A method and system for realizing data flow acceleration based on a NAT acceleration engine

Abstract

The present invention relates to the technical field of data stream acceleration, and discloses a method and system for realizing data stream acceleration based on a NAT acceleration engine. The method includes: deploying a VPN module in a network environment, and establishing a VPN transmission tunnel of the VPN module based on a preset VPN protocol. Obtaining a target data stream to encapsulate data packets, and encrypting the encapsulated data packets. Monitoring network traffic, obtaining the encrypted data packets, and parsing to obtain the header information of the data packets. According to the header information, determining whether the data packets are in an encrypted state, wherein if the data packets are in an encrypted state, special identification is performed. Obtaining a preset routing table, and determining the next hop of the identified data packets according to the preset routing table. Obtaining the real-time performance data of the network link when forwarding data packets, and adjusting the processing strategy of the data stream according to the real-time performance data. The present invention realizes the optimization of network performance by monitoring and parsing encrypted data packets in real time and dynamically adjusting the data stream processing strategy.

Description

Technical Field

[0001] The present invention relates to the technical field of data stream acceleration. Specifically, it relates to a method and system for realizing data stream acceleration based on a NAT acceleration engine. Background Art

[0002] With the continuous growth of network communication requirements, the security and efficiency of data transmission have become one of the key goals in the development of network technologies. As a mature encrypted communication method, VPN (Virtual Private Network) technology creates an encrypted private channel over an insecure public network to achieve secure data transmission. However, with the wide application of VPNs, especially in network communication products with built-in VPN functions, such as devices supporting protocols like OpenVPN and WireGuard, the problem of the forwarding performance of encrypted and encapsulated data packets has become increasingly prominent.

[0003] Existing VPN systems usually use standard Network Address Translation (NAT) technology to forward data packets. However, when a data packet is encrypted and encapsulated by the VPN module, its data content and some header information have been encrypted, making it impossible for traditional software NAT acceleration engines to directly perform NAT conversion on such encrypted data packets. As a result, such data packets must enter the system's protocol stack for slow processing paths, relying on the system's traditional forwarding mechanism to decrypt and process the encapsulated packets, which greatly affects the real-time forwarding performance of data packets, leading to an increase in transmission latency and packet loss rate, and a decline in the overall user experience.

[0004] Therefore, there is an urgent need to invent a method for data stream acceleration to solve the problem of efficiently forwarding data streams in a VPN encryption environment in the prior art. Summary of the Invention

[0005] In view of this, the present invention proposes a method and system for realizing data stream acceleration based on a NAT acceleration engine, aiming to solve the problem of efficiently forwarding data streams in a VPN encryption environment in the current technology.

[0006] The present invention proposes a method for realizing data stream acceleration based on a NAT acceleration engine, including:

[0007] Deploy a VPN module in a network environment and establish a VPN transmission tunnel for the VPN module based on a preset VPN protocol;

[0008] Obtain a target data stream for encapsulating data packets, and encrypt the encapsulated data packets through the VPN transmission tunnel;

[0009] Monitor the network traffic of the target network, obtain the encrypted data packets, and parse the data packets to obtain the header information of the data packets. Among them, the header information includes VPN header information and unencrypted network layer and outer protocol headers;

[0010] Determine whether the data packet is in an encrypted state according to the header information. If the data packet is in an encrypted state, special identification is performed on the data packet;

[0011] Obtain a preset routing table, and determine the next hop of the identified data packet according to the preset routing table;

[0012] Obtain the real-time performance data of the network link when forwarding the data packet, and adjust the processing strategy of the data stream according to the real-time performance data. Among them, the real-time performance data includes the delay, bandwidth, and packet loss rate when the data packet is transmitted.

[0013] Further, when parsing the data packet to obtain the header information of the data packet, it includes:

[0014] Based on a data packet capture tool, monitor the data stream in real time, and parse each data packet in the data stream layer by layer to identify the source IP address, destination IP address, protocol type, and port number of the data packet;

[0015] Perform deep packet inspection on the parsed data packet, and obtain the encryption protocol type, encryption algorithm, and key exchange method of the data packet.

[0016] Further, when obtaining the real-time performance data of the network link when forwarding the data packet and adjusting the processing strategy of the data stream according to the real-time performance data, it includes:

[0017] Obtain the real-time delay, real-time bandwidth, and real-time packet loss rate of the network link, and compare the real-time delay, real-time bandwidth, and real-time packet loss rate with the pre-configured preset delay, preset bandwidth, and preset packet loss rate. According to the comparison result, determine whether to adjust the processing strategy of the data stream:

[0018] When the real-time delay is less than or equal to the preset delay, the real-time bandwidth is greater than or equal to the preset bandwidth, and the real-time packet loss rate is less than or equal to the preset packet loss rate, it is determined that the processing strategy of the data stream is not adjusted;

[0019] When the real-time delay is greater than the preset delay, and / or the real-time bandwidth is less than the preset bandwidth, and / or the real-time packet loss rate is greater than the preset packet loss rate, it is determined that the processing strategy of the data stream is adjusted;

[0020] Among them, when determining to adjust the processing strategy of the data flow, it includes: obtaining the real-time delay, real-time bandwidth and real-time packet loss rate of the transmission link in each of the processing strategies, evaluating each of the transmission links according to the relationship between the real-time delay, real-time bandwidth and real-time packet loss rate and the preset delay, preset bandwidth and preset packet loss rate, and sorting the evaluation results in reverse order, and adjusting the processing strategy corresponding to the first evaluation result as the processing strategy of the data flow.

