection device, that is, the field content of the destination port in the target request data packet.

[0050] Exemplarily, it is known that the preset port mapping table includes {external port number 1: internal port number 1, external port number 2: internal port number 2, external port number 3: internal port number 3}, and the destination port in the first request data packet is external port number 2, then the destination port in the target request data packet is internal port number 2.

[0051] S130 , sending a target request data packet to the kernel of the video protection device by using the internal network port, so that the kernel generates a target response data packet of the target request data packet.

[0052] The target response data packet is a response data packet used by the core of the video protection device to reply to the target request data packet. Exemplarily, the target response data packet may include a processing result or requested data.

[0053] Specifically, after obtaining the target request data packet, the target request data packet may be sent to the kernel using the internal network port.

[0054] Afterwards, the kernel can receive the target request data packet, parse and process the target request data packet, and then perform corresponding operations according to the request content in the target request data packet, such as querying status, processing data requests, and executing security policies; then generate a target response data packet according to the execution result, that is, the target response data packet can include source IP address, source port, destination IP address, destination port and data content, etc., where the source IP address is the private network IP address of the video protection device, the destination IP address is the IP address of the external network device, the source port is the destination port in the target request data packet, the destination port is the source port in the target request data packet, and the data content is the execution result.

[0055] Exemplarily, when the first request data packet is a status query request, the data content in the target response data packet generated by the kernel is the current status of the video protection device.

[0056] S140, using the internal network port to obtain the target response data packet from the kernel.

[0057] Specifically, after sending a target request data packet to the kernel of the video protection device by using the internal network port, a target response data packet generated by the kernel can be captured on the internal network port based on a packet capture tool.

[0058] S150: modify the source address of the target response data packet from the address of the video protection device to the address of the camera to obtain a first response data packet.

[0059] The source address is the source IP address in the target response data packet. The first response data packet is a data packet obtained after performing source address conversion on the target response data packet.

[0060] Specifically, after obtaining the target response data packet from the kernel using the internal network port, the target response data packet can be parsed and the destination IP address can be extracted. Then, when it is determined that the destination IP address is an external network device, the source IP address can be extracted from the target response data packet. At this time, the source IP address is the private IP address of the video protection device. In order to prevent the private IP address of the video protection device from being exposed, the source IP address can be modified from the address of the video protection device (i.e., the private IP address of the video protection device) to the address of the camera (i.e., the public IP address of the camera).

[0061] After the source address of the target response data packet is changed from the address of the video protection device to the address of the camera, the port number corresponding to the source port field (recorded as the internal port number) can be extracted from the target response data packet, and the preset port mapping table is queried based on the internal port number to query the external port number corresponding to the internal port number, and then the field content of the source port in the target response data packet is modified to the external port number, and the target response data packet is re-encapsulated to ensure that other fields (such as the destination IP address, destination port and data content, etc.) remain unchanged to obtain the first response data packet.

[0062] S160: Send a first response data packet to the external network device by using the first external network port.

[0063] Specifically, after obtaining the first response data packet, the first response data packet may be sent to a specific port of the external network device (ie, the destination port in the first response data packet) by using the first external network port.

[0064] According to the technical solution of the embodiment of the present application, the video protection device can use the first external network port to receive a first request data packet sent by an external network device, and modify the destination address of the first request data packet from the address of the camera to the address of the video protection device to obtain a target request data packet, and then use the internal network port to send the target request data packet to the kernel of the video protection device, so that the kernel generates a target response data packet for the target request data packet, and use the internal network port to obtain the target response data packet from the kernel, and then modify the source address of the target response data packet from the address of the video protection device to the address of the camera to obtain a first response data packet, and use the first external network port to send the first response data packet to the external network device. In the above technical scheme, by changing the destination address in the first request data packet from the address of the camera to the address of the video protection device, and changing the source address of the target response data packet from the address of the video protection device to the address of the camera, the video protection device can reuse the public IP address of the camera, without allocating a public IP address to the video protection device, thereby reducing the number of allocated public IP addresses, solving the problem of difficulty in allocating public IP addresses to a large number of video protection devices in the prior art, and keeping the IP address of the camera unchanged as the public IP address, without changing the connection method of the camera, solving the problem of increasing the deployment cost of the video protection device in the prior art, thereby reducing the deployment cost of the video protection device; and, by using the public IP address of the camera to communicate with external network devices, the video protection device has an address conversion function, which can avoid exposing the private IP address of the video protection device, making it difficult for external network devices to directly access the internal network structure of the video protection device, thereby increasing the security of the network.

