Cross-border service traffic transmission method and device, storage medium and program product

Abstract

The invention provides a cross-border service traffic transmission method and device, a storage medium and a program product, relates to the technical field of communication, and can solve the problem of poor network quality in related technologies. The method comprises the following steps: performing application identification on cross-border service traffic, and obtaining target service traffic corresponding to a target application; shunting the target service flow to a virtual private network (VPN) tunnel port; the VPN tunnel port is used for guiding the traffic to the target cross-border channel; and transmitting the target service traffic to an overseas network through the target cross-border channel. According to the invention, the network quality of the cross-border service can be guaranteed.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method, device, storage medium and program product for transmitting cross-border business traffic. Background Art

[0002] Cross-border network access refers to accessing network resources across the borders of different countries or regions. With the development of the economy and society and the upgrading of network infrastructure, cross-border network access has become more and more common, and the demand for cross-border access by network broadband users has also continued to increase.

[0003] At present, compared with domestic access, cross-border access is subject to limitations such as transmission distance, transmission path, and network congestion. Problems such as large end-to-end network delay and high packet loss rate often occur, and the network quality is poor. Therefore, it is difficult to guarantee the normal communication experience of cross-border access users. Summary of the invention

[0004] The present application provides a cross-border business traffic transmission method, device, storage medium and program product, which can ensure the network quality of cross-border business.

[0005] In order to achieve the above objectives, this application adopts the following technical solutions:

[0006] In a first aspect, the present application provides a method for transmitting cross-border business traffic, the method comprising: performing application identification on cross-border business traffic to obtain target business traffic corresponding to the target application; diverting the target business traffic to a virtual private network VPN tunnel port; the VPN tunnel port is used to divert traffic to a target cross-border channel; and transmitting the target business traffic to an overseas network through the target cross-border channel.

[0007] Based on the above technical solution, the cross-border business traffic transmission device can perform application identification on the cross-border business traffic, thereby obtaining the target business traffic corresponding to the target application to be protected. Afterwards, the cross-border business traffic transmission device diverts the target business traffic to the VPN tunnel port. When the target business traffic is diverted to the target cross-border channel through the VPN tunnel port, the cross-border business traffic transmission device can transmit the target business traffic to the overseas network through the target cross-border channel. The above technical solution of the present application can identify, divert and divert cross-border business traffic on the user side, thereby ensuring the network quality of the cross-border transmission of the business to be protected.

[0008] In combination with the above-mentioned first aspect, in a possible implementation method, the method includes: determining the traffic characteristics of cross-border business traffic; and taking the business traffic in the cross-border business traffic that matches the traffic characteristics corresponding to the target application as the target business traffic.

[0009] In combination with the above-mentioned first aspect, in a possible implementation manner, the traffic characteristics include at least one of the following: source IP address, destination IP address, transport layer protocol, port number, application layer protocol, domain name.

[0010] In combination with the above-mentioned first aspect, in a possible implementation method, the method includes: obtaining traffic characteristics corresponding to the target application from a feature database; the feature database is used to store the identification information of the application and the traffic characteristics corresponding to the application; judging whether there is business traffic matching the traffic characteristics corresponding to the target application in the cross-border business traffic; if there is business traffic matching the traffic characteristics corresponding to the target application in the cross-border business traffic, taking the business traffic as the target business traffic.

[0011] In combination with the first aspect above, in a possible implementation, the method also includes: performing network address translation on the target service traffic through a network address translation NAT module, and converting the source IP address of the target service traffic into an IP address in an address pool configured by the NAT module.

[0012] In combination with the above-mentioned first aspect, in a possible implementation method, the method also includes: receiving return service traffic from an overseas network; when the destination IP address of the return service traffic is an IP address in the address pool configured by the NAT module, transmitting the return service traffic through the target cross-border channel.

[0013] In the second aspect, the present application provides a cross-border business traffic transmission device, which includes: a processing unit and a communication unit; the processing unit is used to perform application identification on the cross-border business traffic and obtain the target business traffic corresponding to the target application; the communication unit is used to divert the target business traffic to the virtual private network VPN tunnel port; the VPN tunnel port is used to divert the traffic to the target cross-border channel; the communication unit is used to transmit the target business traffic to the overseas network through the target cross-border channel.

[0014] In combination with the above-mentioned second aspect, in a possible implementation method, the processing unit is used to: determine the traffic characteristics of the cross-border business traffic; and take the business traffic in the cross-border business traffic that matches the traffic characteristics corresponding to the target application as the target business traffic.