[0021] Furthermore, when evaluating each of the transmission links based on the relationship between the real-time delay, the real-time bandwidth, and the real-time packet loss rate and the preset delay, the preset bandwidth, and the preset packet loss rate, the evaluation includes:

[0022] Obtaining the real-time delay of each of the transmission links, obtaining a delay mean of the real-time delays of each of the transmission links, and determining the preset delay based on the delay mean;

[0023] Obtaining a delay difference between the real-time delay of the transmission link and the preset delay, and determining a performance score of the transmission link when evaluating the transmission link based on a relationship between the delay difference and a pre-configured first preset delay difference and a second preset delay difference;

[0024] When the delay difference is less than the first preset delay difference, determining that the performance score of the transmission link is L3;

[0025] When the delay difference is greater than or equal to the first preset delay difference and the delay difference is less than the second preset delay difference, determining that the performance score of the transmission link is L2;

[0026] When the delay difference is greater than or equal to the second preset delay difference, determining that the performance score of the transmission link is L1;

[0027] The first preset delay difference is smaller than the second preset delay difference, and L1<L2<L3.

[0028] Furthermore, when the performance score of the transmission link is determined to be Li, i=1, 2, 3, including:

[0029] Acquire the real-time bandwidth of each transmission link, acquire the bandwidth average of the real-time bandwidth of each transmission link, and determine the preset bandwidth by using the bandwidth average;

[0030] Comparing the real-time bandwidth of the transmission link with the preset bandwidth, and determining whether to adjust the performance score Li of the transmission link according to the comparison result;

[0031] When the real-time bandwidth is greater than or equal to the preset bandwidth, it is determined that the performance score Li of the transmission link is not adjusted;

[0032] When the real-time bandwidth is less than the preset bandwidth, the bandwidth difference between the real-time bandwidth and the preset bandwidth is obtained, and according to the bandwidth difference, an adjustment coefficient is determined, and the performance score Li of the transmission link is adjusted according to the adjustment coefficient.

[0033] Further, when determining the adjustment coefficient according to the bandwidth difference, it includes:

[0034] Determine the adjustment coefficient according to the relationship between the bandwidth difference and the pre-configured first preset bandwidth difference and second preset bandwidth difference;

[0035] When the bandwidth difference is less than the first preset bandwidth difference, it is determined that the adjustment coefficient is M3;

[0036] When the bandwidth difference is greater than or equal to the first preset bandwidth difference and less than the second preset bandwidth difference, it is determined that the adjustment coefficient is M2;

[0037] When the bandwidth difference is greater than or equal to the second preset bandwidth difference, it is determined that the adjustment coefficient is M1;

[0038] Wherein, the first preset bandwidth difference is less than the second preset bandwidth difference, and M1 < M2 < M3.

[0039] Further, when it is determined that the adjustment coefficient is Mi, i = 1, 2, 3, it includes:

[0040] Obtain the real-time packet loss rate of each transmission link, obtain the average packet loss rate of the real-time packet loss rate of each transmission link, and determine the preset packet loss rate with the average packet loss rate;

[0041] Compare the real-time packet loss rate with the preset packet loss rate, and determine whether to correct the adjustment coefficient Mi according to the comparison result;

[0042] When the real-time packet loss rate is less than or equal to the preset packet loss rate, it is determined that the adjustment coefficient Mi is not corrected;

[0043] When the real-time packet loss rate is greater than the preset packet loss rate, obtain the packet loss rate difference between the real-time packet loss rate and the preset packet loss rate, determine a correction coefficient according to the packet loss rate difference, and correct the adjustment coefficient Mi according to the correction coefficient.

[0044] Further, when determining the correction coefficient according to the packet loss rate difference, it includes:

[0045] Determine the correction coefficient according to the relationship between the packet loss rate difference and the pre-configured first preset packet loss rate difference and second preset packet loss rate difference;

[0046] When the packet loss rate difference is less than the first preset packet loss rate difference, determine that the correction coefficient is N3;

[0047] When the packet loss rate difference is greater than or equal to the first preset packet loss rate difference and less than the second preset packet loss rate difference, determine that the correction coefficient is N2;

[0048] When the packet loss rate difference is greater than or equal to the second preset packet loss rate difference, determine that the correction coefficient is N3;

[0049] Wherein, the first preset packet loss rate difference is less than the second preset packet loss rate difference, and N1 < N2 < N3 < 1.

[0050] Further, when sorting the evaluation results in reverse order and adjusting the processing strategy corresponding to the first evaluation result to the processing strategy of the data stream, it includes:

[0051] Obtain the performance scores of each of the evaluation results, and obtain the average value of the performance scores of each of the evaluation results;

[0052] Compare according to the performance score and the average value of the performance scores, and determine the sorting of the performance scores according to the comparison result:

[0053] When the performance score is lower than the average value of the performance scores, determine that the performance score is not sorted;

[0054] When the performance evaluation is higher than or equal to the average value of the performance scores, determine that the performance score is sorted.

[0055] Compared with the prior art, the beneficial effects of the present invention are as follows: By deploying a VPN module in a network environment and establishing a transmission tunnel based on a preset VPN protocol, encapsulation and encryption processing of data streams can be achieved. This tunnel mechanism ensures the security of data streams, but at the same time brings problems that are difficult to handle by traditional NAT. Because the data packets after encryption and encapsulation have been encrypted in terms of header information and data content, the traditional software NAT acceleration engine cannot directly process such data packets and needs to take a slow protocol stack path for parsing and forwarding, resulting in increased latency and decreased performance. Secondly, by monitoring network traffic to obtain the encrypted data packets and parsing the header information of the data packets, including the VPN header and the unencrypted network layer and transport layer protocol header information, the data packets in the encrypted and encapsulated state can be accurately identified. This step uses the specific encapsulation format of the VPN protocol. By parsing the VPN header information and the network layer header, it can be determined whether the data packet is in an encrypted state. Once it is confirmed that the data packet has been encrypted and encapsulated by the VPN, the data packet will be specially marked, so as to facilitate quickly distinguishing encrypted data packets from ordinary data packets during subsequent processing, achieving precise classification management of data streams and avoiding unnecessary protocol stack path processing. Finally, this method quickly determines the next-hop forwarding path of the data packet by looking up a preset routing table, so that the marked encrypted data packet can directly enter the optimized forwarding path instead of the traditional slow processing path. During the forwarding process, by real-time monitoring the performance data of the network link, such as the latency, bandwidth, and packet loss rate of data packet transmission, the processing strategy of the data stream is automatically adjusted according to the monitoring results. This dynamic adjustment strategy further improves the adaptability of the system, enabling the NAT acceleration engine to maintain high transmission performance in the face of different network conditions. This not only improves the transmission speed of VPN data streams but also significantly optimizes the resource utilization rate, providing users with a network transmission experience with lower latency, higher bandwidth, and lower packet loss rate.