[0065] The following further describes a data communication method provided by an embodiment of the present application. Figure 3 1 is another flow chart of the data communication method provided by the embodiment of the present application. The embodiment of the present application is optimized on the basis of the above embodiments.

[0066] Optional, such as Figure 4 Shown is another structural schematic diagram of the data communication system provided by an embodiment of the present application, wherein the external network port of the video protection device also includes a second external network port provided for the camera, and the internal network port may include a first pair of internal network ports provided for the first external network port and a second pair of internal network ports provided for the kernel; at this time, the video protection device can be communicated with the external network device through the first external network port, can be communicated with the camera through the second external network port, and can be communicated with the kernel through the second pair of internal network ports; at the same time, the first pair of internal network ports and the second pair of internal network ports are electrically connected through wires, and the first pair of internal network ports and the first external network port can be communicated with each other.

[0067] See also Figure 3 The method of this embodiment includes but is not limited to the following steps:

[0068] S301: Receive a first request data packet sent by an external network device through a first external network port.

[0069] S302: Determine the actual access device according to the first request data packet.

[0070] The actually accessed device is the device actually accessed by the first request data packet.

[0071] Specifically, since data packets of external network devices accessing the video protection device and the camera will be sent to the video protection device, after using the first external network port to receive the first request data packet sent by the external network device, the actual access device of the first request data packet can be determined.

[0072] In a possible implementation, the first request data packet can be parsed to obtain an initial five-tuple. When the preset port mapping table includes the destination port in the initial five-tuple, it is determined that the actual access device is a video protection device; when the preset port mapping table does not include the destination port in the initial five-tuple, it is determined that the actual access device is a camera. The initial five-tuple may include a source IP address, a source port, a destination IP address, a destination port, and a transport layer protocol. The source IP address is the IP address of the initiator of the first request data packet, which is used to identify the network location of the device or server (i.e., the external network device) that sends the data. The source port is the identifier of the application or service that sends the first request data packet on the network, which is used to distinguish the data streams of different applications or services on the same external network device. The destination IP address is the IP address of the target recipient of the first request data packet, which is used to identify the network location of the device or server that receives the data. In this case, the destination IP address is the public IP address of the camera. The destination port is the identifier of the application or service that receives the first request data packet on the network. The transport layer protocol is the transport layer protocol used by the first request data packet, which may include the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP). In an embodiment of the present application, by parsing the initial five-tuple and querying the preset port mapping table, the actual access device of the first request data packet can be quickly determined, thereby improving the accuracy and efficiency of determining the actual access device, providing a basis for determination for subsequent address conversion, thereby avoiding invalid transmission of data packets in the network and improving the overall processing efficiency of the network.

[0073] In another possible implementation, since the physical addresses of the video protection device and the camera are different and unique, the first request data packet can be parsed to obtain the destination physical address, and the actual access device can be determined based on the destination physical address. In the embodiment of the present application, the actual access device can be directly and accurately located by determining the actual access device through the destination physical address, thereby improving the accuracy and efficiency of determining the actual access device and providing a basis for subsequent address conversion.

[0074] S303: Determine whether the actual access device is a video protection device.

[0075] Specifically, if it is determined that the actual access device is a video protection device, S304 may be executed; if it is determined that the actual access device is a camera, S309 may be executed.

