Data packet transmission method and electronic equipment

Abstract

The invention discloses a data packet transmission method and electronic equipment, and the method comprises the steps that a transmission layer packages application data of an application program into a first message according to a path of a target route corresponding to a virtual network card, the first message is stored in a shared memory, and the shared memory is a memory in a kernel mode. And the VPN service reads the first message from a shared memory, wherein the shared memory is set to allow the service operation in the user mode. And the VPN service processes the first message to obtain a second message, and sends the second message to the network layer. And the network layer processes the second message to obtain a first data packet, and sends the first data packet to a VPN server corresponding to the VPN service through a physical network card. Therefore, in the process, the VPN service reads the message from the shared memory in the kernel mode according to the sharing mechanism, and only needs to undergo transmission layer processing and network layer processing once, so that redundancy processing is reduced, power consumption is reduced, memory occupation is reduced, and data forwarding performance is improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the technical field of data transmission, and in particular to a method and electronic device for transmitting a data packet. Background Art

[0002] With the rapid development of electronic devices, electronic devices can use the HarmonyOS system, which supports the virtual private network (VPN) function. A virtual private network refers to a logical network built on the network platform (such as the Internet, ATM, Frame Relay, etc.) provided by a public network service provider, where user data is transmitted in the logical link.

[0003] At present, the data packet transmission method is usually: after the application data is encapsulated by the TCP / UDP protocol stack of the transport layer, it is sent to the network layer for filtering to obtain a data packet. Then the data packet is stored in the kernel state memory. The data in the memory is copied to the kernel state hard disk. The user state VPN service reads the data packet from the hard disk, and after being processed by the VPN service, the processed data packet is encapsulated by the TCP / UDP protocol stack of the transport layer again, and filtered by the network layer again, and then sent to the VPN server through the physical network card. It can be seen that during the transmission of the data packet, the data packet needs to be stored on the kernel state hard disk, and needs to be processed twice by the transport layer and twice by the network layer before the data packet can be transmitted from the kernel state to the user state and sent out. There is redundant processing, resulting in high power consumption, high memory usage, and poor data forwarding performance. Summary of the invention

[0004] The embodiments of the present application provide a data packet transmission method and an electronic device, which reduce redundant processing, lower power consumption, reduce memory usage, and improve data forwarding performance.

[0005] In order to achieve the above-mentioned purpose, the embodiment of the present application adopts the following technical solution.

[0006] In the first aspect, the embodiment of the present application provides a method for transmitting a data packet, the execution subject of the method can be an electronic device, or a component located in the electronic device (for example, a chip, a chip system or a processor, etc.), and the following description is made by taking the execution subject as an electronic device as an example. The method includes: the transport layer encapsulates the application data of the application into a first message according to the path of the target route corresponding to the virtual network card, the first message is stored in a shared memory, and the shared memory is a kernel state memory; the VPN service reads the first message from the shared memory, and the shared memory is set to allow user state service operations; the VPN service processes the first message to obtain a second message, and sends the second message to the network layer; the network layer processes the second message to obtain a first data packet, and sends the first data packet to the VPN server corresponding to the VPN service through the physical network card.

[0007] The shared memory can be understood as a storage area in the kernel layer, or a section of interval code in the program. The shared memory can be deployed in the driver of the virtual network card.

[0008] In one design, the shared memory is configured to allow user-mode service operations, specifically, the VPN service has the authority to read data from the shared memory, where the operations may include read operations, write operations, and the like.

[0009] In one design scheme, the first message is stored in a shared memory, and a specific implementation may be: the transport layer sends the first message to the virtual network card XDP, and the virtual network card XDP writes the first message into the shared memory.

[0010] In this application, the transport layer encapsulates the application data of the application into a first message according to the path of the target route corresponding to the virtual network card, and the first message is stored in the shared memory, which is the memory of the kernel state. The VPN service reads the first message from the shared memory, and the shared memory is set to allow service operations in the user state. The VPN service obtains the second message after processing the first message, and sends the second message to the network layer. The network layer obtains the first data packet after processing the second message, and sends the first data packet to the VPN server corresponding to the VPN service through the physical network card. It can be seen that in the process of converting application data from the kernel state to the user state in the prior art, it needs to undergo two transport layers for encapsulation and two network layers for filtering. In this process of this application, the VPN service only needs to read the message from the shared memory of the kernel state according to the sharing mechanism, so as to realize the conversion of application data from the kernel state to the user state, and only needs to undergo one transport layer processing and one network layer processing, which reduces redundant processing, reduces power consumption, reduces memory usage, and improves data forwarding performance.

[0011] In some design solutions, before the VPN service reads the first message from the shared memory, the process further includes: the transport layer sends the first message to the network layer; the network layer filters the first message to obtain a third message; and the network layer stores the third message in the shared memory. In this way, by filtering the first message, messages with wrong IP addresses can be filtered out, thereby reducing the storage capacity of the shared memory.

[0012] In one design scheme, the network layer filters the first message to obtain the third message, which may be specifically implemented as follows: the virtual network card XDP filters the first message to obtain the third message.

[0013] In one design scheme, the network layer filters the first message to obtain the third message, including: the network layer filters the first message according to a message header judgment rule to obtain the third message.

[0014] Specifically, the virtual network card XDP filters the first message according to the first filtering rule to obtain the third message, and the first filtering rule may include a message header filtering rule. That is, the virtual network card XDP may filter out the error message header carried in the first message according to the first filtering rule to obtain the third message. The judgment of the error message header may be determined according to the message header table.

[0015] In one design, the first part of the program in the VPN service is deployed on the virtual network card driver corresponding to the virtual network card, and the first part of the program is used to write the first message into the shared memory. That is, the first part of the program in the VPN service can be sunk to the virtual network card driver. In this way, when it is necessary to write a message into the shared memory, the VPN service can write the message into the shared memory through the virtual network card driver.

[0016] In one design, the second part of the program in the VPN service is deployed on the virtual network card driver corresponding to the virtual network card, and the second part of the program is used to read the first message from the shared memory. That is, the second part of the program in the VPN service can be sunk to the virtual network card driver. In this way, when it is necessary to read the message from the shared memory, the VPN service can read the message from the shared memory through the virtual network card driver.

[0017] In one design, the second part of the program in the VPN service is deployed on the physical network card driver corresponding to the physical network card, and the second part of the program is used to read the first message from the shared memory. That is, the second part of the program in the VPN service can be sunk to the physical network card driver. In this way, when it is necessary to read the message from the shared memory, the VPN service can read the message from the shared memory through the physical network card driver.