[0056] On the other hand, the present application also provides a system for accelerating data streams based on a NAT acceleration engine, including:

[0057] A VPN module deployed in a network environment, the VPN module is configured to establish a VPN transmission tunnel based on a preset VPN protocol, and the VPN module is further configured to obtain a target data stream for encapsulating data packets and encrypt the encapsulated data packets based on the VPN transmission tunnel;

[0058] An analysis module configured to monitor the network traffic of a target network, obtain the encrypted data packets, and analyze the data packets to obtain the header information of the data packets;

[0059] A NAT acceleration module configured with a plurality of transmission links;

[0060] An identification module, electrically connected to the parsing module, configured to determine whether the data packet is in an encrypted state according to the header information, wherein if the data packet is in an encrypted state, the identification module specially identifies the data packet;

[0061] A central control module, electrically connected to the identification module, configured to obtain a preset routing table and determine the next hop of the identified data packet according to the preset routing table; the central control module is further configured to obtain real-time performance data of the network link when forwarding the data packet and adjust the processing strategy of the data stream according to the real-time performance data.

[0062] It can be understood that the above-mentioned embodiments of the present invention for a method and system for accelerating data streams based on a NAT acceleration engine have the same beneficial effects and will not be elaborated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] By reading the following detailed description of the preferred embodiments, various other advantages and benefits will become clear to those of ordinary skill in the art. The drawings are only for the purpose of showing the preferred embodiments and are not to be considered as limiting the present invention. Moreover, throughout the drawings, the same reference numerals are used to represent the same components. In the drawings:

[0064] Figure 1 It is a flowchart of a method for accelerating data streams based on a NAT acceleration engine provided by an embodiment of the present invention;

[0065] Figure 2 It is a functional block diagram of a system for accelerating data streams based on a NAT acceleration engine provided by an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0066] Hereinafter, exemplary embodiments of the present disclosure will be described in more detail with reference to the drawings. Although the exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided so that the present disclosure can be more thoroughly understood and the scope of the present disclosure can be fully conveyed to those skilled in the art. It should be noted that, without conflict, the embodiments in the present invention and the features in the embodiments can be combined with each other. Hereinafter, the present invention will be described in detail with reference to the drawings and in combination with the embodiments.

[0067] As Figure 1 shown, in some embodiments of the present application, this embodiment provides a method including:

[0068] Step S100: Deploy a VPN module in a network environment and establish a VPN transmission tunnel for the VPN module based on a preset VPN protocol.

[0069] Specifically, select a suitable VPN protocol (such as OpenVPN or WireGuard), which provide efficient encryption mechanisms and flexible configuration options to adapt to different network environments and requirements. By deploying the VPN module, users can establish a private encrypted channel on an insecure public network, thus protecting sensitive information from unauthorized access.

[0070] It can be understood that by choosing a suitable VPN protocol (such as OpenVPN or WireGuard), users can utilize the efficient encryption mechanisms provided by these protocols to ensure the security of data transmission in various network environments. Specifically, these protocols encrypt the data, making it difficult to be eavesdropped or tampered with during transmission, thus greatly enhancing the confidentiality and integrity of the data. For example, OpenVPN, as a widely used open-source VPN protocol, uses SSL / TLS for secure encryption, supports multiple encryption algorithms and authentication methods, and has a high degree of flexibility and configurability. This enables users to choose different encryption strengths and transmission protocols according to their own needs to cope with different network environments. In contrast, WireGuard is favored for its simple design and efficient performance, providing faster connection speeds and lower latency. The effective combination of these protocols enables the VPN module to provide users with multiple security protection options to adapt to changing network threats. Secondly, by deploying the VPN module, users can establish a private encrypted channel when using public Wi-Fi or an insecure network. This encrypted channel not only protects users' sensitive information, such as login credentials, financial transactions, and personal data, from being stolen by hackers or malware, but also effectively prevents man-in-the-middle attacks and other network security threats. Especially in the context of the increasing popularity of remote work and online transactions, the use of VPN has become an important means to ensure data security. In addition, the flexible configuration options of the VPN module enable it to adapt to various network environments. For example, in the case of high latency or limited bandwidth, users can choose a more suitable protocol and encryption method to optimize performance and the user experience. This adaptability not only enhances network security but also enables users to access network resources with confidence from any location and on any device.

[0071] Step S200: Obtain the target data stream to encapsulate data packets, and encrypt the encapsulated data packets through the VPN transmission tunnel.

[0072] It is understandable that by identifying the data streams that need to be encrypted, this may include network requests, file transfers, or real-time communication data from different applications. After obtaining these target data streams, the system will encapsulate them, which usually involves reorganizing the source IP address, target IP address, port information, and other relevant metadata of the original data packets. This encapsulation process not only ensures the integrity of the data during transmission but also hides the information of the original data stream, making it more secure during transmission. Qi Cong. The encapsulated data packets will be encrypted through the established VPN transmission tunnel. This process uses a preset VPN protocol to encrypt the data, ensuring that the data is in a secure state when transmitted over the network. The encryption process involves converting the data content into ciphertext so that it cannot be eavesdropped on or tampered with during transmission. This encryption mechanism also includes generating encryption keys and using encryption algorithms (such as AES, ChaCha20, etc.) to ensure the confidentiality and integrity of the data.