[0015] In combination with the above second aspect, in a possible implementation, the traffic characteristics include at least one of the following: source IP address, destination IP address, transport layer protocol, port number, application layer protocol, domain name.

[0016] In combination with the above-mentioned second aspect, in a possible implementation method, the processing unit is used to: obtain the traffic characteristics corresponding to the target application from the feature database; the feature database is used to store the identification information of the application and the traffic characteristics corresponding to the application; determine whether there is business traffic matching the traffic characteristics corresponding to the target application in the cross-border business traffic; if there is business traffic matching the traffic characteristics corresponding to the target application in the cross-border business traffic, take the business traffic as the target business traffic.

[0017] In combination with the above-mentioned second aspect, in a possible implementation method, the processing unit is also used to: perform network address translation on the target service traffic through the network address translation NAT module, and convert the source IP address of the target service traffic into an IP address in the address pool configured by the NAT module.

[0018] In combination with the above-mentioned second aspect, in a possible implementation method, the communication unit is also used to: receive return service traffic from an overseas network; the processing unit is also used to: transmit the return service traffic through a target cross-border channel when the destination IP address of the return service traffic is an IP address in the address pool configured by the NAT module.

[0019] In a third aspect, the present application provides a cross-border business traffic transmission device, which includes: a processor and a communication interface; the communication interface and the processor are coupled, and the processor is used to run a computer program or instruction to implement the method described in any of the above embodiments.

[0020] In a fourth aspect, the present application provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a terminal, the terminal executes the method described in any of the above embodiments.

[0021] In a fifth aspect, the present application provides a computer program product, which includes computer program instructions. When the computer program instructions are executed by a processor, the method described in any of the above embodiments is implemented.

[0022] In a sixth aspect, the present application provides a chip, the chip comprising a processor and a communication interface, the communication interface and the processor are coupled, and the processor is used to run a computer program or instruction to implement the method described in any of the above embodiments.

[0023] Specifically, the chip provided in the present application also includes a memory for storing computer programs or instructions.

[0024] It should be noted that the above computer instructions may be stored in whole or in part on a computer-readable storage medium, wherein the computer-readable storage medium may be packaged together with the processor of the device, or may be packaged separately from the processor of the device, which is not limited in this application.

[0025] The descriptions of the second to sixth aspects of the present application can refer to the detailed description of the first aspect; and the beneficial effects of the descriptions of the second to sixth aspects can refer to the beneficial effect analysis of the first aspect, which will not be repeated here.

[0026] In this application, the name of the above cross-border business traffic transmission device does not limit the device or functional module itself. In actual implementation, these devices or functional modules may appear with other names. As long as the functions of each device or functional module are similar to those of this application, they fall within the scope of the claims of this application and their equivalent technologies.

[0027] These and other aspects of the present application will become more apparent from the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 An architecture diagram of a cross-border business traffic transmission system provided in an embodiment of the present application;

[0029] Figure 2 An architectural diagram of another cross-border business traffic transmission system provided in an embodiment of the present application;

[0030] Figure 3 A scenario diagram of cross-border business traffic transmission provided in an embodiment of the present application;

[0031] Figure 4 A flowchart of a cross-border business traffic transmission method provided in an embodiment of the present application;

[0032] Figure 5 A flowchart of another cross-border business traffic transmission method provided in an embodiment of the present application;

[0033] Figure 6 A flowchart of another cross-border business traffic transmission method provided in an embodiment of the present application;

[0034] Figure 7 A structural diagram of a cross-border business traffic transmission device provided in an embodiment of the present application;

[0035] Figure 8 A structural diagram of another cross-border business traffic transmission device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0036] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0037] The term "and / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0038] The terms "first" and "second" and the like in the specification and drawings of this application are used to distinguish different objects, or to distinguish different processing of the same object, rather than to describe a specific order of objects.

[0039] In addition, the terms "including" and "having" and any variations thereof mentioned in the description of the present application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0040] It should be noted that, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0041] In the description of the present application, unless otherwise specified, “plurality” means two or more.

[0042] Cross-border network access refers to accessing network resources across the borders of different countries or regions. With the development of the economy and society and the upgrading of network infrastructure, cross-border network access has become more and more common, and the demand for cross-border access by network broadband users has also continued to increase.

