Message processing method and device, equipment, storage medium and program product

Abstract

The invention relates to a message processing method and device, equipment, a storage medium and a program product. The method comprises the following steps: receiving a to-be-processed message sent by a client; if the to-be-processed message is a tunnel message, decapsulating the to-be-processed message to remove a protocol header of the to-be-processed message; according to the negotiation information of the tunnel message, carrying out decryption operation and redundancy elimination operation on the de-packaged to-be-processed message, and determining an original message corresponding to the to-be-processed message; and processing the VPP operation through the vector data packet, and forwarding the original message corresponding to the to-be-processed message. By adopting the method, the transmission performance of the network tunnel can be ensured.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a message processing method, device, equipment, storage medium and program product. Background Art

[0002] Virtual network tunneling technology is a technology that builds a dedicated, logical data communication channel on a public network infrastructure. Virtual network tunneling technology adds additional encapsulation information to data packets, allowing data packets to be transmitted securely and efficiently between different physical networks.

[0003] In related technologies, data can be encrypted through an open virtual private network (OpenVPN) to ensure the security of data during transmission. OpenVPN supports two transmission protocols, TCP and UDP, and the appropriate transmission protocol can be selected according to the network conditions.

[0004] However, in some network environments with high latency or high packet loss, the UDP protocol is inefficient and has no anti-packet loss function. Although TCP transmission is reliable, repeated retransmissions increase latency when the network is not in good condition. Therefore, the performance of network tunnel transmission cannot be guaranteed at present. Summary of the invention

[0005] Based on this, it is necessary to provide a message processing method, device, equipment, storage medium and program product that can ensure the performance of network tunnel transmission in response to the above technical problems.

[0006] In a first aspect, the present application provides a message processing method, which is applied to a server, comprising:

[0007] Receive the pending message sent by the client;

[0008] If the message to be processed is a tunnel message, decapsulate the message to be processed to remove the protocol header of the message to be processed;

[0009] According to the negotiation information of the tunnel message, decryption operation and redundancy removal operation are performed on the unsealed message to be processed to determine the original message corresponding to the message to be processed;

[0010] The original message corresponding to the message to be processed is forwarded through a vector packet processing (VPP) operation.

[0011] In one of the embodiments, before receiving the message to be processed sent by the client, the method further includes:

[0012] Receive negotiation indication information of the tunnel message sent by the client, wherein the negotiation indication information includes: an encryption type of the tunnel message, an encryption key of the tunnel message, a type of de-redundancy operation of the tunnel message, and configuration information of the de-redundancy operation.

[0013] In one of the embodiments, the de-redundancy operation includes a forward error correction FEC operation and / or a fast reliable transport protocol KCP operation;

[0014] The FEC operation is used to detect and correct errors in the transmission process of the message to be processed, and the KCP operation implements fast retransmission, congestion control, out-of-order processing and window management in an unreliable network environment.

[0015] In one of the embodiments, performing a decryption operation and a redundancy removal operation on the unsealed message to be processed according to the negotiation information of the tunnel message, and determining an original message corresponding to the message to be processed includes:

[0016] According to the encryption type of the tunnel message and the encryption key of the tunnel message, a decryption operation is performed on the unsealed message to be processed to obtain a decrypted message to be processed;

[0017] According to the type of the de-redundancy operation of the tunnel message and the configuration information of the de-redundancy operation, the decrypted message to be processed is decoded at least once to determine the original message corresponding to the message to be processed.

[0018] In a second aspect, the present application provides a message processing method, which is applied to a client, comprising:

[0019] Get the original message;

[0020] Perform encryption and redundancy removal operations on the original message according to the negotiation information of the tunnel message to determine the original message after processing;

[0021] Encapsulating the processed original message and adding a protocol header corresponding to the tunnel message to generate a message to be processed;

[0022] Use the VPP operation to send the message to be processed to the server.

[0023] In one embodiment, before using the VPP operation to send the to-be-processed message to the server, the method further includes:

[0024] The negotiation indication information of the tunnel message sent to the server includes: the encryption type of the tunnel message, the encryption key of the tunnel message, the type of de-redundancy operation of the tunnel message, and the configuration information of the de-redundancy operation.

[0025] In one of the embodiments, the de-redundancy operation includes a forward error correction FEC operation and / or a fast reliable transport protocol KCP operation;

[0026] The FEC operation is used to detect and correct errors in the transmission process of the message to be processed, and the KCP operation implements fast retransmission, congestion control, out-of-order processing and window management in an unreliable network environment.

[0027] In one of the embodiments, performing encryption and de-redundancy operations on the original message according to the negotiation information of the tunnel message to determine the processed original message includes:

[0028] Performing an encryption operation on the original message according to the encryption type of the tunnel message and the encryption key of the tunnel message to obtain an encrypted original message;

[0029] According to the type of the de-redundancy operation of the tunnel message and the configuration information of the de-redundancy operation, the encrypted original message is encoded at least once to determine the processed original message.

[0030] In a third aspect, the present application provides a message processing device, applied to a server, the device comprising:

[0031] A receiving module, used for receiving a message to be processed sent by a client;

[0032] The first processing module is used to decapsulate the message to be processed to remove the protocol header of the message to be processed if the message to be processed is a tunnel message; perform a decryption operation and a de-redundancy operation on the decapsulated message to be processed according to the negotiation information of the tunnel message, and determine the original message corresponding to the message to be processed;

[0033] The first sending module is used to forward the original message corresponding to the message to be processed through a vector data packet processing (VPP) operation.