[0073] Step S300, monitor the network traffic of the target network, obtain the encrypted data packets, and parse the data packets to obtain the header information of the data packets, where the header information includes VPN header information and unencrypted network layer and outer protocol headers.

[0074] Specifically, when parsing the data packets to obtain the header information of the data packets, it includes: real-time monitoring of the data stream based on a data packet capture tool, and layer-by-layer parsing of each data packet in the data stream to identify the source IP address, target IP address, protocol type, and port number of the data packet. Perform deep packet inspection on the parsed data packets, and obtain the encryption protocol type, encryption algorithm, and key exchange method of the data packets.

[0075] It is understandable that by continuously monitoring the traffic of the target network, encrypted packets after VPN encryption processing can be obtained in real time. This process provides a necessary basis for subsequent data analysis, enabling network administrators or applications to obtain key information about the data stream without compromising data security. Secondly, during the process of parsing the packets, the packet structure is analyzed layer by layer, starting from the outermost protocol header, and basic network information such as source IP address, destination IP address, protocol type, and port number is extracted. This information not only helps to understand the source and destination of the data stream but also provides basic data for the management and optimization of network traffic. On this basis, deep packet inspection is further carried out to identify the encrypted protocol type, encryption algorithm, and key exchange method in the packets. This parsing process is crucial for understanding the encryption mechanism of the packets, and thus can identify the security standards and technologies used, ensuring the confidentiality and integrity of data during transmission. In addition, this deep parsing technology is not only applicable to monitoring the security of the data stream but can also provide decision-making support for network optimization. By analyzing the encryption characteristics of different packets, the system can identify potential bottlenecks and problems in the network. For example, if certain encryption algorithms cause increased latency or low bandwidth utilization, network administrators or programs can adjust the strategy accordingly and select a more efficient encryption method or optimize the packet processing flow. This adaptive ability not only improves network performance but also enhances flexibility and response capabilities in the face of a constantly changing network environment. Step S400: Determine whether the packet is in an encrypted state according to the header information. If the packet is in an encrypted state, the packet is specially marked.

[0076] Step S400: Determine whether the packet is in an encrypted state according to the header information. If the packet is in an encrypted state, the packet is specially marked.

[0077] Specifically, for different types of VPN traffic, multiple unique marking values are designed to support multiple encryption protocols (such as OpenVPN, WireGuard, etc.), and the marking is dynamically assigned according to the traffic characteristics. Secondly, for multi-tenant traffic transmitted through the VPN tunnel, unique marks can be assigned to each tenant according to the tenant's identity to ensure the independent management and acceleration of each tenant's traffic. Finally, when marking the packets, the timestamp of the mark assignment and the processing log are recorded for subsequent tracking and performance analysis of the traffic.

[0078] It is understandable that by parsing the header information of data packets, their encryption status can be identified. This process not only involves determining whether a data packet is encrypted, but also requires in-depth analysis of its characteristics to ensure accurate differentiation of different types of VPN traffic. Through meticulous inspection of data packets, it is possible to efficiently identify which data packets are encrypted, enabling subsequent processing and management. Secondly, to support multiple encryption protocols (such as OpenVPN, WireGuard, etc.), multiple unique marker values are designed. These marker values not only functionally distinguish different types of VPN traffic, but also have a high degree of flexibility in structure, enabling dynamic allocation of markers based on actual traffic characteristics. This dynamic allocation mechanism not only improves the efficiency of data packet processing, but also provides strong support for subsequent traffic management. For example, when a specific traffic pattern is identified, a specific marker can be automatically assigned to ensure rapid identification and processing of encrypted data. In addition, in a multi-tenant environment, unique markers can be assigned according to the identity of each tenant to ensure independent management and acceleration of each tenant's traffic. This method effectively solves the problem of traffic confusion that may occur in a shared environment, ensuring that the data traffic of each tenant can be clearly identified and independently processed. This feature is particularly applicable to cloud computing and shared network services, providing customized security protection and performance optimization for each user. Finally, when marking data packets, the timestamp of marker allocation and processing logs are recorded. This not only facilitates subsequent traffic tracking and performance analysis, but also provides an important basis for problem diagnosis and system optimization. By analyzing historical records, network administrators or programs can gain in-depth understanding of the impact of different traffic patterns on network performance, thereby formulating more effective traffic management strategies. The application of this technical principle significantly improves the visualization and management capabilities of the network, enabling users to enjoy higher security and performance in a complex VPN environment.

[0079] Step S500 obtains a preset routing table and determines the next hop of the identified data packet according to the preset routing table.

[0080] Step S60, obtain the real-time performance data of the network link when forwarding data packets, and adjust the processing strategy of the data stream according to the real-time performance data, where the real-time performance data includes the delay, bandwidth, and packet loss rate when the data packet is transmitted.

[0081] Specifically, when obtaining the real-time performance data of the network link for the forwarded data packet and adjusting the processing strategy of the data stream according to the real-time performance data, it includes: obtaining the real-time delay, real-time bandwidth, and real-time packet loss rate of the network link, comparing the real-time delay, real-time bandwidth, and real-time packet loss rate with the pre-configured preset delay, preset bandwidth, and preset packet loss rate, and judging whether to adjust the processing strategy of the data stream according to the comparison result: when the real-time delay is less than or equal to the preset delay, the real-time bandwidth is greater than or equal to the preset bandwidth, and the real-time packet loss rate is less than or equal to the preset packet loss rate, it is determined not to adjust the processing strategy of the data stream. When the real-time delay is greater than the preset delay, and / or the real-time bandwidth is less than the preset bandwidth, and / or the real-time packet loss rate is greater than the preset packet loss rate, it is determined to adjust the processing strategy of the data stream. Among them, when it is determined to adjust the processing strategy of the data stream, it includes: obtaining the real-time delay, real-time bandwidth, and real-time packet loss rate of the transmission link in each processing strategy, evaluating each transmission link according to the relationship between the real-time delay, real-time bandwidth, and real-time packet loss rate and the preset delay, preset bandwidth, and preset packet loss rate, sorting the evaluation results in reverse order, and adjusting the processing strategy corresponding to the first evaluation result to the processing strategy of the data stream.