[0076] S304: When the actual access device is a video protection device, the destination address of the first request data packet is modified from the address of the camera to the address of the video protection device to obtain a target request data packet.

[0077] Specifically, the implementation process and technical principle of S304 are the same as those of S120, and reference may be made to the description of S120 above, which will not be repeated here.

[0078] S305: Send a target request data packet to the kernel of the video protection device by using the internal network port, so that the kernel generates a target response data packet for the target request data packet.

[0079] Specifically, the second pair of internal network ports can be used to send a target request data packet to the kernel of the video protection device, so that the kernel generates a target response data packet of the target request data packet. The specific implementation details are the same as S130, and the description of S130 can be referred to above, which will not be repeated here.

[0080] S306, using the internal network port to obtain the target response data packet from the kernel.

[0081] Specifically, the target response data packet can be obtained from the kernel using the second pair of internal network ports.

[0082] S307: Modify the source address of the target response data packet from the address of the video protection device to the address of the camera to obtain a first response data packet.

[0083] Specifically, the implementation process and technical principle of S307 are the same as those of S150, and reference may be made to the description of S150 above, which will not be repeated here.

[0084] S308: Send a first response data packet to the external network device using the first external network port.

[0085] S309: When the actual access device is a camera, use the second external network port to send a first request data packet to the camera, so that the camera generates a second response data packet to the first request data packet.

[0086] The second response data packet is a response data packet used by the camera to reply to the first request data packet. Exemplarily, the second response data packet may include video data requested by the external network device.

[0087] Specifically, when the actual access device is a camera, the video protection device can use the data plane development kit (DPDK) technology to forward the first request data packet with zero copy, without performing address conversion on the first request data packet. At this time, the second external network port can be used to send the first request data packet to the camera.

[0088] Afterwards, the camera can receive the first request data packet sent by the video protection device, parse and process the first request data packet, and then perform corresponding operations according to the request content in the first request data packet, such as processing data requests, etc., and then generate a second response data packet according to the execution result, that is, the second response data packet can include source IP address, source port, destination IP address, destination port and data content, etc., wherein the source IP address is the public IP address of the camera, the destination IP address is the IP address of the external network device, the source port is the destination port in the first request data packet, and the destination port is the source port in the first request data packet; the data content is the execution result; afterward, the second response data packet can be sent to the video protection device.

[0089] S310: Receive a second response data packet sent by the camera using the second external network port, and send the second response data packet to the external network device using the first external network port.

[0090] Specifically, after using the second external network port to send a first request data packet to the camera, the second external network port can be used to receive a second response data packet sent by the camera, and the second response data packet can be parsed. When it is determined that the destination IP address in the second response data packet is an external network device, the first external network port is used to send a second response data packet to the external network device.

[0091] It should be noted that there is no obvious order in which S304 to S308 and S309 to S310 are executed. The order of execution can be determined according to actual conditions, and this embodiment does not make any specific limitation on this.

[0092] Optionally, the second request data packet generated by the kernel can be obtained by using the second pair of internal network ports, and when the preset port mapping table includes the destination port in the second request data packet, the source address of the second request data packet is modified from the address of the video protection device to the address of the camera to obtain a target active request data packet, and then the target active request data packet is sent to the external network device by using the first external network port, so that the external network device generates a target active response data packet for the target active request data packet, and then the target active response data packet sent by the external network device is received by using the first external network port, and when it is determined that the actual access device of the target active response data packet is the video protection device, the destination address of the target active response data packet is modified from the address of the camera to the address of the video protection device to obtain a third response data packet, and then the third response data packet is sent to the kernel by using the second pair of internal network ports, which can avoid exposing the private IP address of the video protection device, making it difficult for external network devices to directly access the internal network structure of the video protection device, thereby increasing the security of the network. Among them, the second request data packet is a request data packet actively generated by the video protection device, which is used to request data from the external access device, and the source IP address is the IP address of the video protection device; the target active request data packet is a data packet obtained after the source address of the second request data packet is converted, and the source IP address is the IP address of the camera; the target active response data packet is a response data packet used by the external network device to reply to the target active request data packet, and the destination IP address is the IP address of the camera; the third response data packet is a data packet obtained after the destination address of the target active response data packet is converted, and the destination IP address is the IP address of the video protection device.