[0018] In one design solution, the VPN service is a user-mode VPN service.

[0019] In one design, the VPN service belongs to the network layer or the application layer. The first part of the VPN service program is embedded in the driver of the virtual network card, and the first part of the program can be used to write the message into the shared memory. The second part of the VPN service program is embedded in the driver of the physical network card, and the second part of the program can be used to read the message from the shared memory.

[0020] In one design scheme, the network layer obtains the first data packet after processing the second message, including: the network layer filters the second message to obtain the first data packet.

[0021] Specifically, the network layer filters the second message according to the second filtering rule, and then performs flow control on the filtered second message to obtain the first data packet.

[0022] In one design, the VPN service processes the first message to obtain the second message, including: the VPN service encrypts the first message and encapsulates a message header to obtain the second message.

[0023] For example, the application data is "Hello". The first message may include an IP header, a TCP header and application data (such as Hello). The second message may include an IP2 header, a TCP2 header, a TLS header, an IP1 header, a TCP1 header and application data (such as Hello).

[0024] In a second aspect, an embodiment of the present application provides an electronic device, comprising: an encapsulator, for encapsulating application data of an application into a first message according to the path of a target route corresponding to a virtual network card, wherein the first message is stored in a shared memory, and the shared memory is a kernel-state memory. An acquirer, for reading the first message from the shared memory, wherein the shared memory is configured to allow user-state service operations. A processor, for processing the first message to obtain a second message, and sending the second message to a network layer. A first transmitter, for processing the second message to obtain a first data packet, and sending the first data packet to a VPN server corresponding to the VPN service through a physical network card.

[0025] The shared memory can be understood as a storage area in the kernel layer, or a section of interval code in the program. The shared memory can be deployed in the driver of the virtual network card.

[0026] In one design, the shared memory is configured to allow user-mode service operations, specifically, the VPN service has the authority to read data from the shared memory, where the operations may include read operations, write operations, and the like.

[0027] In one design scheme, the first message is stored in a shared memory, and a specific implementation may be: the transport layer sends the first message to the virtual network card XDP, and the virtual network card XDP writes the first message into the shared memory.

[0028] In this application, the transport layer encapsulates the application data of the application into a first message according to the path of the target route corresponding to the virtual network card, and the first message is stored in the shared memory, which is the memory of the kernel state. The VPN service reads the first message from the shared memory, and the shared memory is set to allow service operations in the user state. The VPN service obtains the second message after processing the first message, and sends the second message to the network layer. The network layer obtains the first data packet after processing the second message, and sends the first data packet to the VPN server corresponding to the VPN service through the physical network card. It can be seen that in the process of converting application data from the kernel state to the user state in the prior art, it needs to undergo two transport layers for encapsulation and two network layers for filtering. In this process of this application, the VPN service only needs to read the message from the shared memory of the kernel state according to the sharing mechanism, so as to realize the conversion of application data from the kernel state to the user state, and only needs to undergo one transport layer processing and one network layer processing, which reduces redundant processing, reduces power consumption, reduces memory usage, and improves data forwarding performance.

[0029] In some design schemes, the electronic device further includes: a second transmitter, configured to send the first message to the network layer; a first filter, configured to filter the first message to obtain a third message; and a memory, configured to store the third message in the shared memory. In this way, by filtering the first message, messages with incorrect IP addresses can be filtered out, thereby reducing the storage capacity of the shared memory. Accordingly, the acquirer is configured to: read the third message after filtering the first message from the shared memory.

[0030] In one design scheme, the first filter is used for: the virtual network card XDP filters the first message to obtain a third message.

[0031] In one design scheme, the first filter is used to filter the first message according to a message header judgment rule to obtain the third message.

[0032] Specifically, the virtual network card XDP filters the first message according to the first filtering rule to obtain the third message, and the first filtering rule may include a message header filtering rule. That is, the virtual network card XDP may filter out the error message header carried in the first message according to the first filtering rule to obtain the third message. The judgment of the error message header may be determined according to the message header table.

[0033] In one design, the first part of the program in the VPN service is deployed on the virtual network card driver corresponding to the virtual network card, and the first part of the program is used to write the first message into the shared memory. That is, the first part of the program in the VPN service can be sunk to the virtual network card driver. In this way, when it is necessary to write a message into the shared memory, the VPN service can write the message into the shared memory through the virtual network card driver.

[0034] In one design, the second part of the program in the VPN service is deployed on the virtual network card driver corresponding to the virtual network card, and the second part of the program is used to read the first message from the shared memory. That is, the second part of the program in the VPN service can be sunk to the virtual network card driver. In this way, when it is necessary to read the message from the shared memory, the VPN service can read the message from the shared memory through the virtual network card driver.

[0035] In one design, the second part of the program in the VPN service is deployed on the physical network card driver corresponding to the physical network card, and the second part of the program is used to read the first message from the shared memory. That is, the second part of the program in the VPN service can be sunk to the physical network card driver. In this way, when it is necessary to read the message from the shared memory, the VPN service can read the message from the shared memory through the physical network card driver.

[0036] In one design solution, the VPN service is a user-mode VPN service.

[0037] In one design, the VPN service belongs to the network layer or the application layer. The first part of the VPN service program is embedded in the driver of the virtual network card, and the first part of the program can be used to write the message into the shared memory. The second part of the VPN service program is embedded in the driver of the physical network card, and the second part of the program can be used to read the message from the shared memory.

[0038] In one design, the second filter is further included, which is used to filter the second message to obtain the first data packet. Specifically, the network layer filters the second message according to the second filtering rule, and then performs flow control on the filtered second message to obtain the first data packet.

[0039] In one design, the processor is used to: encrypt the first message and encapsulate the message header to obtain the second message. For example, the application data is "hello". The first message may include an IP header, a TCP header, and application data (such as hello). The second message may include an IP2 header, a TCP2 header, a TLS header, an IP1 header, a TCP1 header, and application data (such as hello).

[0040] In a third aspect, an embodiment of the present application provides an electronic device, comprising: one or more processors; and a memory, wherein the memory stores a code; when the code is executed by the processor, the electronic device executes the method described in the first aspect.

[0041] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium includes computer instructions. When the computer instructions are executed on an electronic device, the electronic device executes the method described in the first aspect.

[0042] In a fifth aspect, an embodiment of the present application provides a chip system, which includes one or more processors. When the one or more processors execute instructions, the one or more processors execute the method described in the first aspect.