[0043] At present, compared with domestic access, cross-border access is subject to restrictions such as transmission distance, transmission path, and network congestion. Problems such as large end-to-end network delay and high packet loss rate often occur, and the network quality is poor. Especially for network services that are sensitive to network quality, such as online education and e-commerce live streaming, the communication experience during cross-border access is poor.

[0044] The congestion of the international exit of the operator's Internet is a key factor affecting the quality of the cross-border network. In some embodiments, the network quality can be improved in the following ways.

[0045] 1. Improve the transmission performance of the network through data and protocol optimization. For example, the transmission efficiency of protocols such as the Transmission Control Protocol (TCP) can be improved by compressing the data to be transmitted and modifying the packet loss and retransmission strategy, thereby reducing the delay.

[0046] However, if only optimization measures are taken at the protocol level without changing the transmission path of the traffic, the improvement of latency and packet loss will be limited or unstable. At the same time, this method is limited by the type of protocol. For example, optimization for TCP is not applicable to other protocols (such as new media transmission protocols based on the user datagram protocol (UDP)), resulting in limited optimization effects.

[0047] 2. By setting up a cache server within the country and configuring policies through the gateway or local domain name system (DNS), web pages, files and other content of related domain names are cached. When users access the content of the same domain name again, the access request will be redirected to the cache server within the country, thereby avoiding international export congestion problems and reducing latency and packet loss.

[0048] However, this solution requires authorization from the source site to legally copy and store its content within the country and provide access in the name of the source site. Otherwise, there will be risks of copyright infringement and other infringements. At the same time, setting up a cache server will also bring security risks such as content tampering and access hijacking.

[0049] In addition, since it is difficult for the cache server to synchronize data in time, this solution has a good acceleration effect on static content such as web pages and files, but has limited acceleration effect on dynamic content. Since this solution needs to determine the services to be protected by domain name, the services to be protected need to have relatively centralized and fixed domain names, which is not flexible enough in actual operation.

[0050] 3. Use non-congested, high-performance dedicated cross-border links and deploy proxy servers both in China and abroad. Through policy configuration on the overseas website / application side, when a user accesses their domain name or IP, the access request is redirected to the nearest proxy server in China. Traffic crosses the border through high-performance links, and then the overseas proxy server acts as a proxy for the user to access. Due to the use of dedicated cross-border links, performance indicators such as network latency and packet loss are improved. Return traffic is introduced into the dedicated link based on the address of the proxy server.

[0051] However, optimization through proxy servers and redirection, and switching to dedicated cross-border links can significantly improve latency and packet loss, and there are no issues such as protocol, copyright, dynamic acceleration, and content tampering. However, it still requires that the services to be protected have relatively concentrated and fixed domain names or IP addresses, and still increases the security risk of access hijacking. At the same time, the processing process of multiple servers at home and abroad will also increase a small amount of service latency.

[0052] In view of this, in the technical solution provided in the present application, the cross-border business traffic transmission device can perform application identification on the cross-border business traffic, so as to obtain the target business traffic corresponding to the target application to be protected. Afterwards, the cross-border business traffic transmission device diverts the target business traffic to the virtual private network (VPN) tunnel port. When the target business traffic is diverted to the target cross-border channel through the VPN tunnel port, the cross-border business traffic transmission device can transmit the target business traffic to the overseas network through the target cross-border channel. The above-mentioned technical solution of the present application can identify, divert and divert cross-border business traffic on the user side, thereby ensuring the network quality of the cross-border transmission of the business to be protected.

[0053] The implementation of the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings.

[0054] Figure 1 This is an architecture diagram of a cross-border business traffic transmission system provided in an embodiment of the present application. Figure 1 As shown, the cross-border business traffic transmission system includes: an application identification module 101, a VPN tunnel port 102 and a target cross-border channel 103.

[0055] The application identification module 101 may be a system or module with application identification function deployed in the core layer of the operator's metropolitan area network. The application identification module 101 may be serially connected to a normal forwarding path of user traffic.

[0056] The application identification module 101 is used to identify the received user traffic, thereby realizing the diversion of the user traffic.

[0057] The VPN tunnel port 102 can be configured on the bearer network. After the user traffic is split, the user traffic to be protected flows into the VPN tunnel port 102, and other traffic flows into the normal port connected to the Internet. The VPN tunnel port 102 is used to divert the user traffic to the target cross-border channel 103.