[0082] It can be seen that by real-time monitoring the performance data of the network link (including delay, bandwidth, and packet loss rate) and comparing these real-time data with the preset performance metrics, the processing strategy of the data stream is dynamically adjusted. Specifically, the system obtains the performance data of the network link in real time, determines whether the current network state meets the preset conditions, and then decides whether to adjust the processing strategy. When the monitored real-time delay, bandwidth, or packet loss rate exceeds the preset range, the transmission link performance of different processing strategies will be evaluated, and each transmission link will be sorted according to the relationship between the real-time data and the preset value. Finally, the link with the best performance will be selected as the new processing strategy for the data stream.

[0083] It is understandable that by collecting real-time performance data of network links, these data include real-time latency, bandwidth, and packet loss rate. These metrics are key parameters for evaluating network performance and can reflect the current state and transmission efficiency of the network. Real-time latency refers to the time required for a data packet to be transmitted in the network, while real-time bandwidth represents the amount of data that the network can handle. The real-time packet loss rate refers to the proportion of data packets lost during transmission. The validity of these data directly affects the user experience and the overall performance during data acceleration. Secondly, by comparing the real-time performance data with preset performance metrics, it is possible to quickly determine whether the current network state meets the preset conditions. This process not only includes determining whether the real-time latency is less than or equal to the preset value, whether the real-time bandwidth is greater than or equal to the preset value, and whether the real-time packet loss rate is less than or equal to the preset value, but also requires comprehensive consideration of the comprehensive evaluation of these metrics. When any one of the performance metrics does not meet the preset conditions, it will be determined that it is necessary to adjust the processing strategy of the data stream. This method ensures that network management can respond in real time, thereby reducing latency and data loss and improving the efficiency of network transmission. In addition, once it is determined that the processing strategy needs to be adjusted, the real-time performance data of the transmission links in each processing strategy will be obtained and evaluated. This evaluation process not only considers a single latency or bandwidth, but comprehensively considers the performance of each processing strategy in order to select the best processing strategy. The system will sort the evaluation results of all strategies in reverse order, so as to quickly identify the best-performing strategy and adjust it as the new data stream processing strategy. This dynamic decision-making mechanism can quickly adapt when the network conditions change, maintaining the high efficiency and stability of data transmission. Finally, through real-time monitoring and flexible adjustment of the processing strategy, the system can intelligently allocate bandwidth and resources according to the actual traffic demand and network conditions, reducing the risk of network congestion. At the same time, this dynamic adjustment ability also provides higher flexibility for network management, enabling users to enjoy a better network experience in different application scenarios.

[0084] Specifically, when sorting the evaluation results in reverse order and adjusting the processing strategy corresponding to the first evaluation result as the processing strategy of the data stream, it includes: obtaining the performance scores of each evaluation result and obtaining the average performance score of each evaluation result. Compare according to the performance score and the average performance score, and determine the sorting of the performance score according to the comparison result: when the performance score is lower than the average performance score, it is determined that the performance score is not sorted. When the performance evaluation is higher than or equal to the average performance score, it is determined that the performance score is sorted.

[0085] It is understandable that by calculating the performance scores of each evaluation result and finding the mean of these scores. This mean serves as a performance benchmark, allowing for a relative evaluation of the performance of the link. When a performance score is higher than the mean, it indicates that the link performs well, and it is sorted so that those links with better performance are given priority. If the performance score is lower than the mean, it indicates that there may be a problem with the link, so it is not sorted. Through this sorting mechanism based on performance scores and the mean, excellent-performing links can be quickly identified and given priority for processing, thereby achieving efficient management and optimization of the data stream and ensuring that network resources are utilized optimally.

[0086] Specifically, when evaluating each transmission link according to the relationship between the real-time delay, real-time bandwidth, and real-time packet loss rate and the preset delay, preset bandwidth, and preset packet loss rate, it includes: obtaining the real-time delay of each transmission link, obtaining the mean delay of the real-time delays of each transmission link, and determining the preset delay with the mean delay. Obtaining the delay difference between the real-time delay of the transmission link and the preset delay, and determining the performance score of the transmission link during evaluation according to the relationship between the delay difference and the pre-configured first preset delay difference and second preset delay difference. When the delay difference is less than the first preset delay difference, the performance score of the transmission link is determined to be L3. When the delay difference is greater than or equal to the first preset delay difference and less than the second preset delay difference, the performance score of the transmission link is determined to be L2. When the delay difference is greater than or equal to the second preset delay difference, the performance score of the transmission link is determined to be L1. Among them, the first preset delay difference is less than the second preset delay difference, and L1 < L2 < L3.

[0087] Specifically, when the performance score of the transmission link is determined to be Li, i = 1, 2, 3, it includes: obtaining the real-time bandwidth of each transmission link, obtaining the mean bandwidth of the real-time bandwidths of each transmission link, and determining the preset bandwidth with the mean bandwidth. Comparing the real-time bandwidth of the transmission link with the preset bandwidth, and determining whether to adjust the performance score Li of the transmission link according to the comparison result: when the real-time bandwidth is greater than or equal to the preset bandwidth, it is determined not to adjust the performance score Li of the transmission link. When the real-time bandwidth is less than the preset bandwidth, obtain the bandwidth difference between the real-time bandwidth and the preset bandwidth, determine the adjustment coefficient according to the bandwidth difference, and adjust the performance score Li of the transmission link according to the adjustment coefficient.