[0093] The technical solution of the embodiment of the present application can use the first external network port to receive the first request data packet sent by the external network device, and determine the actual access device according to the first request data packet. Then, when the actual access device is a video protection device, the destination address of the first request data packet is modified from the address of the camera to the address of the video protection device to obtain the target request data packet, and the target request data packet is sent to the kernel of the video protection device using the internal network port, so that the kernel generates a target response data packet of the target request data packet, and then the target response data packet is obtained from the kernel using the internal network port, and the source address of the target response data packet is modified from the address of the video protection device to the address of the camera to obtain the first response data packet, and then the first external network port is used to send the first response data packet to the external network device. The video protection device reduces the deployment cost of the video protection device by reusing the public IP address of the camera, and can avoid exposing the private IP address of the video protection device through address conversion, thereby increasing the security of the network.

[0094] When the actual access device is a camera, a first request data packet is sent to the camera using the second external network port, so that the camera generates a second response data packet for the first request data packet, and then the second response data packet sent by the camera is received using the second external network port, and the second response data packet is sent to the external network device using the first external network port. By forwarding business traffic (such as data packets accessing the camera and data packets accessing the external network device from the camera) in real time, the forwarding delay can be reduced, and real-time business in the data communication system will not be affected. At the same time, the video protection device, as an intermediate layer, can filter and review all data packets accessing the camera and the video protection device, intercept data packets that are not for accessing the camera, and thus effectively prevent malicious requests from reaching the camera, thereby reducing the risk of the camera being illegally accessed or controlled.

[0095] Figure 5 is a schematic diagram of a data communication device provided in an embodiment of the present application, referring to Figure 5 , the data communication device may include:

[0096] The receiving module 510 is used to receive a first request data packet sent by an external network device through a first external network port;

[0097] A first address conversion module 520 is used to modify the destination address of the first request data packet from the address of the camera to the address of the video protection device to obtain a target request data packet;

[0098] The first sending module 530 is used to send a target request data packet to the kernel of the video protection device by using the internal network port, so that the kernel generates a target response data packet of the target request data packet;

[0099] The acquisition module 540 is used to acquire the target response data packet from the kernel using the internal network port;

[0100] The second address conversion module 550 is used to modify the source address of the target response data packet from the address of the video protection device to the address of the camera to obtain a first response data packet;

[0101] The second sending module 560 is used to send a first response data packet to the external network device by using the first external network port.

[0102] In one embodiment, the data communication apparatus further includes a device determination module, and the device determination module is specifically used to:

[0103] Before the destination address of the first request data packet is modified from the address of the camera to the address of the video protection device and the target request data packet is obtained, the actual access device is determined according to the first request data packet;

[0104] When the actual access device is a video protection device, the destination address of the first request data packet is modified from the address of the camera to the address of the video protection device, thereby obtaining a target request data packet.

[0105] In one embodiment, the external network port includes a second external network port provided for the camera, and the data communication device also includes a forwarding module, which is specifically used to:

[0106] After determining the actual access device according to the first request data packet, when the actual access device is a camera, using the second external network port to send the first request data packet to the camera, so that the camera generates a second response data packet to the first request data packet;

[0107] The second response data packet sent by the camera is received by using the second external network port, and the second response data packet is sent to the external network device by using the first external network port.

[0108] In one embodiment, the device determination module determines the actual access device according to the first request data packet, including:

[0109] Parse the first request data packet to obtain an initial five-tuple;

[0110] When the preset port mapping table includes the destination port in the initial five-tuple, determining that the actual access device is a video protection device;

[0111] When the preset port mapping table does not include the destination port in the initial quintuple, it is determined that the actual access device is a camera.