[0034] In one of the embodiments, the receiving module is also used to receive negotiation indication information of the tunnel message sent by the client, and the negotiation indication information includes: the encryption type of the tunnel message, the encryption key of the tunnel message, the type of de-redundancy operation of the tunnel message, and configuration information of the de-redundancy operation.

[0035] In one of the embodiments, the de-redundancy operation includes a forward error correction FEC operation and / or a fast reliable transport protocol KCP operation;

[0036] The FEC operation is used to detect and correct errors in the transmission process of the message to be processed, and the KCP operation implements fast retransmission, congestion control, out-of-order processing and window management in an unreliable network environment.

[0037] In one of the embodiments, the first processing module is further used to perform a decryption operation on the unsealed message to be processed according to the encryption type of the tunnel message and the encryption key of the tunnel message to obtain a decrypted message to be processed; and to decode the decrypted message to be processed at least once according to the type of de-redundancy operation of the tunnel message and the configuration information of the de-redundancy operation to determine the original message corresponding to the message to be processed.

[0038] In a fourth aspect, the present application provides a message processing device, applied to a client, the device comprising:

[0039] The second processing module is used to obtain the original message; perform encryption and de-redundancy operations on the original message according to the negotiation information of the tunnel message to determine the processed original message; encapsulate the processed original message and add the protocol header corresponding to the tunnel message to generate a message to be processed;

[0040] The second sending module is used to use the VPP operation to send the message to be processed to the server.

[0041] In one of the embodiments, the second sending module is also used to send negotiation indication information of the tunnel message to the server, and the negotiation indication information includes: the encryption type of the tunnel message, the encryption key of the tunnel message, the type of de-redundancy operation of the tunnel message, and the configuration information of the de-redundancy operation.

[0042] In one of the embodiments, the de-redundancy operation includes a forward error correction FEC operation and / or a fast reliable transport protocol KCP operation;

[0043] The FEC operation is used to detect and correct errors in the transmission process of the message to be processed, and the KCP operation implements fast retransmission, congestion control, out-of-order processing and window management in an unreliable network environment.

[0044] In one of the embodiments, the second processing module is further used to perform an encryption operation on the original message according to the encryption type of the tunnel message and the encryption key of the tunnel message to obtain the encrypted original message; and to encode the encrypted original message at least once according to the type of de-redundancy operation of the tunnel message and the configuration information of the de-redundancy operation to determine the processed original message.

[0045] In a fifth aspect, the present application provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the method described in the first aspect are implemented.

[0046] In a sixth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the method described in the first aspect are implemented.

[0047] In a seventh aspect, the present application provides a computer program product, including a computer program, characterized in that when the computer program is executed by a processor, the steps of the method described in the first aspect are implemented.

[0048] The above-mentioned message processing method, device, equipment, storage medium and program product first receive the message to be processed sent by the client. If the message to be processed is a tunnel message, the message to be processed is decapsulated to remove the protocol header of the message to be processed. Subsequently, according to the negotiation information of the tunnel message, the decapsulated message to be processed is decrypted and de-redundant, and the original message corresponding to the message to be processed is determined. Finally, the original message corresponding to the message to be processed is forwarded through the vector packet processing VPP operation. Since the de-redundant operation is indicated by the negotiation mechanism, the de-redundant operation can be performed on the message to be processed after decryption, thereby reducing the tunnel packet loss rate and delay, thereby ensuring the performance of the network tunnel transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0050] FIG1 is an application environment diagram of a message processing method provided in an embodiment of the present application;

[0051] Figure 2 A flowchart of a message processing method provided in an embodiment of the present application;

[0052] Figure 3 A schematic diagram of a negotiation flow between a client and a server that is improved in an embodiment of the present application;

[0053] Figure 4 A schematic diagram of data flow between a client and a server provided in an embodiment of the present application;

[0054] Figure 5 A schematic diagram of the principle of receiving a tunnel message provided in an embodiment of the present application;

[0055] Figure 6 A flowchart of another message processing method provided in an embodiment of the present application;

[0056] Figure 7 A schematic diagram of the principle of sending a tunnel message provided in an embodiment of the present application;

[0057] Figure 8 A signaling interaction diagram of a message processing method provided in an embodiment of the present application;

[0058] Fig. 9 A structural block diagram of a message processing device provided in an embodiment of the present application;

[0059] Fig.10 A structural block diagram of another message processing device provided in an embodiment of the present application

[0060] Fig.11 An internal structure diagram of a computer device provided in an embodiment of the present application;

[0061] Fig.12 An internal structure diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0062] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0063] First, the related technology will be described below.

[0064] Traditional physical private networks (such as dedicated lines) are costly and have long deployment cycles, making it difficult to meet the rapidly changing market demands. At the same time, the scalability and flexibility of physical networks are also limited, making it difficult to meet the needs of large-scale data centers and cloud computing environments. With the popularization of technologies such as server virtualization, storage virtualization, and network virtualization, the demand for network resources in data centers and cloud computing environments is increasing. Virtual network tunnel technology can provide flexible and scalable network solutions for these environments, and is therefore becoming more and more popular.