[0043] Among them, the specific implementation methods and corresponding technical effects of each embodiment in the above-mentioned second to fifth aspects can refer to the specific implementation methods and technical effects of the above-mentioned first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0045] Figure 2 for Figure 1 A schematic diagram of a software architecture of an electronic device is shown;

[0046] Figure 3 For Figure 2 A schematic flow chart of a method for transmitting a data packet of the electronic device shown;

[0047] Figure 4 For Figure 2 A schematic flow chart of a method for transmitting a data packet of the electronic device shown;

[0048] Figure 5 Provided in the embodiments of this application Figure 1 A schematic diagram of software architecture of another electronic device is shown;

[0049] Figure 6 For Figure 5 A schematic flow chart of a method for transmitting a data packet of the electronic device shown;

[0050] Figure 7 For Figure 5 A schematic flow chart of a method for transmitting a data packet of the electronic device shown;

[0051] Figure 8 For Figure 5 A schematic flow chart of a method for transmitting a data packet of the electronic device shown;

[0052] Fig. 9 Provided in the embodiments of this application Figure 1 A schematic diagram of software architecture of another electronic device is shown;

[0053] Fig.10 A schematic diagram of a data packet transmission method provided in an embodiment of the present application;

[0054] Fig.11 A schematic diagram of another data packet transmission method provided in an embodiment of the present application;

[0055] Fig.12 A schematic diagram of a flow chart of another data packet transmission method provided in an embodiment of the present application;

[0056] Fig.13 A schematic diagram of an application scenario of the data packet transmission method provided in an embodiment of the present application in a practical application;

[0057] Fig.14 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0058] Figure 1 A schematic structural diagram of an electronic device 100 is shown.

[0059] The electronic device 100 may include a processor 110 , a memory 120 , a universal serial bus (USB) interface 130 , a charging management module 140 , a power management module 141 , a battery 142 , an antenna 1 , and a wireless communication module 150 .

[0060] It is to be understood that the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0061] The processor 110 may be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. The memory may store instructions or data that the processor 110 has just used or cyclically used. If the processor 110 needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0062] The USB interface 130 is an interface that complies with USB standard specifications, and may specifically be a Mini USB interface, a Micro USB interface, a USB Type C interface, etc. The USB interface 130 may be used to connect a charger to charge the electronic device 100, and may also be used to transmit data between the electronic device 100 and a peripheral device.

[0063] It is understandable that the interface connection relationship between the modules illustrated in the embodiment of the present application is only a schematic illustration and does not constitute a structural limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may also adopt different interface connection methods in the above embodiments, or a combination of multiple interface connection methods.

[0064] The charging management module 140 is used to receive charging input from a charger. The charger may be a wireless charger or a wired charger. In some wired charging embodiments, the charging management module 140 may receive charging input from a wired charger through the USB interface 130. In some wireless charging embodiments, the charging management module 140 may receive wireless charging input through a wireless charging coil of the electronic device 100. While the charging management module 140 is charging the battery 142, it may also power the electronic device through the power management module 141.

[0065] The power management module 141 is used to connect the battery 142, the charging management module 140 and the processor 110. The power management module 141 receives input from the battery 142 and / or the charging management module 140 to power the processor 110, the memory 120, etc. The power management module 141 can also be used to monitor parameters such as battery capacity, battery cycle number, battery health status (leakage, impedance), etc. In some other embodiments, the power management module 141 can also be set in the processor 110. In other embodiments, the power management module 141 and the charging management module 140 can also be set in the same device.

[0066] The wireless communication function of the electronic device 100 can be implemented through the antenna 1, the wireless communication module 150, the modem processor and the baseband processor.

[0067] Antenna 1 is used to transmit and receive electromagnetic wave signals. Each antenna in electronic device 100 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve the utilization of antennas. For example, antenna 1 can be reused as a diversity antenna for a wireless local area network. In some other embodiments, the antenna can be used in combination with a tuning switch.

[0068] The wireless communication module 150 can provide wireless communication solutions including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR), etc., which are applied to the electronic device 100. The wireless communication module 150 can be one or more devices integrating at least one communication processing module. The wireless communication module 150 receives electromagnetic waves via the antenna 1, modulates the frequency of the electromagnetic wave signal and performs filtering, and sends the processed signal to the processor 110. The wireless communication module 150 can also receive the signal to be sent from the processor 110, modulate the frequency of the signal, amplify it, and convert it into electromagnetic waves for radiation through the antenna 1.

[0069] The memory 120 can be used to store computer executable program codes, which include instructions. The memory 120 may include a program storage area and a data storage area. Among them, the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc. The data storage area may store data created during the use of the electronic device 100 (such as audio data, a phone book, etc.), etc. In addition, the memory 120 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc. The processor 110 executes various functional applications and data processing of the electronic device 100 by running instructions stored in the memory 120, and / or instructions stored in a memory provided in the processor.

[0070] Of course, the electronic device may also include other functional units, which are not limited in the embodiments of the present application.

[0071] The software system of the electronic device 100 may adopt a layered architecture, an event-driven architecture, a micro-kernel architecture, a micro-service architecture, or a cloud architecture. Figure 2 It is a software structure block diagram of the electronic device 100 according to an embodiment of the present application.

[0072] The layered architecture divides the software into several layers, each with a clear role and division of labor. The layers communicate with each other through software interfaces. In some embodiments, the electronic device 100 may use the HarmonyOS system, which supports a virtual private network (VPN) function. The software system of the electronic device 100 is composed of an application layer, an application framework layer, and a kernel layer from top to bottom.

[0073] The application layer may include applications such as the first application, memo, and call.

[0074] The application framework layer may include a VPN service. Alternatively, the kernel layer may include a VPN service.

[0075] The kernel layer may also include a network architecture, which may include a transport layer and a network layer. The transport layer may include a transport module, such as a transmission control protocol (TCP) encapsulation module, a user datagram protocol (UDP) protocol encapsulation module, and the like. The network layer may include a network module, a network card driver module, and a physical network card. The network module may include a network processing module. The network card driver module may include a virtual network card driver and a physical network card driver. The virtual network card driver may include a filtering module and a flow control module. Exemplarily, the filtering module may include a virtual network card XDP (express data path). The flow control module may include a virtual network card TC (traffic control). The physical network card driver may include a filtering module and a flow control module. Exemplarily, the filtering module may include a physical network card XDP. The flow control module may include a physical network card TC.