[0112] In one embodiment, the device determination module determines the actual access device according to the first request data packet, including:

[0113] Parsing the first request data packet to obtain a destination physical address;

[0114] The actual access device is determined based on the destination physical address.

[0115] In one embodiment, the data communication device further includes an active request module, and the active request module is specifically used to:

[0116] Using the internal network port to obtain the second request data packet generated by the kernel;

[0117] When the preset port mapping table includes the destination port in the second request data packet, modifying the source address of the second request data packet from the address of the video protection device to the address of the camera, to obtain a target active request data packet;

[0118] The target active request data packet is sent to the external network device by using the first external network port, so that the external network device generates a target active response data packet for the target active request data packet.

[0119] In one embodiment, the internal network ports include a first pair of internal network ports provided for the first external network port and a second pair of internal network ports provided for the kernel.

[0120] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example for illustration. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the functional modules described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0121] The data communication device provided in this embodiment can be applied to the data communication method provided in any of the above embodiments, and has corresponding functions and beneficial effects.

[0122] Figure 6 It is a structural schematic diagram of the video protection device provided in an embodiment of the present application. Figure 6 A block diagram of an exemplary video protection device 11 suitable for implementing embodiments of the present application is shown. Figure 6 The video protection device 11 shown is only an example and should not bring any limitation to the function and scope of use of the present embodiment.

[0123] like Figure 6 As shown, the video protection device 11 is in the form of a general purpose computing electronic device. The components of the video protection device 11 may include, but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 connecting different system components (including the system memory 28 and the processing unit 16).

[0124] Bus 18 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. By way of example, these architectures include, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MAC) bus, an Enhanced ISA bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0125] The video protection device 11 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the video protection device 11, including volatile and non-volatile media, removable and non-removable media.

[0126] The system memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. The video protection device 11 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be used to read and write non-removable, non-volatile magnetic media ( Figure 6 not shown, usually called a "hard drive"). Although Figure 6 Not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical medium) may be provided. In these cases, each drive may be connected to the bus 18 via one or more data medium interfaces. The system memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present application.

[0127] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in system memory 28, such program modules 42 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. Program modules 42 generally perform the functions and / or methods of the embodiments described herein.

[0128] The video protection device 11 may also communicate with one or more external devices 14 (e.g., keyboards, pointing devices, displays 24, etc.), one or more devices that enable a user to interact with the video protection device 11, and / or any device that enables the video protection device 11 to communicate with one or more other computing devices (e.g., network cards, modems, etc.). Such communication may be performed via an input / output (I / O) interface 22. Furthermore, the video protection device 11 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 20.

[0129] like Figure 6 As shown, the network adapter 20 communicates with other modules of the video protection device 11 via the bus 18. It should be understood that although Figure 6 Not shown, other hardware and / or software modules may be used in conjunction with the video protection device 11, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0130] The processing unit 16 executes various functional applications and page displays by running programs stored in the system memory 28, such as implementing a data communication method provided in any embodiment of the present application.

[0131] An embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, a data communication method provided by any embodiment of the present application is implemented, for example.

[0132] The computer storage medium of this embodiment can adopt any combination of one or more computer-readable media. Computer-readable media can be computer-readable signal media or computer-readable storage media. Computer-readable storage media can be, for example, but not limited to: electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: electrical connections with one or more wires, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above. In this document, computer-readable storage media can be any tangible medium containing or storing programs, which can be used by instruction execution systems, devices or devices or used in combination with them.

[0133] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0134] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0135] Computer program code for performing the operation of the present application can be written in one or more programming languages ​​or combinations thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer, partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (e.g., using an Internet service provider to connect through the Internet).

[0136] It should be understood by those skilled in the art that the above modules or steps of the present application can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, optionally, they can be implemented by a program code executable by a computer device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.