[0065] Virtual network tunnel technology is a technology that builds a dedicated, logical data communication channel on a public network infrastructure. Virtual network tunnel technology adds additional encapsulation information to data packets, allowing data packets to be transmitted in a dedicated, private channel, allowing data packets to be transmitted securely and efficiently between different physical networks. Virtual network tunnel technology can be widely used in enterprise networks, data center interconnection, cloud computing and other fields, providing users with flexible, scalable and secure network solutions.

[0066] It should be understood that virtual network tunnel technology usually has technical features such as encapsulation, flexibility, and security. In terms of encapsulation, virtual network tunnel technology encapsulates data packets into a format that can be transmitted on the public network by adding additional encapsulation information to the data packets. This encapsulation process ensures the integrity and security of the data packets during transmission. In terms of flexibility, virtual network tunnel technology can span different physical networks to achieve cross-regional and cross-operator network interconnection. At the same time, virtual network tunnel technology can also be dynamically adjusted and optimized according to business needs to improve the flexibility and scalability of the network. In terms of security, virtual network tunnel technology uses security mechanisms such as encryption and authentication to ensure the confidentiality, integrity and availability of data during transmission. At the same time, virtual network tunnel technology can also provide security functions such as access control and auditing to enhance network security.

[0067] It should be understood that virtual network tunnel technology can be widely used in enterprise networks, data center interconnection, cloud computing and other fields. First, enterprise networks can use virtual network tunnel technology to build cross-regional private networks to achieve application scenarios such as remote office and branch office interconnection. Private networks can provide enterprises with secure and reliable network communication services. Secondly, in the cloud computing and big data environment, the interconnection between data centers has become particularly important. Virtual network tunnel technology can achieve Layer 2 or Layer 3 interconnection between data centers and improve the resource utilization and scalability of data centers. Thirdly, cloud computing platforms need to provide users with flexible and scalable network services. Virtual network tunnel technology can help cloud computing platforms build virtual network environments and achieve network isolation and resource sharing between users.

[0068] Based on this, virtual network tunnel technology is a technology that builds a dedicated, logical data communication channel on a public network infrastructure. The development motivations of virtual network tunnel technology include physical network limitations, the popularization of virtualization technology, and security needs. Virtual network tunnel technology has the characteristics of encapsulation, flexibility, and security, and is widely used in enterprise networks, data center interconnection, cloud computing and other fields.

[0069] In related technologies, data can be encrypted through an Open Virtual Private Network (OpenVPN) to ensure the security of data during transmission. OpenVPN is an open source virtual private network protocol based on the Open Secure Sockets Layer (OpenSSL) library, which provides a secure, efficient and flexible network communication solution.

[0070] It should be understood that since OpenVPN is an open source project, it supports multiple operating systems and platforms (for example, Windows, macOS, Linux, iOS, and Android, etc.), which enables OpenVPN to run on a variety of devices and environments. Secondly, OpenVPN uses the Secure Sockets Layer (SSL) / Transport Layer Security (TLS) protocol to encrypt data to ensure the security of data during transmission. OpenVPN supports a variety of encryption algorithms, such as the Advanced Encryption Standard (AES) algorithm, the Data Encryption Standard (DES), the Triple Data Encryption Standard (3DES), the Blowfish algorithm, and the Camellia algorithm, etc. Users can choose the appropriate encryption algorithm according to actual needs. Thirdly, OpenVPN uses optimized transmission protocols and data compression technology to improve the efficiency and stability of data transmission. Finally, OpenVPN supports two transmission protocols, TCP and UDP, and users can choose the appropriate protocol according to network conditions. In addition, OpenVPN also supports a variety of authentication methods, including pre-shared keys, third-party certificates, and username / password combinations.

[0071] The working principle of OpenVPN is mainly based on virtual network cards and SSL / TLS protocols. First, OpenVPN can use a driver software implemented by virtual network cards using network underlying programming technology. It can add a non-real network card to the host and configure it like other network cards, which allows OpenVPN to transmit data like a real network device. Secondly, the virtual network card SSL / TLS protocol is used to implement data packet encryption and verification. When data is transmitted in the OpenVPN channel, it is first encrypted and then transmitted to the destination address. At the destination address, the data packet will be decrypted and restored to the original data. In this way, OpenVPN can ensure the security of data during transmission.

[0072] OpenVPN can be used to implement a variety of application scenarios. Enterprise employees can use OpenVPN to securely access the company's internal network at home or elsewhere to achieve remote work and data transmission. OpenVPN can be used to build a secure VPN network to protect the privacy and security of users on public networks. OpenVPN can be used to connect and manage IoT devices to achieve secure communication and data transmission between devices. In some cases, certain resources may be restricted by geographic location or network policy. Through OpenVPN, users can bypass these restrictions and access restricted resources.

