Data communication method, device, equipment and medium

Abstract

The invention discloses a data communication method and device, equipment and a medium, is applied to a preset physical gateway, and relates to the technical field of communication, and the method comprises the steps: obtaining a request data packet sent by a client; the request data packet comprises a client IP address and a target service system IP address; initiating connection aiming at the IP address of the client in a user mode and creating a corresponding target socket, then converting the IP address of the client into a target character string, and storing the target character string into a target option; and obtaining a target character string in the target option by using a socket cache in a kernel mode, converting the target character string into a client IP address, and changing a source IP address of the socket cache into the client IP address to obtain a forwarding data packet corresponding to the request data packet, and sending the forwarding data packet to a corresponding target service system. Therefore, the operation of mutual communication between the user mode and the kernel mode can be simplified.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a data communication method, device, equipment and medium. Background Art

[0002] At present, in the application scenario of VPN (Virtual Private Network) proxy, the use of Layer 4 traffic tunnel is a common method. Specifically, the client traffic is usually proxied to the gateway by means of tunnel proxy, and then the gateway forwards the connection traffic received from the client to the real business system.

[0003] However, in the process of using conventional forwarding technology, Network Address Translation (NAT) often occurs. This causes the IP (Internet Protocol) addresses obtained by the real business system to be the gateway address, making it impossible to distinguish specific users or other addresses. It can only be known that the access is initiated by the VPN gateway. In addition, it also leads to the following four problems:

[0004] First, it increases the difficulty of network troubleshooting. When an abnormality occurs in the business system, the client cannot be found in time because the gateway address is obtained instead of the real client address, making it difficult to quickly locate the source of the fault.

[0005] Second, it is not conducive to traffic monitoring and analysis, that is, it is impossible to accurately obtain the client's real traffic characteristics and behavior patterns;

[0006] Third, when multiple clients are involved, it is impossible to distinguish the access situations of different clients, which affects the evaluation of business system load and business system performance;

[0007] Fourth, it may cause some compliance issues. Some industries and regions have strict requirements for recording the true source of network access, which may lead to violations when the client's real IP address cannot be obtained.

[0008] As can be seen from the above, how to simplify the operation of mutual communication between user state and kernel state during data communication is a problem that needs to be solved urgently. Summary of the invention

[0009] In view of this, the purpose of the present invention is to provide a data communication method, device, equipment and medium, which can initiate a connection and create a target socket for a client IP address in user mode, and convert the client IP address into a target string and store it in the target option in the target socket, so as to obtain the target string in the target option in kernel mode, and then reversely parse it into the client IP address, and change the source IP address of the socket cache to the client IP address. In this way, the operation of mutual communication between the user mode and the kernel mode can be simplified during the data communication process. The specific scheme is as follows:

[0010] In a first aspect, the present application provides a data communication method, comprising:

[0011] Obtaining a request data packet sent by a client; the request data packet includes the client IP address and the target business system IP address;

[0012] Initiate a connection for the client IP address in the user state of the preset physical gateway and create a corresponding target socket, then convert the client IP address into a target string and store the target string in a target option in the target socket;

[0013] In the kernel state of the preset physical gateway, the target string in the target option is obtained by using the socket cache, and the target string is converted into the client IP address, and the source IP address of the socket cache is changed to the client IP address to obtain a forwarding data packet corresponding to the request data packet, and the forwarding data packet is sent to the corresponding target service system;

[0014] The source IP address and the destination IP address of the forwarded data packet are respectively the client IP address and the target service system IP address.

[0015] Optionally, obtaining a request data packet sent by the client includes:

[0016] Obtaining an encrypted data packet transmitted by the client through a first preset encryption tunnel;

[0017] The encrypted data packet is decrypted to obtain the request data packet.

[0018] Optionally, converting the client IP address into a target string and storing the target string into a target option in the target socket includes:

[0019] Convert the client IP address into a target string according to a preset conversion rule, and store the target string into a target option in the target socket;

[0020] Accordingly, converting the target character string into the client IP address includes:

[0021] The target character string is converted into the client IP address according to a preset reverse parsing rule corresponding to the preset conversion rule.