[0137] In addition, the acquisition, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0138] Note that the above are only preferred embodiments of the present application and the technical principles used. Those skilled in the art will understand that the present application is not limited to the specific embodiments herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present application. Therefore, although the present application is described in more detail through the above embodiments, the present application is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the inventive concept of the present application, and the scope of the present application is determined by the scope of the appended claims.

Claims

1. A data communication method, characterized in that: A video protection device applied to a data communication system, wherein the data communication system further includes an external network device and a camera protected by the video protection device, wherein the video protection device includes an external network port and an internal network port, wherein the external network port includes a first external network port provided for the external network device, and wherein the method includes: Receive a first request data packet sent by the external network device using the first external network port; Modify the destination address of the first request data packet from the address of the camera to the address of the video protection device to obtain a target request data packet; Sending the target request data packet to the kernel of the video protection device by using the internal network port, so that the kernel generates a target response data packet of the target request data packet; Obtaining the target response data packet from the kernel using the internal network port; Modify the source address of the target response data packet from the address of the video protection device to the address of the camera to obtain a first response data packet; The first response data packet is sent to the external network device by using the first external network port.

2. The data communication method according to claim 1, characterized in that: Before the destination address of the first request data packet is modified from the address of the camera to the address of the video protection device to obtain the target request data packet, the method further includes: Determine the actual access device according to the first request data packet; When the actual access device is the video protection device, the destination address of the first request data packet is modified from the address of the camera to the address of the video protection device to obtain a target request data packet.

3. The data communication method according to claim 2, characterized in that: The external network port includes a second external network port provided for the camera, and after determining the actual access device according to the first request data packet, further includes: When the actual access device is the camera, using the second external network port to send the first request data packet to the camera, so that the camera generates a second response data packet to the first request data packet; The second response data packet sent by the camera is received by using the second external network port, and the second response data packet is sent to the external network device by using the first external network port.

4. The data communication method according to claim 2, characterized in that: The determining the actual access device according to the first request data packet comprises: Parsing the first request data packet to obtain an initial five-tuple; When the preset port mapping table includes the destination port in the initial quintuple, determining that the actual access device is the video protection device; When the preset port mapping table does not include the destination port in the initial quintuple, it is determined that the actual access device is the camera.

5. The data communication method according to claim 2, characterized in that: The determining the actual access device according to the first request data packet comprises: Parsing the first request data packet to obtain a destination physical address; The actual access device is determined according to the destination physical address.

6. The data communication method according to claim 1, characterized in that: The method further comprises: Using the internal network port to obtain a second request data packet generated by the kernel; When the preset port mapping table includes the destination port in the second request data packet, modifying the source address of the second request data packet from the address of the video protection device to the address of the camera, to obtain a target active request data packet; The target active request data packet is sent to the external network device by using the first external network port, so that the external network device generates a target active response data packet for the target active request data packet.

7. The data communication method according to claim 1, characterized in that: The internal network ports include a first pair of internal network ports provided for the first external network port and a second pair of internal network ports provided for the kernel.

8. A data communication device, characterized in that: A video protection device applied to a data communication system, wherein the data communication system further includes an external network device and a camera protected by the video protection device, wherein the video protection device includes an external network port and an internal network port, wherein the external network port includes a first external network port provided for the external network device, and wherein the device includes: A receiving module, configured to receive, by using the first external network port, a first request data packet sent by the external network device; A first address conversion module, used to modify the destination address of the first request data packet from the address of the camera to the address of the video protection device, to obtain a target request data packet; A first sending module, configured to send the target request data packet to the kernel of the video protection device by using the internal network port, so that the kernel generates a target response data packet of the target request data packet; An acquisition module, used for acquiring the target response data packet from the kernel using the internal network port; A second address conversion module, used to modify the source address of the target response data packet from the address of the video protection device to the address of the camera, to obtain a first response data packet; The second sending module is used to send the first response data packet to the external network device by using the first external network port.

9. A video protection device, characterized in that: The video protection equipment includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the data communication method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the data communication method according to any one of claims 1 to 7 is implemented.

Images