[0073] However, the virtual network tunnel technology implemented by OpenVPN has the following problems. The first problem is that in some high-latency or high-packet-loss network environments, the UDP protocol is inefficient and has no anti-packet-loss function. Although TCP transmission is reliable, repeated retransmissions increase latency when the network is not in good condition. The Linux data plane frequently forwards in and out of the protocol stack, resulting in high system overhead and performance limitations by the kernel. Therefore, the performance of network tunnel transmission cannot be guaranteed at present. The second problem is that operation and maintenance personnel need a certain technical foundation for configuration and installation. The third problem is that many virtual network tunnel technologies generally use standardized encryption protocols, which enhances interoperability but also provides attackers with opportunities to exploit known vulnerabilities. The complex key management process increases the risk of key leakage, thereby weakening the security of the tunnel. In addition, some tunnel protocols may not be able to fully foresee all potential security threats in the early stages of design, resulting in security vulnerabilities. The fourth problem is that some tunnel technologies are highly dependent on specific hardware devices or software platforms, which limits their deployment and expansion capabilities in different environments. Standardized tunnel protocols are difficult to quickly adapt to rapidly changing network environments and business needs. At the same time, the physical resources (CPU, memory, bandwidth) that tunnels rely on are limited, which limits their processing power and expansion potential.

[0074] To solve the above problems, the embodiments of the present application provide a message processing method, apparatus, device, storage medium and program product. First, a message to be processed sent by a client is received. If the message to be processed is a tunnel message, the message to be processed is decapsulated to remove the protocol header of the message to be processed. Subsequently, according to the negotiation information of the tunnel message, the decapsulated message to be processed is decrypted and de-redundant, and the original message corresponding to the message to be processed is determined. Finally, the original message corresponding to the message to be processed is forwarded through the vector data packet processing VPP operation. Since the de-redundant operation is indicated through the negotiation mechanism, the de-redundant operation can be performed after the message to be processed is decrypted, thereby reducing the tunnel packet loss rate and delay, thereby ensuring the performance of the network tunnel transmission.

[0075] The following describes the application environment of the message processing method provided in the embodiment of the present application.

[0076] The message processing method provided in the embodiment of the present application can be applied to the application environment shown in Figure 1. Among them, the client 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers.

[0077] When transmitting a message, the client 102 sends a message to be processed to the server 104. If the message to be processed is a tunnel message, the server 104 decapsulates the message to be processed to remove the protocol header of the message to be processed. Subsequently, the server 104 performs a decryption operation and a de-redundancy operation on the decapsulated message to be processed according to the negotiation information of the tunnel message, and determines the original message corresponding to the message to be processed. Finally, the server 104 forwards the original message corresponding to the message to be processed through the vector packet processing VPP operation.

[0078] The client 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices, and portable wearable devices. IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. Head-mounted devices may be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The server 104 may be an independent physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides cloud computing services.

[0079] In an exemplary embodiment, Figure 2 As shown, a message processing method is provided, and the method is applied to the server in FIG. 1 as an example for description, including S201-S204:

[0080] S201: The server receives a message to be processed sent by the client.

[0081] In this application, when a message needs to be processed, the client can send the message to be processed to the server.

[0082] It should be understood that the embodiments of the present application do not limit the above-mentioned messages to be processed, which can be any type of messages, including tunnel messages.

[0083] It should be understood that the embodiments of the present application do not limit how the server receives the message to be processed. In some embodiments, the message to be processed can be received by the Data Plane Development Kit (DPDK) in the server. DPDK is an open source software development kit for building high-performance data plane applications. DPDK aims to improve the performance of network applications by bypassing the network protocol stack of the operating system kernel and directly sending, receiving and processing data packets in user space. DPDK provides a set of optimized user space libraries and drivers that support high-performance packet processing, memory management, multi-core concurrent processing and other functions.

[0084] In some embodiments, before the client sends the message to be processed to the server, it can also send negotiation indication information of the tunnel message to the server, and the negotiation indication information includes: the encryption type of the tunnel message, the encryption key of the tunnel message, the type of de-redundancy operation of the tunnel message, and the configuration information of the de-redundancy operation.

[0085] Exemplarily, the redundancy removal operation includes a forward error correction (FEC) operation and / or a Kernel Congestion Control Protocol (KCP) operation. The FEC operation is used to detect and correct errors in the transmission process of the message to be processed, and the KCP operation implements fast retransmission, congestion control, out-of-order processing and window management in an unreliable network environment.

[0086] In other embodiments, the redundancy removal operation may also include parity check, cyclic redundancy check, etc.

[0087] It should be understood that the type of de-redundancy operation of the tunnel message included in the negotiation indication information may indicate that the de-redundancy operation of the tunnel message has been enabled, and the type of de-redundancy operation of the tunnel message not included in the negotiation indication information may indicate that the de-redundancy operation of the tunnel message has not been enabled.

[0088] It should be understood that FEC is a coding technology widely used in communication systems and data transmission. FEC operation can detect and correct errors during data transmission, thereby improving the reliability and fault tolerance of data transmission. KCP is a fast and reliable transmission protocol based on UDP, which can provide low latency and high reliability data transmission in unreliable network environments. It is particularly suitable for real-time applications such as real-time games, video communications, etc.

[0089] Accordingly, the configuration information of the de-redundancy operation may include the configuration information of FEC and / or the configuration information of KCP.

[0090] Exemplarily, the encryption types of tunnel messages may include Advanced Encryption Standard (AES) algorithm, Data Encryption Standard (DES), Triple Data Encryption Standard (3DES), Blowfish algorithm, Camellia algorithm, etc., but the embodiments of the present application do not limit this.