[0076] For example, Figure 3 and Figure 4 is a flow chart of an existing data packet transmission method, Figure 2 Another software architecture diagram of an electronic device. Figures 2 to 4As shown, ① when the first application needs to send application data, the first application of the application layer (referred to as the application layer) sends the application data to the transmission module of the kernel layer. The transmission module encapsulates the application data according to the TCP / UDP protocol to obtain a first message, and the first message may include a TCP1 header, an IP1 header and application data. ② The transmission module sends the first message to the network module, and the network module receives the first message and filters the first message. Specifically, the virtual network card XDP of the network module performs a first filtering on the first message according to the first filtering rule, and the first filtering rule may be a predefined, open, and programmatic rule. The network processing module of the network module performs a second filtering on the message filtered by the virtual network card XDP according to the second filtering rule and searches for a route to obtain a second message. The second filtering rule may be set and completed by the three components of the kernel, netfilter, nat, and mandle. The virtual network card TC of the network module performs flow control on the second message. Afterwards, ③ the network module stores the processed second message in the kernel state memory. ④ The memory copies the data / message in the memory to the hard disk. ⑤ The VPN service in the network layer of the kernel layer can read the second message from the hard disk, and encrypt or decrypt the second message to obtain a third message, which may include a TLS header, a TCP1 header, an IP1 header, and application data. After that, ⑥ the VPN service sends the third message to the transmission module of the transport layer. The transmission module encapsulates the third message according to the TCP / UDP protocol to obtain a fourth message, which may include a TCP2 header, an IP2 header, a TLS header, a TCP1 header, an IP1 header, and application data. ⑦ The transmission module sends the fourth message to the network module, and the network module performs the operation in the above step ② on the fourth message to obtain a first data packet. After that, ⑧ the network module sends the first data packet to the network card driver module. ⑨⑩ The network card driver module drives the physical network card to transmit the first data packet to the VPN server corresponding to the VPN service.

[0077] In summary, during the transmission of data packets, the data packets need to be stored in the memory and then copied from the memory to the hard disk. When the VPN service reads data from the hard disk, it needs to go through two transport layer processes (such as ① and ⑥) and two network layer processes (such as ② and ⑦) before the data packets can be transmitted from the kernel state to the user state and transmitted to the server corresponding to the VPN service. There is redundant processing, resulting in high power consumption, high memory usage, and poor data forwarding performance.

[0078] In order to solve the above technical problems, the present application provides a data packet transmission method, which can be applied to electronic devices, and the method includes: the transport layer encapsulates the application data of the application into a first message according to the path of the target route corresponding to the virtual network card, and the first message is stored in the shared memory, which is the memory of the kernel state. The VPN service reads the first message from the shared memory, and the VPN service has the authority to read data from the shared memory. The VPN service obtains the second message after processing the first message, and sends the second message to the network layer. The network layer obtains the first data packet after processing the second message, and sends the first data packet to the VPN server corresponding to the VPN service through the physical network card. It can be seen that in the process of converting application data from the kernel state to the user state in the prior art, it needs to undergo two transport layers for encapsulation and two network layers for filtering. In this process of the present application, the VPN service only needs to read the message from the shared memory of the kernel state according to the sharing mechanism, so as to realize the conversion of application data from the kernel state to the user state, and only needs to undergo one transport layer processing and one network layer processing, thereby reducing redundant processing, reducing power consumption, reducing memory usage, and improving data forwarding performance.

[0079] In some embodiments, the program for reading / writing messages in the VPN service is sunk into the network card driver, that is, the program for reading / writing messages in the VPN service is deployed in the network card driver. The network card driver may refer to a virtual network card driver and / or a physical network card driver. In other words, the VPN service in user mode satisfies the memory sharing mechanism in kernel mode. In this way, after the message is written into the memory in kernel mode, the VPN service can directly read the message from the memory in kernel mode.

[0080] For example, Figures 6 to 8 is a flow chart of a method for transmitting a data packet in an embodiment of the present application, Figure 5 FIG. 1 is another software architecture diagram of an electronic device. Figures 5 to 8 As shown, compared with the existing data packet transmission method, the difference is that after the transmission module encapsulates the application data according to the TCP / UDP protocol to obtain the first message, ② the transmission module sends the first message to the shared memory, which is the kernel state memory. Specifically, Figure 5 As shown, the transmission module sends the first message to the virtual network card XDP of the virtual network card driver of the network layer, and the virtual network card XDP performs a first filtering on the first message according to the first filtering rule to obtain a third message. Then, the filtered third message is written into the shared memory. Then, as Figure 5③ The VPN service reads the filtered message from the shared memory, and encrypts or decrypts the filtered message to obtain a second message, which may include a TCP2 header, an IP2 header, a TLS header, a TCP1 header, an IP1 header, and application data. Afterwards, ④ the VPN service sends the second message to the network module, and the network module performs a second filtering on the second message and searches for a route according to the second filtering rule to obtain a third message. The second filtering rule may be set and completed by the three components of the kernel, namely, netfilter, nat, and mandle. The virtual network card TC of the network module performs flow control on the second message. Afterwards, the second message is encrypted or decrypted to obtain a first data packet. Afterwards, ⑤ the network module sends the first data packet to the network card driver module. ⑥ The network card driver module drives the physical network card to transmit the first data packet to the VPN server corresponding to the VPN service. It can be seen that under the sharing mechanism of the shared memory in kernel state that the user state process meets, the user state VPN service can directly read data from the shared memory in kernel state, reduce the redundant operations of data transmission from kernel state to user state, reduce power consumption, reduce memory usage, and improve data forwarding performance.

[0081] In actual applications, APP attempts to send application data to server A on the public network through the TCP protocol. The specific transmission process is as follows: APP calls the posix interface to send Payload, which specifies the IP address and port of server A. The Linux kernel copies the Payload (or application data) to the shared memory in the kernel state, that is, the driver of the virtual network card. The transmission module of the Linux kernel encapsulates the TCP header on the application data according to the IP address and port of server A, and then encapsulates the IP header to obtain an IP message. The Linux kernel finds the route between the device and the server, and passes the encapsulated IP message to the driver of the virtual network card. The driver of the virtual network card passes the IP message directly to the VPN service. The VPN service uses the IP message as Payload in the user state, encrypts or performs other operations, and then encapsulates a layer of TCP header, the target address and target port of server A, pointing to the VPN gateway. The VPN service encapsulates another layer of IP header on the message, pointing to the VPN gateway. The VPN service passes the processed new IP message directly to the physical network card driver. The physical network card driver receives the IP message and drives the physical network card to send the message to the VPN gateway. It can be seen that the driver of the virtual network card can directly transmit data with the user-state VPN service, reducing redundant operations of data transmission from kernel state to user state, reducing power consumption, reducing memory usage, and improving data forwarding performance.