[0058] The target cross-border channel 103 can be connected to the edge device deployed in the operator's network. The user traffic to be protected enters the domestic access point of the target cross-border channel 103, is forwarded to the target cross-border channel 103 through normal routing, enters the overseas network after crossing the border, continues normal routing forwarding, and finally reaches the server side of the application / website overseas.

[0059] It should be understood that the target cross-border channel 103 is physically different from the general Internet international exit. Therefore, the link utilization rate of the target cross-border channel 103 is lower, the congestion is less or no congestion, and the performance indicators such as latency and packet loss of the target cross-border channel 103 are better than those of the general Internet international exit. Therefore, the cross-border business traffic transmission through the target cross-border channel 103 can ensure the network quality of cross-border transmission.

[0060] As a possible embodiment, combining Figure 1 The example shown is Figure 2 As shown, the cross-border service traffic transmission system may further include a network address translation (NAT) module 104. The NAT module 104 is connected to the VPN tunnel port 102 and the target cross-border channel 103 respectively.

[0061] The NAT module 104 may be an edge device deployed in the operator network and configured with a carrier-grade NAT function module. The NAT module 104 is used to perform network address translation on user traffic, that is, to modify the IP address of the user device in the user traffic to a pre-configured user-side dedicated address.

[0062] In some embodiments, Figure 3 As shown, after the user traffic is identified and diverted by the application identification module 101, the user traffic to be protected is diverted to the VPN tunnel port 102 on the bearer network, and other traffic is diverted to the domestic Internet. Other traffic enters the normal port connecting to the Internet of the domestic Internet, and enters the overseas Internet through the international exit of the Internet.

[0063] Among them, after the user traffic to be protected passes through the VPN tunnel port 102, it reaches the PE device deployed with the NAT module 104, and the VPN encapsulation is removed, and then the source address NAT is performed in the NAT module 104 to modify the IP address of the user device to the pre-configured user-side dedicated address. The user traffic to be protected enters the domestic access point of the target cross-border channel 103, is forwarded to the target cross-border channel 103 through normal routing, enters the overseas Internet after crossing the border, continues to perform normal routing forwarding, and finally reaches the server end of the application / website in foreign countries.

[0064] For the return traffic to be guaranteed, the overseas server uses the user-side dedicated address configured by the NAT module 104 as the destination IP address to send the return traffic to the overseas Internet. Since the destination IP address configured for the return traffic is the user-side dedicated address configured by the NAT module 104, each hop routing forwarding device of the overseas Internet forwards it to the overseas side of the target cross-border channel 103 according to the dedicated address, and then crosses the border through the target cross-border channel 103, enters the bearer network VPN on the domestic side, and then reaches the metropolitan area network where the user equipment is located along the VPN path, and finally reaches the user equipment and realizes two-way traffic guarantee.

[0065] It should be noted that the cross-border business traffic transmission method provided in the embodiment of the present application can be applied to at least one of the above-mentioned application identification module 101, VPN tunnel port 102, target cross-border channel 103 and NAT module 104. The above-mentioned application identification module 101, VPN tunnel port 102, target cross-border channel 103 and NAT module 104 can be independent communication devices, such as access network equipment, core network equipment and other communication devices. At this time, the cross-border business traffic transmission method provided in the embodiment of the present application can be implemented by a cross-border business traffic transmission system composed of the above-mentioned application identification module 101, VPN tunnel port 102, target cross-border channel 103 and NAT module 104.

[0066] The above-mentioned application identification module 101, VPN tunnel port 102, target cross-border channel 103 and NAT module 104 can also be functional modules coupled in a communication device, such as a communication network element. The above-mentioned application identification module 101, VPN tunnel port 102, target cross-border channel 103 and NAT module 104 can also be a computer program (application, APP) for executing the cross-border business traffic transmission method. At this time, the cross-border business traffic transmission method provided in the embodiment of the present application can be implemented by a cross-border business traffic transmission device composed of the above-mentioned application identification module 101, VPN tunnel port 102, target cross-border channel 103 and NAT module 104.

[0067] Exemplarily, the cross-border business traffic transmission device may be a server, and the server includes:

[0068] Processor, the processor can be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits used to control the execution of the program of the present application.

[0069] Transceiver, a transceiver can be a device using any transceiver type for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc.

[0070] Memory, the memory may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory may exist independently and be connected to the processor through a communication line. The memory may also be integrated with the processor.