[0091] For example, Figure 3 A schematic diagram of a negotiation flow between a client and a server is provided for improving the embodiment of the present application, such as Figure 3 As shown, before the client sends a message to be processed to the server, the negotiation indication information can be exchanged through the negotiation flow. The client can exchange the client's identity document (ID), indication information of the asymmetric encryption algorithm, encryption type, FEC configuration information and / or KCP configuration information.

[0092] It should be understood that the embodiments of the present application do not limit how to transmit the negotiation indication information of the pending messages and tunnel messages. Exemplarily, the negotiation indication information for the tunnel message can be transmitted by a negotiation program running on Linux, which can be started through a service in a Linux terminal. Exemplarily, for the pending messages, they can be transmitted by a data transmission program running in the form of a plug-in in Vector Packet Processing (VPP), and started in VPP through the Command Line Interface (CLI).

[0093] Among them, VPP is a high-performance network data processing technology that can use the single instruction multiple data (SIMD) and vector processing capabilities of modern processors to accelerate the processing of network data packets. VPP is usually used in combination with hardware acceleration technologies such as DPDK, Intel DPDK, FPGA, ASIC and other technologies to achieve high-speed, low-latency network data processing.

[0094] For example, Figure 4 A schematic diagram of data flow between a client and a server provided in an embodiment of the present application, such as Figure 4As shown, the VPP1 module in the client and the VPP2 module in the server have both activated the tunnel transmission plug-in, and the above-mentioned negotiation program is installed in Linux. The client includes a first virtual network card (client-tunnel) created by the tunnel plug-in in the VPP, and the server includes a second virtual network card (server-tunnel) created by the tunnel plug-in in the VPP.

[0095] The negotiation information of the tunnel message can be carried in the negotiation flow, and the message to be processed can be carried in the data flow. The transmission direction (first packet) of the negotiation flow can be from the client to the G1 (lcp) unit to the lcp-G1 unit to the G1 unit to the VPP1 output unit to the 7x-ETP protocol transmission pipeline to the VPP1 input unit to the G1 unit to the lcp-G1 unit to the G1 (lcp) to the server. The transmission direction (first packet) of the data flow can be from the client-tunnel (lcp) unit to the lcp-client-tunnel unit to the client-tunnel unit to the G1 unit to the VPP1 output unit to the 7x-ETP protocol transmission pipeline to the VPP2 input unit to the G1 unit to the server-tunnel unit to the lcp-server-tunnel unit to the server-tunnel (lcp) unit.

[0096] The G1 unit is a specific negotiation mechanism unit, the G1(lcp) unit is used to determine that the Link Control Protocol (LCP) is used for link control in G1, and the lcp-G1 unit is used to determine that the G1 specific parameters or methods are used in the LCP negotiation process. The client-tunnel unit is a first virtual network card unit, the client-tunnel(lcp) unit is used to determine that the LCP is used for link control in the first virtual network card, and the lcp-client-tunnel unit is used to determine that the first virtual network card is used in the LCP negotiation process.

[0097] It should be understood that the 7x-ETP protocol is a private transport layer protocol and can be used to replace TCP as the transport layer bearer protocol.

[0098] S202: If the message to be processed is a tunnel message, the server decapsulates the message to be processed to remove the protocol header of the message to be processed.

[0099] In this step, after receiving the message to be processed sent by the client, the server can determine whether the message to be processed is a tunnel message. If the message to be processed is a tunnel message, the server decapsulates the message to be processed to remove the protocol header of the message to be processed.

[0100] In other embodiments, if the message to be processed is not a tunnel message, the server may forward the message to be processed normally.

[0101] It should be understood that the embodiments of the present application do not limit how to decapsulate the message to be processed. In some embodiments, since different protocols have different message structures, after receiving the message to be processed, the message structure of the message to be processed can be first determined, including the length and position of each field. Subsequently, the various fields in the message header of the message to be processed can be parsed according to the message structure of the message to be processed. Finally, the data in the message header can be removed, and the payload part can be retained.

[0102] S203: The server performs a decryption operation and a redundancy removal operation on the unsealed message to be processed according to the negotiation information of the tunnel message, and determines the original message corresponding to the message to be processed.

[0103] In this step, after the server decapsulates the message to be processed to remove the protocol header of the message to be processed, it can decrypt and remove redundancy operations on the decapsulated message to be processed according to the negotiation information of the tunnel message to determine the original message corresponding to the message to be processed.

[0104] In some embodiments, the client may first perform a decryption operation on the unsealed message to be processed according to the encryption type of the tunnel message and the encryption key of the tunnel message to obtain the decrypted message to be processed. Subsequently, the client may decode the decrypted message to be processed at least once according to the type of the de-redundancy operation of the tunnel message and the configuration information of the de-redundancy operation to determine the original message corresponding to the message to be processed.

[0105] For example, Figure 5 A schematic diagram of a principle of receiving a tunnel message provided in an embodiment of the present application, such as Figure 5 As shown, if the encryption type is the AES algorithm, the encryption key of the tunnel message can be processed by the AES decryption unit accordingly to realize the decryption operation of the unsealed message to be processed. If the encryption type is the SM4 algorithm, the encryption key of the tunnel message can be processed by the AES decryption unit accordingly to realize the decryption operation of the unsealed message to be processed.

[0106] Continue to refer Figure 5 If the types of de-redundancy operations of the tunnel message include KCP and FEC, it can be determined that KCP and FEC are turned on. At this time, the decrypted message to be processed can be decoded for the first time based on the configuration information of FEC, and then the decrypted message to be processed can be decoded for the second time based on the configuration information of KCP.