[0082] In some other embodiments, the difference from the above embodiments is that the VPN service is deployed in Fig. 9The application framework layer of the electronic device 100 shown. Similarly, the VPN service reads the message from the shared memory in the kernel layer and sends the message to the network module in the kernel layer, which has been transmitted to the VPN server corresponding to the VPN service through the physical network card. The specific transmission process can refer to the above-mentioned related content, which will not be repeated here.

[0083] The electronic device may be a mobile phone, tablet computer, desktop, laptop, notebook computer, ultra-mobile personal computer (UMPC), handheld computer, smart TV, netbook, virtual reality device or other device with display function. The specific form of the electronic device is not particularly limited in the embodiments of the present application. In the embodiments of the present application, the electronic device is a mobile phone as an example for description.

[0084] Below Fig.10 Taking the architecture shown as an example, the data packet transmission method provided in the embodiment of the present application is described. Each unit in the following embodiment may have Fig.10 It should be noted that the message names or parameter names in the messages exchanged between the devices in the embodiments of the present application are only examples, and other names may be used in the specific implementation. In addition, the actions, terms, etc. involved in the embodiments of the present application may refer to each other without limitation.

[0085] The following is a detailed introduction to a method for transmitting a data packet provided in an embodiment of the present application.

[0086] Fig.10 A schematic diagram of a method for transmitting a data packet provided in an embodiment of the present application. The method is applied to Figure 5 In the electronic device 100 shown, the method may include:

[0087] S1000. An electronic device receives application data of an application program at an application layer.

[0088] The application may be a communication application, a shopping application, an entertainment application, a query application, etc. The application on the electronic device needs to transmit application data to the application on other devices. Among them, transmission can be understood as sending or receiving. In the embodiment of the present application, sending data is used as an example for explanation, and the process of receiving data is the reverse process of the process of sending data, which will not be repeated here.

[0089] For example, the application is a communication application, such as Figure 5 As shown, the application data that the first application needs to transmit is "Hello".

[0090] S1001. The electronic device routes the application data to the corresponding virtual network card according to the VPN routing table corresponding to the application data.

[0091] In a specific implementation manner, the electronic device can route the application data to a corresponding virtual network card according to the application data and a VPN routing table, and the virtual network card corresponds to the encapsulation interface.

[0092] S1002: The electronic device calls the encapsulation interface corresponding to the virtual network card, and encapsulates the application data of the application program into a first message according to the path of the target route corresponding to the virtual network card.

[0093] In a specific implementation, the electronic device encapsulates a TCP header on the application data according to the path of the target route corresponding to the virtual network card and the TCP protocol, and then encapsulates an IP header on the message encapsulating the TCP header according to the IP protocol to obtain an IP message, which is the first message. The first message may include an IP header, a TCP header, and application data (such as "Hello").

[0094] Of course, in order to filter out the message with the wrong IP address, the electronic device needs to filter the first message, as specifically shown in S1003.

[0095] S1003: The electronic device calls the filtering interface corresponding to the virtual network card to filter the first message to obtain a second message.

[0096] In a specific implementation, the electronic device filters the first message according to the first filtering rule to obtain the second message. The first filtering rule may be user-defined or editable. For example, the first filtering rule may include a message header judgment rule. Specifically, the network module of the network layer filters the first message according to the message header judgment rule, and filters out messages with incorrect IP addresses to obtain the second message.

[0097] S1004: The electronic device calls the driver of the virtual network card and sends the second message to the VPN service of the electronic device.

[0098] In a specific implementation, the first part of the program in the VPN service is deployed on the virtual network card driver corresponding to the virtual network card, and the first part of the program is used to write the first message into the shared memory. That is, the first part of the program in the VPN service can be sunk to the virtual network card driver. In this way, when it is necessary to write a message into the shared memory, the VPN service can write the message into the shared memory through the virtual network card driver.

[0099] In a specific implementation, the second part of the program in the VPN service is deployed on the virtual network card driver corresponding to the virtual network card, and the second part of the program is used to read the first message from the shared memory. That is, the second part of the program in the VPN service can be sunk to the virtual network card driver. In this way, when it is necessary to read the message from the shared memory, the VPN service can read the message from the shared memory through the virtual network card driver.

[0100] In a specific implementation, the second part of the program in the VPN service is deployed on the physical network card driver corresponding to the physical network card, and the second part of the program is used to read the first message from the shared memory. That is, the second part of the program in the VPN service can be sunk to the physical network card driver. In this way, when it is necessary to read the message from the shared memory, the VPN service can read the message from the shared memory through the physical network card driver.

[0101] In a specific implementation manner, the VPN service is a user-mode VPN service.

[0102] S1005: The VPN service of the electronic device processes the second message to obtain a third message, and sends the third message to the network layer.

[0103] In a specific implementation, S1005 can be implemented as follows: the VPN service encrypts the second message and encapsulates the message header to obtain a third message. The third message may include an IP2 header, a TCP2 header, a TLS header, an IP1 header, a TCP1 header, and application data (such as "Hello").

[0104] S1006: The electronic device calls the filtering interface corresponding to the physical network card to filter the third message to obtain a first data packet.

[0105] In a specific implementation, S1006 can be implemented as follows: the electronic device filters the third message according to the second filtering rule to obtain the first data packet. The second filtering rule is implemented by the three components of the kernel, namely, netfilter, nat, and mandle.

[0106] S1007: The electronic device calls a driver of the physical network card and sends the first data packet to a VPN server corresponding to the VPN service through the physical network card.

[0107] In an embodiment of the present application, the electronic device encapsulates the application data of the application into a first message according to the path of the target route corresponding to the virtual network card, and filters the first message to obtain a second message. The electronic device calls the driver of the virtual network card and sends the second message to the VPN service of the electronic device. The VPN service processes the second message to obtain a third message, and sends the third message to the network layer. The network layer obtains a first data packet after processing the third message, and sends the first data packet to the VPN server corresponding to the VPN service through the physical network card. It can be seen that in this process, part of the program of the VPN service in user state sinks into the driver of the virtual network card. Therefore, the VPN service in user state can directly receive the message sent by the driver of the virtual network card, and complete the transmission of the message from the kernel state to the user state, without going through two transport layer processing and two network layer processing, reducing redundant processing, reducing power consumption, reducing memory usage, and improving data forwarding performance.