[0071] It should be pointed out that the various embodiments of the present application can learn from or refer to each other. For example, the same or similar steps, method embodiments, system embodiments and device embodiments can all refer to each other without limitation.

[0072] Figure 4 A flow chart of a cross-border business traffic transmission method provided in an embodiment of the present application. Figure 4 As shown, the method comprises the following steps:

[0073] Step 401: The cross-border business traffic transmission device performs application identification on the cross-border business traffic to obtain target business traffic corresponding to the target application.

[0074] Exemplarily, the cross-border business traffic transmission device can perform application identification on the cross-border business traffic by configuring an application identification module on the forwarding path of the user traffic, and then identify the target business traffic corresponding to the target application from the cross-border business traffic.

[0075] The target business traffic corresponding to the target application is the cross-border business traffic to be secured. The target application can be one or more applications. The browsing data generated by the target application during the communication process is the target business traffic corresponding to the target application. The target application can also correspond to the business type to be secured, that is, one or more applications under the business type to be secured.

[0076] Step 402: The cross-border business traffic transmission device diverts the target business traffic to the VPN tunnel port.

[0077] Among them, the VPN tunnel port is used to direct traffic to the target cross-border channel.

[0078] In some embodiments, after the cross-border business traffic transmission device identifies the target business traffic corresponding to the target application, it can divert the target business traffic to the VPN tunnel port configured on the bearer network, and guide the target business traffic to the target cross-border channel through VPN. Other traffic in the cross-border business traffic can flow into the normal port connected to the Internet of the domestic Internet, and enter the overseas Internet through the international exit of the Internet.

[0079] For example, a layer 3 VPN (L3VPN) can be configured in the bearer network. In L3VPN, data traffic will be routed through routing devices when transmitted between different subnets, thereby providing logically isolated network services for different business traffic on a shared basic network facility to ensure data security and network quality of target business traffic.

[0080] Among them, the VPN tunnel port can establish a data connection between the edge device connected to the target cross-border channel at the domestic access point, so as to divert the traffic to the target cross-border channel.

[0081] Step 403: The cross-border business traffic transmission device transmits the target business traffic to the overseas network through the target cross-border channel.

[0082] Exemplarily, the target cross-border channel can be connected to the edge device deployed in the operator's network. The target business traffic enters the domestic access point of the target cross-border channel, is forwarded to the target cross-border channel through normal routing, enters the overseas network after crossing the border, continues normal routing forwarding, and finally reaches the server side of the application / website overseas.

[0083] It should be understood that the target cross-border channel is physically different from the general Internet international exit. Therefore, the link utilization rate of the target cross-border channel is lower, the congestion is less or no congestion, and the performance indicators such as latency and packet loss of the target cross-border channel are better than those of the general Internet international exit. Therefore, the transmission of cross-border business traffic through the target cross-border channel can ensure the network quality of cross-border transmission.

[0084] Based on the above technical solution, the cross-border business traffic transmission device can perform application identification on the cross-border business traffic, thereby obtaining the target business traffic corresponding to the target application to be protected. Afterwards, the cross-border business traffic transmission device diverts the target business traffic to the VPN tunnel port. When the target business traffic is diverted to the target cross-border channel through the VPN tunnel port, the cross-border business traffic transmission device can transmit the target business traffic to the overseas network through the target cross-border channel. The above technical solution of the present application can identify, divert and divert cross-border business traffic on the user side, thereby ensuring the network quality of the cross-border transmission of the business to be protected.

[0085] The following is an introduction to the process of application identification of a cross-border business traffic transmission device.

[0086] As a possible embodiment of the present application, Figure 4 The embodiment shown, as Figure 5 As shown, the above step 401 can also be implemented through the following steps 501-502.

[0087] Step 501: The cross-border business traffic transmission device determines the traffic characteristics of the cross-border business traffic.

[0088] In some embodiments, the flow characteristics include at least one of the following:

[0089] Source IP address, destination IP address, transport layer protocol, port number, application layer protocol, domain name.

[0090] Exemplarily, the cross-border business traffic transmission device can obtain the traffic characteristics of the cross-border business traffic from the data packets of the cross-border business traffic.

[0091] Step 502: The cross-border business traffic transmission device takes the business traffic in the cross-border business traffic that matches the traffic characteristics corresponding to the target application as the target business traffic.