[0088] Specifically, when determining the adjustment coefficient according to the bandwidth difference, it includes: determining the adjustment coefficient according to the relationship between the bandwidth difference and the pre-configured first preset bandwidth difference and second preset bandwidth difference. When the bandwidth difference is less than the first preset bandwidth difference, the adjustment coefficient is determined to be M3. When the bandwidth difference is greater than or equal to the first preset bandwidth difference and less than the second preset bandwidth difference, the adjustment coefficient is determined to be M2. When the bandwidth difference is greater than or equal to the second preset bandwidth difference, the adjustment coefficient is determined to be M1. Among them, the first preset bandwidth difference is less than the second preset bandwidth difference, and M1 < M2 < M3.

[0089] Specifically, when determining that the adjustment coefficient is Mi, i = 1, 2, 3, it includes: obtaining the real-time packet loss rate of each transmission link, obtaining the average packet loss rate of the real-time packet loss rate of each transmission link, and determining the preset packet loss rate with the average packet loss rate. Compare the real-time packet loss rate with the preset packet loss rate, and determine whether to correct the adjustment coefficient Mi according to the comparison result. When the real-time packet loss rate is less than or equal to the preset packet loss rate, it is determined that the adjustment coefficient Mi is not corrected. When the real-time packet loss rate is greater than the preset packet loss rate, obtain the packet loss rate difference between the real-time packet loss rate and the preset packet loss rate, determine the correction coefficient according to the packet loss rate difference, and correct the adjustment coefficient Mi according to the correction coefficient.

[0090] Specifically, when determining the correction coefficient according to the packet loss rate difference, it includes: determining the correction coefficient according to the relationship between the packet loss rate difference and the pre-configured first preset packet loss rate difference and second preset packet loss rate difference. When the packet loss rate difference is less than the first preset packet loss rate difference, the correction coefficient is determined to be N3. When the packet loss rate difference is greater than or equal to the first preset packet loss rate difference and less than the second preset packet loss rate difference, the correction coefficient is determined to be N2. When the packet loss rate difference is greater than or equal to the second preset packet loss rate difference, the correction coefficient is determined to be N3. Among them, the first preset packet loss rate difference is less than the second preset packet loss rate difference, and N1 < N2 < N3 < 1.

[0091] It can be seen that through hierarchical evaluation and dynamic adjustment of the real-time performance data (delay, bandwidth, and packet loss rate) of the network transmission link, the efficient management and optimization of network traffic can be achieved. By allocating a performance score (L1, L2, or L3) to each transmission link according to the difference between the real-time delay and the preset delay, the level of the score reflects the performance of the link. Subsequently, by further analyzing the relationship between the real-time bandwidth and the preset bandwidth, the performance score is adjusted to reflect the impact of bandwidth shortage on the link performance. Similarly, by comparing the real-time packet loss rate with the preset packet loss rate, the previously determined adjustment coefficient can also be corrected, so as to comprehensively consider the impacts of delay, bandwidth, and packet loss rate on the link performance.

[0092] It is understandable that by monitoring the real-time delay of the network link and calculating the mean value of the delay, and then comparing it with the preset delay. This process ensures that the performance of the link is evaluated within a dynamic range. According to the magnitude of the delay difference, the link is divided into three categories of performance scores (L1, L2, L3), where L3 indicates excellent performance and L1 indicates poor performance. This grading and scoring mechanism not only enables network managers or programs to intuitively understand the performance status of different links, but also quickly identify the links that need to be optimized, thus improving the overall network management efficiency. Secondly, after the delay assessment, the real-time bandwidth is immediately monitored. This process is equally important because bandwidth is a key factor affecting the network traffic processing capacity. When the real-time bandwidth is lower than the preset value, an adjustment coefficient is determined according to the bandwidth difference, which further affects the performance score. In this way, it can reflect in real time the impact of insufficient bandwidth on network performance and make corresponding adjustments when necessary. This flexible response mechanism enables the network to maintain a high transmission quality during traffic fluctuations, reducing network congestion and the decline of user experience caused by insufficient bandwidth. In addition, the monitoring and evaluation of the packet loss rate cannot be ignored. By obtaining the real-time packet loss rate of the link and comparing it with the preset value, the evaluation process of the link performance is further improved. If the real-time packet loss rate exceeds the preset value, the packet loss rate difference is calculated, and a correction coefficient is determined based on this difference. Such a correction mechanism ensures the accuracy of the performance score, enabling timely response and adjustment when the link is abnormal. Finally, through the comprehensive evaluation of delay, bandwidth and packet loss rate, a comprehensive performance analysis of each transmission link can be carried out, providing strong data support for the optimization management of network traffic. Moreover, through the dynamic evaluation and adjustment mechanism based on multi-dimensional performance indicators, the adaptive ability of the network is greatly improved, enabling the network to flexibly respond to changing traffic demands and network conditions. As users' requirements for network quality are getting higher and higher, this not only improves the utilization efficiency of network resources, but also enhances the user experience, ensuring the stability and reliability of network services in different application scenarios.

[0093] In the above embodiments, by deploying a VPN module in the network environment and establishing a transmission tunnel based on a preset VPN protocol, the encapsulation and encryption processing of data streams can be achieved. This tunnel mechanism ensures the security of data streams, but at the same time brings problems that are difficult to handle by traditional NAT. Because the data packets after encryption and encapsulation have been encrypted in terms of header information and data content, the traditional software NAT acceleration engine cannot directly process such data packets and needs to go through the slow protocol stack path for parsing and forwarding, resulting in increased latency and decreased performance. Secondly, by monitoring network traffic to obtain the data packets after encryption processing and parsing the header information of the data packets, including the VPN header and the unencrypted network layer and transport layer protocol header information, the data packets in the encrypted and encapsulated state can be accurately identified. This step uses the specific encapsulation format of the VPN protocol. By parsing the VPN header information and the network layer header, it can be determined whether the data packet is in an encrypted state. Once it is confirmed that the data packet has been encrypted and encapsulated by VPN, the data packet will be specially marked, so as to facilitate quickly distinguishing encrypted data packets from ordinary data packets during subsequent processing, achieving precise classification management of data streams and avoiding unnecessary protocol stack path processing. Finally, this method quickly determines the next-hop forwarding path of the data packet by looking up a preset routing table, so that the marked encrypted data packet can directly enter the optimized forwarding path instead of the traditional slow processing path. During the forwarding process, by real-time monitoring the performance data of the network link, such as the latency, bandwidth, and packet loss rate of data packet transmission, the processing strategy of the data stream is automatically adjusted according to the monitoring results. This dynamic adjustment strategy further improves the adaptability of the system, enabling the NAT acceleration engine to maintain high-efficiency transmission performance when facing different network conditions. This not only improves the transmission speed of VPN data streams but also significantly optimizes the utilization rate of resources, providing users with a network transmission experience with lower latency, higher bandwidth, and lower packet loss rate.