[0108] Fig.11 A schematic diagram of a method for transmitting a data packet provided in an embodiment of the present application. The method is applied to Figure 5 In the electronic device 100 shown, the method may include:

[0109] S1100. The electronic device receives application data of an application program at an application layer.

[0110] Specifically, S1100 may refer to the above-mentioned S1000, and this application does not make any specific limitation.

[0111] S1101. The electronic device routes the application data to the corresponding virtual network card according to the VPN routing table corresponding to the application data.

[0112] In a specific implementation, the transmission module of the electronic device routes the application data to the corresponding virtual network card according to the application data and the VPN routing table. The virtual network card corresponds to the encapsulation interface.

[0113] Specifically, S1101 may refer to the above-mentioned S1001, and this application does not make any specific limitation.

[0114] S1102. The electronic device calls the encapsulation interface corresponding to the virtual network card, and encapsulates the application data of the application into a first message according to the path of the target route corresponding to the virtual network card. The first message is stored in a shared memory, which is a kernel-state memory.

[0115] In a specific implementation, the transmission module of the electronic device encapsulates the TCP header on the application data according to the path of the target route corresponding to the virtual network card and the TCP protocol, and then encapsulates the IP header on the message encapsulated with the TCP header according to the IP to obtain an IP message, which is the first message. The first message may include an IP header, a TCP header, and application data (such as "Hello").

[0116] In a specific implementation, the transmission module of the electronic device stores the first message in a shared memory. Alternatively, the transmission module of the electronic device sends the first message to the network module, and the XDP corresponding to the virtual network card in the network module stores the first message in the shared memory.

[0117] Of course, in order to filter out the message with the wrong IP address, the first message needs to be filtered, as specifically shown in S1103.

[0118] S1103: The electronic device calls the filtering interface corresponding to the virtual network card to filter the first message to obtain a second message.

[0119] In a specific implementation, the network module of the electronic device filters the first message according to the first filtering rule to obtain the second message. The first filtering rule may be customized or editable. For example, the first filtering rule may include a message header judgment rule. Specifically, the network module of the network layer filters the first message according to the message header judgment rule, and filters out the message with the wrong IP address to obtain the second message.

[0120] S1104: The electronic device calls the write interface corresponding to the virtual network card to store the second message in the shared memory.

[0121] In a specific implementable manner, the write interface may be an XDP corresponding to the virtual network card, and the electronic device stores the second message in a shared memory through the virtual network card XDP.

[0122] S1105: The electronic device calls the read interface corresponding to the virtual network card to read the second message from the shared memory.

[0123] In some examples, VPN services belong to the network layer, such as Figure 5 The VPN service shown is located in the network layer of the kernel layer. In some examples, the VPN service belongs to the application layer. Figure 8 The VPN service shown is located in the application framework layer.

[0124] In a specific implementation manner, the VPN service in user state reads the second message from the shared memory in memory state, and the VPN service has the authority to read data from the shared memory.

[0125] S1106: The VPN service of the electronic device processes the second message to obtain a third message, and sends the third message to the network layer.

[0126] In a specific implementation, S1107 can be implemented as follows: the VPN service encrypts the second message and encapsulates the message header to obtain a third message. The third message may include an IP2 header, a TCP2 header, a TLS header, an IP1 header, a TCP1 header, and application data (such as "Hello").

[0127] S1107: The electronic device calls the filtering interface corresponding to the physical network card to filter the third message to obtain a first data packet.

[0128] In a specific implementation, S1107 can be specifically implemented as follows: the network layer of the electronic device filters the third message to obtain the first data packet. Exemplarily, the network layer of the network layer filters the third message according to the second filtering rule to obtain the first data packet. The second filtering rule is completed by the three components of the kernel, netfilter, nat, and mandle.

[0129] S1108: The electronic device calls a driver of the physical network card and sends the first data packet to a VPN server corresponding to the VPN service through the physical network card.

[0130] In the embodiment of the present application, the electronic device encapsulates the application data of the application into a first message according to the path of the target route corresponding to the virtual network card, and filters the first message to obtain a second message. The second message is stored in a shared memory, which is a kernel state memory. The VPN service reads the second message from the shared memory, and the VPN service has the authority to read data from the shared memory. The VPN service obtains a third message after processing the second message, and sends the third message to the network layer. The electronic device calls the filtering interface corresponding to the physical network card, obtains a first data packet after processing the third message, and sends the first data packet to the VPN server corresponding to the VPN service through the physical network card. It can be seen that in the process of converting application data from kernel state to user state in the prior art, it needs to undergo two transport layer encapsulations and two network layer filterings. In this process of the present application, the VPN service only needs to read the message from the kernel state shared memory according to the sharing mechanism, so as to realize the conversion of application data from kernel state to user state, and only needs to undergo one transport layer processing and one network layer processing, thereby reducing redundant processing, reducing power consumption, reducing memory usage, and improving data forwarding performance.

[0131] Fig.12 A schematic diagram of a method for transmitting a data packet provided in an embodiment of the present application. The method is applied to Figure 5 The electronic device 100 shown includes a transmission module, a network module, a shared memory, a network card driver module and a physical network card. The method may include:

[0132] S1200. A transmission module receives application data of an application program at an application layer.

[0133] Specifically, S1200 may refer to the above-mentioned S1000 and S1100, and this application does not make any specific limitation.

[0134] At this time, combined with Figure 5 In ①, the first application transmits the application data to the transmission module of the kernel layer.

[0135] S1201. The transmission module routes the application data to the corresponding virtual network card according to the VPN routing table corresponding to the application data.

[0136] Specifically, S1201 may refer to the above-mentioned S1101, and this application does not make any specific limitation.

[0137] S1202. The transmission module encapsulates the application data of the application into a first message according to the path of the target route corresponding to the virtual network card. The first message is stored in a shared memory, which is a kernel-state memory.

[0138] In a specific implementation, the transmission module encapsulates a TCP header on the application data according to the path of the target route corresponding to the virtual network card and the TCP protocol, and then encapsulates an IP header on the message encapsulated with the TCP header according to the IP protocol to obtain an IP message, which is the first message. The first message may include an IP header, a TCP header, and application data (such as "Hello").