[0022] Optionally, obtaining the target string in the target option by using a socket cache in the kernel state of the preset physical gateway includes:

[0023] Placing a first hook at a first preset detection point of a preset outbound chain based on the Netfilter architecture;

[0024] When the socket cache passes through the preset outbound chain and triggers the first hook, obtaining the socket cache at the first preset detection point from the preset outbound chain;

[0025] Acquire the target character string in the target option by using the socket cache in the kernel state of the preset physical gateway;

[0026] The target socket is a socket, and the target option is a SO_MARK option of the socket.

[0027] Optionally, after changing the source IP address of the socket cache to the client IP address, the method further includes:

[0028] Calculating a checksum for the socket buffer, and determining whether the checksum result obtained after the calculation is consistent with a preset checksum;

[0029] If the checksum result is consistent with the preset checksum, the socket buffer is put back into the preset outbound chain;

[0030] If the checksum result is inconsistent with the preset checksum, the socket buffer is discarded.

[0031] Optionally, after sending the forwarded data packet to the corresponding target service system, the method further includes:

[0032] Placing a second hook at a second preset detection point of a preset inbound chain based on the Netfilter architecture;

[0033] When the response data packet sent by the target business system based on the forwarded data packet passes through the preset inbound chain and triggers the second hook, obtaining the response data packet at the second preset detection point from the preset inbound chain;

[0034] Determine whether the destination IP address of the socket cache corresponding to the response data packet is consistent with the IP address corresponding to the preset physical gateway;

[0035] If they are inconsistent, the destination IP address of the socket buffer corresponding to the response data packet is changed to the IP address corresponding to the preset physical gateway, and the socket buffer corresponding to the response data packet is put back into the preset inbound chain after calculating the corresponding checksum;

[0036] The destination IP address and the return packet routing address of the response data packet are respectively the client IP address and the IP address of the preset physical gateway.

[0037] Optionally, after sending the forwarded data packet to the corresponding target service system, the method further includes:

[0038] Encapsulating and encrypting the socket buffer corresponding to the response data packet to obtain an encrypted socket buffer;

[0039] The encrypted socket buffer is sent to the client via a second preset encryption tunnel so that the client decrypts the encrypted socket buffer and transmits the decrypted data to a target application to complete a communication operation.

[0040] In a second aspect, the present application provides a data communication device, including:

[0041] An information acquisition module is used to acquire a request data packet sent by a client; the request data packet includes the client IP address and the target business system IP address;

[0042] A socket creation module, used for initiating a connection for the client IP address and creating a corresponding target socket in the user state of the preset physical gateway, and then converting the client IP address into a target string and storing the target string in a target option in the target socket;

[0043] A data packet forwarding module is used to use the socket cache in the kernel state of the preset physical gateway to obtain the target string in the target option, convert the target string into the client IP address, and change the source IP address of the socket cache to the client IP address to obtain a forwarding data packet corresponding to the request data packet, and send the forwarding data packet to the corresponding target business system; wherein the source IP address and destination IP address of the forwarding data packet are the client IP address and the target business system IP address, respectively.

[0044] In a third aspect, the present application provides an electronic device, including:

[0045] Memory, used to store computer programs;

[0046] The processor is used to execute the computer program to implement the aforementioned data communication method.

[0047] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, wherein the computer program implements the aforementioned data communication method when executed by a processor.

[0048] As can be seen from the above, before performing data communication, the present application needs to obtain the request data packet sent by the client and the client IP address and the target business system IP address corresponding to the request data packet; initiate a connection for the client IP address in the user state of the preset physical gateway and create a corresponding target socket, then convert the client IP address into a target string and store the target string in the target option in the target socket; in the kernel state of the preset physical gateway, use the socket cache to obtain the target string in the target option, convert the target string into the client IP address, and change the source IP address of the socket cache to the client IP address to obtain a forwarding data packet corresponding to the request data packet, and send the forwarding data packet to the corresponding target business system; wherein the source IP address and destination IP address of the forwarding data packet are the client IP address and the target business system IP address, respectively. It can be seen that the present application initiates a connection and creates a target socket for the client IP address in the user state of the preset physical gateway, and converts the client IP address into a target string and stores it in the target option in the target socket, so as to obtain the target string in the target option in the kernel state, and then reversely parse it into the client IP address, and change the source IP address of the socket cache to the client IP address. In this way, the operation of mutual communication between the user state and the kernel state can be simplified during the data communication process, which improves the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0050] Figure 1 A flow chart of a data communication method disclosed in this application;