[0092] In one possible implementation, the cross-border business traffic transmission device can obtain the traffic characteristics corresponding to the target application from the characteristic database, and determine whether there is business traffic in the cross-border business traffic that matches the traffic characteristics corresponding to the target application.

[0093] In the case that there is business traffic in the cross-border business traffic that matches the traffic characteristics corresponding to the target application, the cross-border business traffic transmission device can use the business traffic as the target business traffic.

[0094] The feature database is used to store the identification information of the application and the traffic features corresponding to the application.

[0095] Exemplarily, the identification information of the application stored in the feature database may be field information that can identify the application, such as the application name and application ID. For the cross-border business to be protected, the cross-border business traffic transmission device can analyze the traffic characteristics that are different between the cross-border business and other business traffic, and add the above traffic characteristics as the traffic characteristics corresponding to the application to the feature database, thereby realizing the update and maintenance of the feature database.

[0096] Based on the above technical solution, the cross-border business traffic transmission device in this application can obtain business traffic that matches the traffic characteristics corresponding to the target application from the cross-border business traffic by matching traffic characteristics, thereby realizing the diversion of the traffic to be protected and other traffic based on the application identification and diversion technology on the user side. Compared with the method of operating on the service side in the related technology, the above solution provided by this application can avoid the request redirection process while ensuring that the network quality is significantly improved, making the operation process simpler and more secure. At the same time, the above application identification method of this application can support the identification of multiple features and their combinations such as the network layer, transport layer, and application layer, so it is not limited to a specific domain name or IP, making the control and adjustment of the protection scope more flexible.

[0097] In addition, the cross-border business traffic transmission device in the present application can also ensure the network quality of the return business traffic of the cross-border business by performing NAT on the target business traffic.

[0098] The following describes the process of performing NAT on a cross-border business traffic transmission device.

[0099] As a possible embodiment of the present application, Figure 4 The embodiment shown, as Figure 6 As shown, the method further includes the following step 601.

[0100] Step 601: The cross-border business traffic transmission device performs network address translation on the target business traffic through the NAT module, and converts the source IP address of the target business traffic into an IP address in the address pool configured by the NAT module.

[0101] The source IP address of the target service traffic is the IP address corresponding to the user device. The address pool configured by the NAT module may include a continuous public network address as the user-side dedicated address for the service to be guaranteed.

[0102] Exemplarily, after the target business traffic passes through the VPN tunnel port, it reaches the PE device deployed with the NAT module and removes the VPN encapsulation. At this time, the source IP address of the target business traffic is the IP address corresponding to the user device. Subsequently, the cross-border business traffic transmission device performs source address NAT on the target business traffic through the NAT module, and modifies the source IP address to a pre-configured user-side dedicated address. At this time, the target business traffic enters the domestic access point of the target cross-border channel with the specified dedicated address as the source ID address, is forwarded to the target cross-border channel through normal routing, enters the overseas Internet after crossing the border, continues normal routing forwarding, and finally reaches the application / website's server end abroad.

[0103] The above conversion process may select a corresponding conversion technology according to the type of IP address corresponding to the user equipment, for example, network address translation for IPv4 to IPv4 (NAT44) based on Internet Protocol version 4 (IPv4), network address translation for IPv6 to IPv6 (NAT66) based on Internet Protocol version 6 (IPv6), etc.

[0104] Based on the above technical solution, the cross-border business traffic transmission device can perform network address translation on the target business traffic through the NAT module, thereby converting the source IP address of the target business traffic into an IP address in the address pool configured by the NAT module. Since the overseas network does not have an application identification system, VPN and other diversion channels are configured. However, business access generally involves two-way communication. This application can distinguish target business traffic from other traffic through the configured user-side dedicated IP address by performing network address translation on the target business traffic. In this way, the return traffic sent from the overseas server to the domestic user can be diverted to the dedicated cross-border channel according to the IP address, thereby achieving the effect of ensuring network quality.

[0105] In one possible embodiment, combining Figure 4 The embodiment shown, as Figure 6 As shown, the method further includes the following steps 602-603.

[0106] Step 602: The cross-border business traffic transmission device receives return business traffic from an overseas network.

[0107] The return traffic may be the return traffic corresponding to the target traffic, or may be the return traffic corresponding to other traffic.

[0108] Step 603: When the destination IP address of the return traffic is an IP address in the address pool configured by the NAT module, the cross-border traffic transmission device transmits the return traffic through the target cross-border channel.