[0139] Of course, in order to filter out the message with the wrong IP address, the first message needs to be filtered, as specifically shown in S1203.

[0140] S1203. The network module calls the filtering interface corresponding to the virtual network card to filter the first message to obtain a second message.

[0141] In a specific implementation manner, the virtual network XDP of the network module filters the first message according to the first filtering rule to obtain the second message.

[0142] S1204. The network module calls the write interface corresponding to the virtual network card to store the second message in the shared memory.

[0143] In a specific implementable manner, the write interface may be an XDP corresponding to the virtual network card, and the network module stores the second message in the shared memory through the virtual network card XDP.

[0144] S1205. The VPN service calls the read interface corresponding to the virtual network card to read the second message from the shared memory.

[0145] In some examples, the VPN service belongs to the network module of the network layer.

[0146] In a specific implementation manner, the VPN service in user state reads the second message from the shared memory in memory state, and the VPN service has the authority to read data from the shared memory.

[0147] S1206: The VPN service processes the second message to obtain a third message, and sends the third message to the network layer.

[0148] S1207. The network module calls the filtering interface corresponding to the physical network card to filter the third message to obtain the first data packet.

[0149] In one specific implementation, S1207 can be specifically implemented as follows: the physical network card XDP corresponding to the network module filters the second message to obtain the first data packet. In another specific implementation, after the physical network card XDP corresponding to the network module filters the second message, the physical network card TC corresponding to the network module performs flow control on the filtered second message to obtain the first data packet.

[0150] S1208: The network module calls the driver of the physical network card to send the first data packet to the VPN server corresponding to the VPN service through the physical network card.

[0151] In the embodiment of the present application, the transport layer encapsulates the application data of the application into a first message according to the path of the target route corresponding to the virtual network card, and the first message is stored in the shared memory, which is the memory of the kernel state. The VPN service reads the first message from the shared memory, and the VPN service has the authority to read data from the shared memory. The VPN service obtains the second message after processing the first message, and sends the second message to the network layer. The network layer obtains the first data packet after processing the second message, and sends the first data packet to the VPN server corresponding to the VPN service through the physical network card. It can be seen that in the process of converting application data from kernel state to user state in the prior art, it needs to undergo two transport layers for encapsulation and two network layers for filtering. In this process of the present application, the VPN service only needs to read the message from the shared memory of the kernel state according to the sharing mechanism, so as to realize the conversion of application data from kernel state to user state, and only needs to undergo one transport layer processing and one network layer processing, thereby reducing redundant processing, reducing power consumption, reducing memory usage, and improving data forwarding performance.

[0152] The specific implementation method of the embodiments of the present application is detailed in the above-mentioned related content, and the embodiments of the present application will not be repeated here.

[0153] The various solutions in the above embodiments of the present application can be combined without contradiction.

[0154] In practical applications, the data packet transmission method provided in the embodiments of the present application can be applied to the following scenarios:

[0155] The first scenario is the scenario where the intranet accesses the public network.

[0156] For example, Fig.13 As shown, the small network of a small company or a medium-sized company, because the business points are scattered in different places and the traffic is also large, forms its own business network through the public network, and uses VPN as a "dedicated line" for transmission. For example, the branch and headquarters of an enterprise are connected to the Internet through gateway 1 and gateway 2 respectively. Due to business needs, internal confidential data is often sent between the branch and the headquarters. In order to protect the secure transmission of this data on the Internet, a VPN tunnel is established between gateway 1 and gateway 2. In this way, the VPN client of the enterprise branch can access the Internet, and the server of the headquarters company can access the Internet network, and the data transmitted between the enterprise branch and the headquarters is transmitted through the Internet network. Among them, whether it is the equipment of the enterprise branch or the headquarters, in the process of the equipment sending data, the data packet transmission method provided in the above embodiment is adopted, which will not be repeated here.

[0157] The second scenario is the cross-segment communication scenario.

[0158] For example, Fig.13 As shown, the company has a business network, but many employees work outside the company and need to access the company network through mobile devices. They also require high Internet speed and strong confidentiality. In this case, the virtual private line function of VPN can be used for remote login. In this way, the VPN client can access the company's network and access the server 1 within the company. Among them, the device within the company that accesses the server within the company, in the process of the device sending data, all adopts the data packet transmission method provided in the above embodiment, which will not be repeated here.

[0159] The present application also provides an electronic device for implementing any of the above methods, for example, an electronic device including a unit (or means) for implementing each step performed by the electronic device in the above method S1000-S1007 or S1100-S1107 or S1200-S1207. Fig.14 , which is a schematic diagram of an electronic device provided in an embodiment of the present application, the electronic device 1400 may include:

[0160] The encapsulator 1401 is used to encapsulate the application data of the application into a first message according to the path of the target route corresponding to the virtual network card, and the first message is stored in the shared memory, which is the memory in the kernel state;

[0161] An acquirer 1402 is used to read the first message from a shared memory, where the shared memory is configured to allow user-mode service operations;

[0162] The processor 1403 is configured to process the first message to obtain a second message, and send the second message to the network layer;

[0163] The first transmitter 1404 is configured to obtain a first data packet after processing the second message, and send the first data packet to a VPN server corresponding to the VPN service through a physical network card.

[0164] In some embodiments, the electronic device 1400 further includes:

[0165] The second transmitter 1405 is used to send the first message to the network layer;

[0166] A first filter 1406, used to filter the first message to obtain a third message;

[0167] The memory 1407 is used to store the third message in the shared memory;

[0168] The acquirer 1402 is used to read from the shared memory the third message obtained by filtering the first message.

[0169] In one embodiment, the first filter 1406 is used to filter the first message according to a message header judgment rule to obtain a third message.

[0170] In one embodiment, the first part of the program in the VPN service is deployed on the virtual network card driver corresponding to the virtual network card, and the first part of the program is used to write the first message into the shared memory. That is, the first part of the program in the VPN service can be sunk to the virtual network card driver. In this way, when it is necessary to write a message into the shared memory, the VPN service can write the message into the shared memory through the virtual network card driver.

[0171] In one embodiment, the second part of the program in the VPN service is deployed on the virtual network card driver corresponding to the virtual network card, and the second part of the program is used to read the first message from the shared memory. That is, the second part of the program in the VPN service can be sunk to the virtual network card driver. In this way, when it is necessary to read the message from the shared memory, the VPN service can read the message from the shared memory through the virtual network card driver.