[0107] If the type of de-redundancy operation of the tunnel message includes FEC, it can be determined that FEC is turned on and KCP is turned off. At this time, the decrypted message to be processed can be decoded only once based on the configuration information of FEC. If the type of de-redundancy operation of the tunnel message includes KCP, it can be determined that KCP is turned on and FEC is turned off. At this time, the decrypted message to be processed can be decoded only once based on the configuration information of KCP. If the de-redundancy operation of the tunnel message is none, it is determined that FEC and KCP are turned off, and no decoding is performed.

[0108] S204: The server forwards the original message corresponding to the message to be processed through the vector data packet processing VPP operation.

[0109] In this step, after determining the original message corresponding to the message to be processed, the server can forward the original message corresponding to the message to be processed through the vector data packet processing VPP operation.

[0110] Among them, VPP is a high-performance network data processing technology that can use the single instruction multiple data (SIMD) and vector processing capabilities of modern processors to accelerate the processing of network data packets. VPP is usually used in combination with hardware acceleration technologies such as DPDK, Intel DPDK, FPGA, ASIC and other technologies to achieve high-speed, low-latency network data processing.

[0111] It should be understood that the embodiments of the present application do not limit how to forward the original message corresponding to the message to be processed. In some embodiments, the server can forward the original message corresponding to the message to be processed back to the client that sent the message to be processed through VPP operation, or forward it to any other client.

[0112] The message processing method provided in the embodiment of the present application implements a virtual network tunnel based on a private protocol based on a VPP framework, adopts a customized negotiation and encryption method to make up for the lack of security, and implements a fast forwarding data plane based on DPDK+VPP, which greatly improves the performance of network tunnel transmission. The FEC function and KCP function reduce the tunnel packet loss rate and delay, and provide a wealth of CLI commands, which are easy for administrators to maintain and modify. In addition, the characteristics of transmission based on a private protocol ensure flexibility and scalability, and can be easily adapted to different scenarios and devices by modifying parameters.

[0113] The message processing method provided in the embodiment of the present application first receives the message to be processed sent by the client. If the message to be processed is a tunnel message, the message to be processed is decapsulated to remove the protocol header of the message to be processed. Subsequently, according to the negotiation information of the tunnel message, the decapsulated message to be processed is decrypted and de-redundant, and the original message corresponding to the message to be processed is determined. Finally, the original message corresponding to the message to be processed is forwarded through the vector data packet processing VPP operation. Since the de-redundant operation is indicated by the negotiation mechanism, the de-redundant operation can be performed after the message to be processed is decrypted, thereby reducing the tunnel packet loss rate and delay, thereby ensuring the performance of the network tunnel transmission.

[0114] The following describes how the client sends a message to be processed. Figure 6 A flow chart of another message processing method provided in an embodiment of the present application, such as Figure 6 As shown, the message processing method is applied to the client, including S301-304:

[0115] S301: The client obtains the original message.

[0116] In some embodiments, before using the VPP operation to send the to-be-processed message to the server, the client may also send negotiation indication information of the tunnel message to the server, where the negotiation indication information includes: the encryption type of the tunnel message, the encryption key of the tunnel message, the type of de-redundancy operation of the tunnel message, and the configuration information of the de-redundancy operation.

[0117] In some embodiments, the de-redundancy operation includes a forward error correction (FEC) operation and / or a fast reliable transport protocol (KCP) operation.

[0118] Among them, the FEC operation is used to detect and correct errors in the transmission process of the pending message, and the KCP operation implements fast retransmission, congestion control, out-of-order processing and window management in an unreliable network environment.

[0119] S302: The client performs encryption and redundancy removal operations on the original message according to the negotiation information of the tunnel message, and determines the processed original message.

[0120] It should be understood that the embodiments of the present application do not limit how to perform encryption and de-redundancy operations on the original message to determine the processed original message. In some embodiments, the client can first perform encryption operations on the original message according to the encryption type of the tunnel message and the encryption key of the tunnel message to obtain the encrypted original message. Subsequently, the client encodes the encrypted original message at least once according to the type of de-redundancy operation of the tunnel message and the configuration information of the de-redundancy operation to determine the processed original message.

[0121] For example, Figure 7 A schematic diagram of the principle of sending a tunnel message provided in an embodiment of the present application, such as Figure 7 As shown, if the encryption type is the AES algorithm, the encryption key of the tunnel message can be processed by the AES encryption unit accordingly to implement the encryption operation of the original message. If the encryption type is the SM4 algorithm, the encryption key of the tunnel message can be processed by the AES decryption unit accordingly to implement the encryption operation of the unsealed message to be processed.

[0122] Continue to refer Figure 7 If the types of de-redundancy operations of the tunnel message include KCP and FEC, it can be determined that KCP and FEC are turned on. At this time, the encrypted original message can be encoded for the first time based on the configuration information of FEC, and then the encrypted original message can be encoded for the second time based on the configuration information of KCP.