[0109] It should be understood that if the destination IP address of the return business traffic is an IP address in the address pool configured by the NAT module, it means that the return business traffic is the return traffic corresponding to the target business traffic. In order to ensure the network quality of the target application, the cross-border business traffic transmission device can divert the return business traffic to the target cross-border channel for transmission. After crossing the border through the target cross-border channel, the return business traffic enters the bearer network VPN on the domestic side, and then reaches the metropolitan area network where the user equipment is located along the VPN path, and finally reaches the user equipment and realizes two-way traffic guarantee.

[0110] Based on the above technical solution, the cross-border business traffic transmission device can receive return business traffic from overseas networks, and transmit the return business traffic through the target cross-border channel when the destination IP address of the return business traffic is an IP address in the address pool configured by the NAT module. In other words, the above technical solution of the present application only requires the Internet routing device to identify the return business traffic to be guaranteed by the destination IP address and forward it to the dedicated channel during the return trip. It does not require a proxy server on the service side or a dedicated overseas VPN to divert traffic, and can achieve return traffic identification and diversion, further simplifying the overall solution process and system facilities, and ensuring the network quality of cross-border business while saving costs.

[0111] The embodiment of the present application can divide the cross-border business traffic transmission device into functional modules or functional units according to the above method example. For example, each functional module or functional unit can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules or functional units. Among them, the division of modules or units in the embodiment of the present application is schematic, which is only a logical functional division. There may be other division methods in actual implementation.

[0112] Take the communication device as the cross-border business traffic transmission device in the above method embodiment as an example, Figure 7 The structure diagram of a cross-border business traffic transmission device 70 is shown. The cross-border business traffic transmission device 70 includes:

[0113] The processing unit 701 is used to perform application identification on the cross-border business traffic and obtain the target business traffic corresponding to the target application.

[0114] The communication unit 702 is used to divert the target business traffic to the virtual private network VPN tunnel port; the VPN tunnel port is used to direct the traffic to the target cross-border channel.

[0115] The communication unit 702 is used to transmit the target business traffic to the overseas network through the target cross-border channel.

[0116] In a possible implementation, the processing unit 701 is used to: determine the traffic characteristics of the cross-border business traffic; and use the business traffic in the cross-border business traffic that matches the traffic characteristics corresponding to the target application as the target business traffic.

[0117] In a possible implementation, the traffic feature includes at least one of the following: a source IP address, a destination IP address, a transport layer protocol, a port number, an application layer protocol, and a domain name.

[0118] In one possible implementation, the processing unit 701 is used to: obtain traffic characteristics corresponding to the target application from a feature database; the feature database is used to store the identification information of the application and the traffic characteristics corresponding to the application; determine whether there is business traffic matching the traffic characteristics corresponding to the target application in the cross-border business traffic; if there is business traffic matching the traffic characteristics corresponding to the target application in the cross-border business traffic, use the business traffic as the target business traffic.

[0119] In a possible implementation, the processing unit 701 is further configured to perform network address translation on the target service traffic through a network address translation NAT module, and convert the source IP address of the target service traffic into an IP address in an address pool configured by the NAT module.

[0120] In one possible implementation, the communication unit 702 is also used to: receive return traffic from an overseas network; the processing unit 701 is also used to: transmit the return traffic through a target cross-border channel when the destination IP address of the return traffic is an IP address in the address pool configured by the NAT module.

[0121] When implemented by hardware, the communication unit 702 in the embodiment of the present application can be integrated on the communication interface, and the processing unit 701 can be integrated on the processor. Figure 8 shown.

[0122] Figure 8Another possible structural diagram of the cross-border business traffic transmission device involved in the above embodiment is shown. The cross-border business traffic transmission device 80 includes: a processor 802 and a communication interface 803. The processor 802 is used to control and manage the actions of the cross-border business traffic transmission device 80. The communication interface 803 is used to support the communication between the cross-border business traffic transmission device 80 and other network entities. The cross-border business traffic transmission device 80 may also include a memory 801 and a bus 804, and the memory 801 is used to store the program code and data of the cross-border business traffic transmission device 80.

[0123] Among them, the memory 801 can be a memory in the cross-border business traffic transmission device 80, etc. The memory may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a read-only memory, a flash memory, a hard disk or a solid-state drive; the memory may also include a combination of the above types of memory.