[0172] In one embodiment, the second part of the program in the VPN service is deployed on the physical network card driver corresponding to the physical network card, and the second part of the program is used to read the first message from the shared memory. That is, the second part of the program in the VPN service can be sunk to the physical network card driver. In this way, when it is necessary to read the message from the shared memory, the VPN service can read the message from the shared memory through the physical network card driver.

[0173] In one embodiment, the VPN service is a user-mode VPN service.

[0174] In one embodiment, the VPN service belongs to the network layer or the application layer.

[0175] In some embodiments, the electronic device 1400 further includes: a second filter 1408, configured to filter the second message to obtain a first data packet.

[0176] In one embodiment, the processor 1403 is configured to: encrypt the first message, and encapsulate the message header to obtain a second message.

[0177] In the embodiment of the present application, the electronic device encapsulates the application data of the application into a first message according to the path of the target route corresponding to the virtual network card, and the first message is stored in the shared memory, which is the memory of the kernel state. The VPN service of the electronic device reads the first message from the shared memory, and the VPN service has the authority to read data from the shared memory. The VPN service obtains the second message after processing the first message, and sends the second message to the network layer. The network layer of the electronic device obtains the first data packet after processing the second message, and sends the first data packet to the VPN server corresponding to the VPN service through the physical network card. It can be seen that in the process of converting application data from kernel state to user state in the prior art, it is necessary to undergo two transport layers for encapsulation and two network layers for filtering. In this process of the present application, the VPN service only needs to read the message from the shared memory of the kernel state according to the sharing mechanism, so as to realize the conversion of application data from kernel state to user state, and only needs to undergo one transport layer processing and one network layer processing, thereby reducing redundant processing, reducing power consumption, reducing memory usage, and improving data forwarding performance.

[0178] An embodiment of the present application also provides a computer-readable storage medium, including instructions, which, when executed on a computer, enable the computer to execute any of the above methods.

[0179] The embodiment of the present application also provides a computer program product including instructions, which, when executed on a computer, enables the computer to execute any of the above methods.

[0180] An embodiment of the present application also provides a chip, which includes a processor and an interface circuit, the interface circuit is coupled to the processor, the processor is used to run a computer program or instruction to implement the above method, and the interface circuit is used to communicate with other modules outside the chip.

[0181] In the description of this application, unless otherwise specified, " / " means "or", for example, A / B can mean A or B. "And / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, "at least one" means one or more, and "plurality" means two or more. The words "first", "second", etc. do not limit the quantity and execution order, and the words "first", "second", etc. do not limit them to be different.

[0182] In the description of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0183] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0184] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0185] The units described as separate components may or may not be physically separated, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0186] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0187] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0188] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application shall be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. A data packet transmission method, applied to an electronic device, characterized in that: The method comprises: The transport layer encapsulates the application data of the application into a first message according to the path of the target route corresponding to the virtual network card, wherein the first message is stored in a shared memory, and the shared memory is configured to allow service operations in user mode; The VPN service reads the first message from the shared memory, and the VPN service has the authority to read data from the shared memory; The VPN service processes the first message to obtain a second message, and sends the second message to the network layer; The network layer processes the second message to obtain a first data packet, and sends the first data packet to a VPN server corresponding to the VPN service through a physical network card.

2. The method according to claim 1, characterized in that Before the VPN service reads the first message from the shared memory, the method further includes: The transport layer sends the first message to the network layer; The network layer filters the first message to obtain a third message; The network layer stores the third message in the shared memory; The VPN service reads the first message from the shared memory, including: reading a third message from the shared memory after filtering the first message.

3. The method according to claim 2, characterized in that The network layer filters the first message to obtain a third message, including: The network layer filters the first message according to a message header judgment rule to obtain the third message.

4. The method according to any one of claims 1 to 3, characterized in that The first part of the program in the VPN service is deployed on the virtual network card driver corresponding to the virtual network card, and the first part of the program is used to write the first message into the shared memory.

5. The method according to any one of claims 1 to 4, characterized in that The second part of the program in the VPN service is deployed on a physical network card driver corresponding to the physical network card, and the second part of the program is used to read the first message from the shared memory.

6. The method according to any one of claims 1 to 5, characterized in that The VPN service is a user-mode VPN service.

7. The method according to any one of claims 1 to 6, characterized in that The VPN service belongs to the network layer or the application layer.

8. The method according to any one of claims 1 to 7, characterized in that The network layer processes the second message to obtain a first data packet, including: The network layer filters the second message to obtain the first data packet.

9. The method according to any one of claims 1 to 8, characterized in that The VPN service processes the first message to obtain a second message, including: The VPN service encrypts the first message and encapsulates the message header to obtain the second message.

10. An electronic device, characterized in that: include: The encapsulator is used to encapsulate the application data of the application into a first message according to the path of the target route corresponding to the virtual network card, wherein the first message is stored in a shared memory, and the shared memory is a kernel state memory; An acquirer, configured to read the first message from the shared memory, wherein the shared memory is configured to allow user-mode service operations; A processor, configured to process the first message to obtain a second message, and send the second message to the network layer; The first transmitter is configured to obtain a first data packet after processing the second message, and send the first data packet to a VPN server corresponding to the VPN service through a physical network card.

11. The electronic device according to claim 10, characterized in that: Also includes: A second transmitter, configured to send the first message to the network layer; A first filter, used to filter the first message to obtain a third message; A memory, used for storing the third message in the shared memory; The acquirer is used to read from the shared memory a third message obtained by filtering the first message.

12. The electronic device according to claim 11, characterized in that: The first filter is used to: The first message is filtered according to a message header judgment rule to obtain the third message.

13. The electronic device according to any one of claims 10 to 12, characterized in that: The first part of the program in the VPN service is deployed on the virtual network card driver corresponding to the virtual network card, and the first part of the program is used to write the first message into the shared memory.

14. The electronic device according to any one of claims 10 to 13, characterized in that: The second part of the program in the VPN service is deployed on a physical network card driver corresponding to the physical network card, and the second part of the program is used to read the first message from the shared memory.

15. The electronic device according to any one of claims 10 to 14, characterized in that: The VPN service is a user-mode VPN service.

16. The electronic device according to any one of claims 10 to 15, characterized in that: The VPN service belongs to the network layer or the application layer.

17. The electronic device according to any one of claims 10 to 16, characterized in that: Also includes: The second filter is used to filter the second message to obtain the first data packet.

18. The electronic device according to any one of claims 10 to 17, characterized in that: The processor is used to: The first message is encrypted and a message header is encapsulated to obtain the second message.

Images