[0094] In another preferred manner based on the above embodiments, as Figure 2 shown, this embodiment provides a system for realizing data stream acceleration based on a NAT acceleration engine, including: a VPN module, an analysis module, a NAT acceleration module, an identification module, and a central control module.

[0095] Specifically, the VPN module is deployed in a network environment. The VPN module is configured to establish a VPN transmission tunnel based on a preset VPN protocol. The VPN module is also configured to obtain a target data stream for encapsulating data packets and perform encryption processing on the encapsulated data packets based on the VPN transmission tunnel. The parsing module is configured to monitor the network traffic of the target network, obtain the encrypted data packets, and parse the data packets to obtain the header information of the data packets. The NAT acceleration module is configured with a number of transmission links. The identification module is electrically connected to the parsing module. The identification module is configured to determine whether the data packet is in an encrypted state according to the header information. Among them, if the data packet is in an encrypted state, the identification module will specially identify the data packet. The central control module is electrically connected to the identification module. The central control module is configured to obtain a preset routing table and determine the next hop of the identified data packet according to the preset routing table. The central control module is also configured to obtain the real-time performance data of the network link when forwarding the data packet and adjust the processing strategy of the data stream according to the real-time performance data.

[0096] It can be understood that the methods and systems for realizing data stream acceleration based on the NAT acceleration engine in the above embodiments of the present invention have the same beneficial effects and will not be elaborated here.

[0097] Those skilled in the art should understand that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0098] The present application is described by referring to the flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram can be implemented by computer program instructions, and the combination of the processes and / or blocks in the flowchart and / or block diagram can also be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices generate means for realizing the functions specified in one process Figure 1 one process or multiple processes and / or blocks Figure 1 or multiple blocks.

[0099] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce a manufacture including an instruction device that implements the functions specified in one or more processes and / or blocks Figure 1 in one or more processes and / or blocks Figure 1 specified in the function of the block or blocks.

[0100] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus, so that a series of operation steps are performed on the computer or other programmable apparatus to produce a computer-implemented process, and thus the instructions executed on the computer or other programmable apparatus provide steps for implementing the functions specified in one or more processes and / or blocks Figure 1 in one or more processes and / or blocks Figure 1 specified in the function of the block or blocks.

[0101] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to the above embodiments, those of ordinary skill in the art should understand that: modifications or equivalent replacements can still be made to the specific embodiments of the present invention. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention shall be covered by the protection scope of the claims of the present invention.

Claims

1. A method for realizing data flow acceleration based on NAT acceleration engine, characterized in that: include: Deploy a VPN module in a network environment and establish a VPN transmission tunnel of the VPN module based on a preset VPN protocol; Obtaining the target data stream to encapsulate data packets, and encrypting the encapsulated data packets through the VPN transmission tunnel; Monitoring network traffic of the target network, obtaining the encrypted data packets, and parsing the data packets to obtain header information of the data packets, wherein the header information includes VPN header information and unencrypted network layer and outer layer protocol headers; Determining whether the data packet is in an encrypted state based on the header information, wherein if the data packet is in an encrypted state, specially marking the data packet; Obtaining a preset routing table, and determining the next hop of the identified data packet according to the preset routing table; Acquire real-time performance data of the network link when forwarding the data packet, and adjust the data flow processing strategy according to the real-time performance data, wherein the real-time performance data includes delay, bandwidth and packet loss rate during data packet transmission; Acquiring real-time performance data of the network link when forwarding the data packet and adjusting the data flow processing strategy according to the real-time performance data includes: Obtaining the real-time delay, real-time bandwidth, and real-time packet loss rate of the network link, and comparing the real-time delay, real-time bandwidth, and real-time packet loss rate with pre-configured preset delay, preset bandwidth, and preset packet loss rate, and determining whether to adjust the processing strategy of the data flow based on the comparison result: When the real-time delay is less than or equal to the preset delay, the real-time bandwidth is greater than or equal to the preset bandwidth, and the real-time packet loss rate is less than or equal to the preset packet loss rate, determining not to adjust the processing strategy of the data flow; When the real-time delay is greater than the preset delay, and / or the real-time bandwidth is less than the preset bandwidth, and / or the real-time packet loss rate is greater than the preset packet loss rate, determining to adjust the processing strategy of the data stream; Wherein, when determining to adjust the processing strategy of the data flow, it includes: obtaining the real-time delay, real-time bandwidth and real-time packet loss rate of the transmission link in each processing strategy, evaluating each transmission link according to the relationship between the real-time delay, real-time bandwidth and real-time packet loss rate and the preset delay, preset bandwidth and preset packet loss rate, and sorting the evaluation results in reverse order, and adjusting the processing strategy corresponding to the first evaluation result as the processing strategy of the data flow; When evaluating each of the transmission links according to the relationship between the real-time delay, the real-time bandwidth, and the real-time packet loss rate and the preset delay, the preset bandwidth, and the preset packet loss rate, the method includes: Obtaining the real-time delay of each transmission link, obtaining a delay mean of the real-time delays of each transmission link, and determining the preset delay by using the delay mean; Obtaining a delay difference between the real-time delay of the transmission link and the preset delay, and determining a performance score of the transmission link when evaluating the transmission link based on a relationship between the delay difference and a pre-configured first preset delay difference and a second preset delay difference; When the delay difference is less than the first preset delay difference, determining that the performance score of the transmission link is L3; When the delay difference is greater than or equal to the first preset delay difference and the delay difference is less than the second preset delay difference, determining that the performance score of the transmission link is L2; When the delay difference is greater than or equal to the second preset delay difference, determining that the performance score of the transmission link is L1; The first preset delay difference is smaller than the second preset delay difference, and L1<L2<L3.