[0124] The processor 802 may be a processor that implements or executes various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of the present application. The processor 802 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array, or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of the present application. The processor 802 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0125] The bus 804 may be an Extended Industry Standard Architecture (EISA) bus, etc. The bus 804 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0126] Figure 8 The cross-border business traffic transmission device 80 may also be a chip. The chip includes one or more (including two) processors 802 and a communication interface 803.

[0127] In some embodiments, the chip further includes a memory 801, which may include a read-only memory and a random access memory, and provides operation instructions and data to the processor 802. A portion of the memory 801 may also include a non-volatile random access memory (NVRAM).

[0128] In some implementations, the memory 801 stores the following elements, execution modules or data structures, or a subset thereof, or an extended set thereof.

[0129] In the embodiment of the present application, the corresponding operation is performed by calling the operation instruction stored in the memory 801 (the operation instruction may be stored in the operating system).

[0130] Through the description of the above implementation methods, technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0131] An embodiment of the present application provides a computer program product comprising instructions. When the computer program product is run on a computer, the computer is enabled to execute the cross-border business traffic transmission method in the above method embodiment.

[0132] An embodiment of the present application also provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a computer, the computer executes the cross-border business traffic transmission method in the method flow shown in the above method embodiment.

[0133] Among them, the computer readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a register, a hard disk, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above, or any other form of computer readable storage medium known in the art. An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an application-specific integrated circuit (ASIC). In the embodiments of the present application, a computer-readable storage medium may be any tangible medium that contains or stores a program, which may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0134] Since the cross-border business traffic transmission device, computer-readable storage medium, and computer program product in the embodiments of the present application can be applied to the above-mentioned method, the technical effects that can be obtained can also refer to the above-mentioned method embodiments, and the embodiments of the present application will not be repeated here.

[0135] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0136] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0137] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0138] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for transmitting cross-border business traffic, characterized in that: The method comprises: Perform application identification on cross-border business traffic and obtain the target business traffic corresponding to the target application; Diverting the target business traffic to a virtual private network VPN tunnel port; the VPN tunnel port is used to divert the traffic to a target cross-border channel; The target business traffic is transmitted to an overseas network through the target cross-border channel.

2. The method according to claim 1, characterized in that The step of performing application identification on the cross-border business traffic and obtaining the target business traffic corresponding to the target application includes: Determining the traffic characteristics of the cross-border business traffic; The business traffic in the cross-border business traffic that matches the traffic characteristics corresponding to the target application is taken as the target business traffic.

3. The method according to claim 2, characterized in that The flow characteristics include at least one of the following: Source IP address, destination IP address, transport layer protocol, port number, application layer protocol, domain name.

4. The method according to claim 2, characterized in that: The taking the business traffic matching the traffic characteristics corresponding to the target application in the cross-border business traffic as the target business traffic includes: Acquire the traffic characteristics corresponding to the target application from a characteristic database; the characteristic database is used to store identification information of the application and the traffic characteristics corresponding to the application; Determine whether there is business traffic in the cross-border business traffic that matches the traffic characteristics corresponding to the target application; In the case that there is business traffic in the cross-border business traffic that matches the traffic characteristics corresponding to the target application, the business traffic is used as the target business traffic.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: The target service traffic is subjected to network address translation by a network address translation (NAT) module, and the source IP address of the target service traffic is translated into an IP address in an address pool configured by the NAT module.

6. The method according to claim 5, characterized in that The method further comprises: receiving backhaul service traffic from the overseas network; When the destination IP address of the return traffic is an IP address in the address pool configured by the NAT module, the return traffic is transmitted through the target cross-border channel.

7. A cross-border business traffic transmission device, characterized in that: include: a processing unit and a communication unit; The processing unit is used to perform application identification on the cross-border business traffic and obtain the target business traffic corresponding to the target application; The communication unit is used to divert the target service traffic to a virtual private network VPN tunnel port; The VPN tunnel port is used to direct traffic to the target cross-border channel; The communication unit is used to transmit the target business traffic to an overseas network through the target cross-border channel.

8. A cross-border business traffic transmission device, characterized in that: include: A processor and a communication interface; the communication interface is coupled to the processor, and the processor is used to run a computer program or instruction to implement the cross-border business traffic transmission method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions. When a computer executes the instructions, the computer executes the cross-border business traffic transmission method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that The computer program product includes computer program instructions, which, when executed by a processor, implement the cross-border business traffic transmission method as described in any one of claims 1 to 6.

Images