[0123] If the type of de-redundancy operation of the tunnel message includes FEC, it can be determined that FEC is turned on and KCP is turned off. At this time, the encrypted original message can be encoded only once based on the configuration information of FEC. If the type of de-redundancy operation of the tunnel message includes KCP, it can be determined that KCP is turned on and FEC is turned off. At this time, the encrypted original message can be encoded only once based on the configuration information of KCP. If the de-redundancy operation of the tunnel message is none, it is determined that FEC and KCP are turned off, and no encoding is performed.

[0124] S303: The client encapsulates the processed original message and adds a protocol header corresponding to the tunnel message to generate a message to be processed.

[0125] S304: The client uses the VPP operation to send the message to be processed to the server.

[0126] Figure 8 A signaling interaction diagram of a message processing method provided in an embodiment of the present application, such as Figure 8 As shown, the message processing method includes S401-S408:

[0127] S401. The client sends negotiation indication information of a tunnel message to the server, where the negotiation indication information includes: encryption type of the tunnel message, encryption key of the tunnel message, type of de-redundancy operation of the tunnel message, and configuration information of the de-redundancy operation.

[0128] S402: The client obtains the original message.

[0129] S403: The client performs encryption and redundancy removal operations on the original message according to the negotiation information of the tunnel message, and determines the processed original message.

[0130] S404: The client encapsulates the processed original message and adds a protocol header corresponding to the tunnel message to generate a message to be processed.

[0131] S405: The client uses the VPP operation to send the message to be processed to the server.

[0132] S406: If the message to be processed is a tunnel message, the server decapsulates the message to be processed to remove the protocol header of the message to be processed.

[0133] S407: The server performs a decryption operation and a redundancy removal operation on the unsealed message to be processed according to the negotiation information of the tunnel message, and determines the original message corresponding to the message to be processed.

[0134] S408: The server forwards the original message corresponding to the message to be processed through the vector data packet processing VPP operation.

[0135] The message processing method provided in the embodiment of the present application first receives the message to be processed sent by the client. If the message to be processed is a tunnel message, the message to be processed is decapsulated to remove the protocol header of the message to be processed. Subsequently, according to the negotiation information of the tunnel message, the decapsulated message to be processed is decrypted and de-redundant, and the original message corresponding to the message to be processed is determined. Finally, the original message corresponding to the message to be processed is forwarded through the vector data packet processing VPP operation. Since the de-redundant operation is indicated by the negotiation mechanism, the de-redundant operation can be performed after the message to be processed is decrypted, thereby reducing the tunnel packet loss rate and delay, thereby ensuring the performance of the network tunnel transmission.

[0136] Based on the same inventive concept, the embodiment of the present application also provides a message processing device for implementing the message processing method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more message processing device embodiments provided below can refer to the limitations on the message processing method above, and will not be repeated here.

[0137] In an exemplary embodiment, Fig. 9 As shown, a message processing device 500 is provided, which is applied to a server. The message processing device 500 includes: a receiving module 501, a first processing module 502 and a first sending module 503, wherein:

[0138] The receiving module 501 is used to receive a message to be processed sent by a client.

[0139] The first processing module 502 is used to decapsulate the message to be processed if it is a tunnel message to remove the protocol header of the message to be processed; decrypt and remove redundancy operations on the decapsulated message to be processed according to the negotiation information of the tunnel message to determine the original message corresponding to the message to be processed.

[0140] The first sending module 503 is used to forward the original message corresponding to the message to be processed through a vector packet processing (VPP) operation.

[0141] In one of the embodiments, the receiving module 501 is also used to receive negotiation indication information of the tunnel message sent by the client, and the negotiation indication information includes: encryption type of the tunnel message, encryption key of the tunnel message, type of de-redundancy operation of the tunnel message, and configuration information of the de-redundancy operation.

[0142] In one embodiment, the redundancy removal operation includes a forward error correction FEC operation and / or a fast reliable transport protocol KCP operation;

[0143] Among them, the FEC operation is used to detect and correct errors in the transmission process of the pending message, and the KCP operation implements fast retransmission, congestion control, out-of-order processing and window management in an unreliable network environment.

[0144] In one of the embodiments, the first processing module 502 is also used to perform a decryption operation on the unsealed message to be processed according to the encryption type of the tunnel message and the encryption key of the tunnel message to obtain the decrypted message to be processed; and decode the decrypted message to be processed at least once according to the type of de-redundancy operation of the tunnel message and the configuration information of the de-redundancy operation to determine the original message corresponding to the message to be processed.

[0145] In an exemplary embodiment, Fig.10 As shown, a message processing device 600 is provided, which is applied to a client. The message processing device 600 includes: a second processing module 601 and a second sending module 602, wherein:

[0146] The second processing module 601 is used to obtain the original message; perform encryption and de-redundancy operations on the original message according to the negotiation information of the tunnel message to determine the processed original message; encapsulate the processed original message and add the protocol header corresponding to the tunnel message to generate a message to be processed.

[0147] The second sending module 602 is used to send the message to be processed to the server by using the VPP operation.

[0148] In one embodiment, the second sending module 602 is also used to send negotiation indication information of the tunnel message to the server, and the negotiation indication information includes: encryption type of the tunnel message, encryption key of the tunnel message, type of de-redundancy operation of the tunnel message, and configuration information of the de-redundancy operation.

[0149] In one embodiment, the redundancy removal operation includes a forward error correction FEC operation and / or a fast reliable transport protocol KCP operation;

[0150] Among them, the FEC operation is used to detect and correct errors in the transmission process of the pending message, and the KCP operation implements fast retransmission, congestion control, out-of-order processing and window management in an unreliable network environment.