2. The method for realizing data flow acceleration based on NAT acceleration engine according to claim 1, characterized in that: Parsing the data packet to obtain header information of the data packet includes: Monitor data flows in real time using a data packet capture tool, and perform layer-by-layer analysis of each data packet in the data flow to identify the source IP address, destination IP address, protocol type, and port number of the data packet; Perform deep data packet inspection on the parsed data packet and obtain the encryption protocol type, encryption algorithm and key exchange method of the data packet.

3. The method for realizing data flow acceleration based on NAT acceleration engine according to claim 2, characterized in that: When the performance score of the transmission link is determined to be Li, i=1, 2, 3, including: Acquire the real-time bandwidth of each transmission link, acquire the bandwidth average of the real-time bandwidth of each transmission link, and determine the preset bandwidth by using the bandwidth average; Comparing the real-time bandwidth of the transmission link with the preset bandwidth, and determining whether to adjust the performance score Li of the transmission link according to the comparison result; When the real-time bandwidth is greater than or equal to the preset bandwidth, determining not to adjust the performance score Li of the transmission link; When the real-time bandwidth is less than the preset bandwidth, the bandwidth difference between the real-time bandwidth and the preset bandwidth is obtained, an adjustment coefficient is determined according to the bandwidth difference, and the performance score Li of the transmission link is adjusted according to the adjustment coefficient.

4. The method for realizing data flow acceleration based on NAT acceleration engine according to claim 3, characterized in that: Determining the adjustment coefficient based on the bandwidth difference includes: Determining the adjustment coefficient according to a relationship between the bandwidth difference and a pre-configured first preset bandwidth difference and a second preset bandwidth difference; When the bandwidth difference is less than the first preset bandwidth difference, determining the adjustment coefficient to be M3; When the bandwidth difference is greater than or equal to the first preset bandwidth difference and the bandwidth difference is less than the second preset bandwidth difference, determining the adjustment coefficient to be M2; When the bandwidth difference is greater than or equal to the second preset bandwidth difference, determining the adjustment coefficient to be M1; The first preset bandwidth difference is smaller than the second preset bandwidth difference, and M1<M2<M3.

5. The method for realizing data flow acceleration based on NAT acceleration engine according to claim 4, characterized in that: When the adjustment coefficient is determined to be Mi, i=1, 2, 3, including: Obtaining a real-time packet loss rate of each transmission link, obtaining a packet loss rate average of the real-time packet loss rates of each transmission link, and determining the preset packet loss rate based on the packet loss rate average; Comparing the real-time packet loss rate with the preset packet loss rate, and determining whether to modify the adjustment coefficient Mi according to the comparison result; When the real-time packet loss rate is less than or equal to the preset packet loss rate, determining not to modify the adjustment coefficient Mi; When the real-time packet loss rate is greater than the preset packet loss rate, the packet loss rate difference between the real-time packet loss rate and the preset packet loss rate is obtained, a correction coefficient is determined according to the packet loss rate difference, and the adjustment coefficient Mi is corrected according to the correction coefficient.

6. The method for realizing data flow acceleration based on NAT acceleration engine according to claim 5, characterized in that: Determining a correction coefficient based on the packet loss rate difference includes: Determining the correction coefficient according to a relationship between the packet loss rate difference and a pre-configured first preset packet loss rate difference and a second preset packet loss rate difference; When the packet loss rate difference is less than the first preset packet loss rate difference, determining the correction coefficient to be N3; When the packet loss rate difference is greater than or equal to the first preset packet loss rate difference, and the packet loss rate difference is less than the second preset packet loss rate difference, determining the correction coefficient to be N2; When the packet loss rate difference is greater than or equal to the second preset packet loss rate difference, determining the correction coefficient to be N3; The first preset packet loss rate difference is smaller than the second preset packet loss rate difference, and N1<N2<N3<1.

7. The method for realizing data flow acceleration based on NAT acceleration engine according to claim 1, characterized in that: Sorting the evaluation results in descending order and adjusting the processing strategy corresponding to the first evaluation result to the processing strategy of the data flow includes: Obtaining a performance score for each of the evaluation results, and obtaining an average of the performance scores for each of the evaluation results; The performance score is compared with the average of the performance scores, and the performance scores are ranked according to the comparison results: When the performance score is lower than the performance score mean, it is determined that the performance score is not to be sorted; When the performance evaluation is higher than or equal to the performance score mean, the performance score is determined for ranking.

8. A system for implementing data flow acceleration based on a NAT acceleration engine, applicable to a method for implementing data flow acceleration based on a NAT acceleration engine as claimed in any one of claims 1 to 7, characterized in that: include: A VPN module, deployed in a network environment, configured to establish a VPN transmission tunnel based on a preset VPN protocol, and further configured to obtain a target data stream, encapsulate data packets, and encrypt the encapsulated data packets based on the VPN transmission tunnel; a parsing module configured to monitor network traffic of a target network, obtain the encrypted data packets, and parse the data packets to obtain header information of the data packets; NAT acceleration module, configured with several transmission links; an identification module electrically connected to the parsing module, the identification module being configured to determine whether the data packet is in an encrypted state based on the header information, wherein if the data packet is in an encrypted state, the identification module performs a special identification on the data packet; A central control module is electrically connected to the identification module, and is configured to obtain a preset routing table and determine the next hop of the identified data packet based on the preset routing table; the central control module is also configured to obtain real-time performance data of the network link when forwarding the data packet, and adjust the data flow processing strategy based on the real-time performance data.

Images