[0151] In one of the embodiments, the second processing module 601 is also used to perform an encryption operation on the original message according to the encryption type of the tunnel message and the encryption key of the tunnel message to obtain the encrypted original message; according to the type of de-redundancy operation of the tunnel message and the configuration information of the de-redundancy operation, the encrypted original message is encoded at least once to determine the processed original message.

[0152] The above modules may be embedded in or independent of a processor in a computer device in the form of hardware, or may be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to the above modules.

[0153] In an exemplary embodiment, a computer device is provided. The computer device may be a server. The internal structure diagram thereof may be as shown in FIG. Fig.11 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a message processing method on the server side is implemented.

[0154] In an exemplary embodiment, a computer device is provided. The computer device may be a client, and its internal structure diagram may be as follows: Fig.12As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a message processing method on the client side is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0155] Those skilled in the art will understand that Fig.11 and 12 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0156] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the above-mentioned message processing method when executing the computer program.

[0157] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned message processing method is implemented.

[0158] In one embodiment, a computer program product is provided, including a computer program, which implements the above-mentioned message processing method when executed by a processor.

[0159] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0160] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0161] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A message processing method, characterized in that: Applied to the server, the method includes: Receive the pending message sent by the client; If the message to be processed is a tunnel message, decapsulate the message to be processed to remove the protocol header of the message to be processed; According to the negotiation information of the tunnel message, decryption operation and redundancy removal operation are performed on the unsealed message to be processed to determine the original message corresponding to the message to be processed; The original message corresponding to the message to be processed is forwarded through a vector packet processing (VPP) operation.

2. The method according to claim 1, characterized in that Before receiving the message to be processed sent by the client, the method further includes: Receive negotiation indication information of the tunnel message sent by the client, wherein the negotiation indication information includes: an encryption type of the tunnel message, an encryption key of the tunnel message, a type of de-redundancy operation of the tunnel message, and configuration information of the de-redundancy operation.

3. The method according to claim 2, characterized in that The de-redundancy operation includes a forward error correction FEC operation and / or a fast reliable transport protocol KCP operation; The FEC operation is used to detect and correct errors in the transmission process of the message to be processed, and the KCP operation implements fast retransmission, congestion control, out-of-order processing and window management in an unreliable network environment.

4. The method according to claim 2 or 3, characterized in that: The step of performing a decryption operation and a redundancy removal operation on the unsealed message to be processed according to the negotiation information of the tunnel message, and determining an original message corresponding to the message to be processed, comprises: According to the encryption type of the tunnel message and the encryption key of the tunnel message, a decryption operation is performed on the unsealed message to be processed to obtain a decrypted message to be processed; According to the type of the de-redundancy operation of the tunnel message and the configuration information of the de-redundancy operation, the decrypted message to be processed is decoded at least once to determine the original message corresponding to the message to be processed.

5. A message processing method, characterized in that: Applied to a client, the method comprises: Get the original message; Perform encryption and redundancy removal operations on the original message according to the negotiation information of the tunnel message to determine the original message after processing; Encapsulating the processed original message and adding a protocol header corresponding to the tunnel message to generate a message to be processed; Use the VPP operation to send the message to be processed to the server.

6. The method according to claim 5, characterized in that Before using the VPP operation to send the to-be-processed message to the server, the method further includes: The negotiation indication information of the tunnel message sent to the server includes: the encryption type of the tunnel message, the encryption key of the tunnel message, the type of de-redundancy operation of the tunnel message, and the configuration information of the de-redundancy operation.

7. The method according to claim 6, characterized in that The de-redundancy operation includes a forward error correction FEC operation and / or a fast reliable transport protocol KCP operation; The FEC operation is used to detect and correct errors in the transmission process of the message to be processed, and the KCP operation implements fast retransmission, congestion control, out-of-order processing and window management in an unreliable network environment.

8. The method according to claim 6 or 7, characterized in that: The step of performing encryption and de-redundancy operations on the original message according to the negotiation information of the tunnel message to determine the processed original message includes: Performing an encryption operation on the original message according to the encryption type of the tunnel message and the encryption key of the tunnel message to obtain an encrypted original message; According to the type of the de-redundancy operation of the tunnel message and the configuration information of the de-redundancy operation, the encrypted original message is encoded at least once to determine the processed original message.

9. A message processing device, characterized in that: Applied to the server, the device comprises: A receiving module, used for receiving a message to be processed sent by a client; The first processing module is used to decapsulate the message to be processed to remove the protocol header of the message to be processed if the message to be processed is a tunnel message; perform a decryption operation and a de-redundancy operation on the decapsulated message to be processed according to the negotiation information of the tunnel message, and determine the original message corresponding to the message to be processed; The first sending module is used to forward the original message corresponding to the message to be processed through a vector data packet processing (VPP) operation.

10. A message processing device, characterized in that: Applied to a client, the device comprises: The second processing module is used to obtain the original message; perform encryption and de-redundancy operations on the original message according to the negotiation information of the tunnel message to determine the processed original message; encapsulate the processed original message and add the protocol header corresponding to the tunnel message to generate a message to be processed; The second sending module is used to use the VPP operation to send the message to be processed to the server.

Images