[0051] Figure 2 It is a flow chart of data communication between a user and a business system;

[0052] Figure 3 A schematic diagram of a process of mutual communication between a preset physical gateway in user mode and kernel mode disclosed in the present application;

[0053] Figure 4 A flowchart of data communication between a user and a business system disclosed in this application;

[0054] Figure 5 A structural flow chart of a data communication device disclosed in this application;

[0055] Figure 6 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0056] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0057] In the application scenario of VPN proxy, the use of four-layer traffic tunnel is a common method. Specifically, the means of tunnel proxy is usually adopted to proxy the client's traffic to the gateway, and then the gateway forwards the connection traffic received from the client to the real business system. To this end, the present application provides a data communication method that can simplify the operation of mutual communication between user state and kernel state during data communication, thereby improving the user experience.

[0058] See also Figure 1 As shown, an embodiment of the present invention discloses a data communication method, which is applied to a preset physical gateway, including:

[0059] Step S11, obtaining a request data packet sent by the client; the request data packet includes the client IP address and the target business system IP address.

[0060] In this embodiment, when an encrypted data packet transmitted by the client through the first preset encryption tunnel is obtained, the encrypted data packet needs to be decrypted to obtain the request data packet. Specifically, obtaining the request data packet sent by the client may include: obtaining an encrypted data packet transmitted by the client through the first preset encryption tunnel; decrypting the encrypted data packet to obtain the request data packet.

[0061] It is understandable that in the application scenario of VPN (Virtual Private Network) proxy, the four-layer traffic tunnel is a very common phenomenon. Specifically, by using the means of tunnel proxy, the traffic sent by the client is transmitted to the preset physical gateway, and then the preset physical gateway forwards the traffic received from the client to the real business system. However, in the process of using conventional forwarding technology, network address translation (NAT) often occurs, resulting in the IP address corresponding to the traffic obtained by the real business system being accessed being the address of the preset physical gateway, and the IP address of the client cannot be obtained. Figure 2 In the four-layer traffic proxy forwarding technology, the main technical solution is that the user first initiates a traffic request to the business system, and then forwards it to the real business system through a preset physical gateway proxy.

[0062] In a specific implementation, a user accesses OA (Office Automation) through a computer, that is, initiates a connection request to the OA business system. The traffic of the connection request will be proxied using the end-side technology, and the traffic will be encrypted, and then transmitted to the preset physical gateway through a preset transmission tunnel. In one implementation, it can be transmitted to the VPN gateway through a preset transmission tunnel, and then after the VPN gateway obtains the encrypted traffic, it will decrypt the encrypted traffic to obtain the real business system address that the traffic specifically needs to request, that is, the above-mentioned OA business system. Then the VPN gateway will initiate a connection to OA, and then it can perform a two-way traffic data exchange, so as to achieve the ability of the user to directly access OA. However, the connection between the VPN gateway and the OA business system is initiated by the address of the VPN gateway itself, that is, for the OA business system, it only knows the address of the VPN gateway: 10.50.111.111, so it can only rely on this address for access. This will result in that if many users initiate access to OA at the same time, the OA business system at this time cannot distinguish between specific users or other addresses, and can only recognize that all accesses are initiated by the VPN gateway. To this end, this application modifies the destination address and source address of the traffic through the netfilter architecture (a subsystem introduced by Linux 2.4.x), and uses it in conjunction with the Mark mechanism of the Socket (i.e., the marking mechanism) to solve the problem that the traffic is NATed during the four-layer traffic forwarding process, resulting in the business system being able to obtain the address of the gateway after NAT but unable to obtain the IP address of the client.

[0063] Step S12: Initiate a connection for the client IP address in the user state of the preset physical gateway and create a corresponding target socket, then convert the client IP address into a target string and store the target string in a target option in the target socket.

[0064] In this embodiment, after the preset physical gateway obtains the request data packet sent by the client, it can obtain the client IP address and the target business system IP address corresponding to the request data packet from the request data packet. Subsequently, a connection is initiated to the client IP address and a corresponding target socket is created. When the target socket is successfully created, the client IP address needs to be converted into a target string and the target string is stored in the target option in the target socket. Specifically, converting the client IP address into a target string and storing the target string in the target option in the target socket can include: converting the client IP address into a target string according to a preset conversion rule, and storing the target string in the target option in the target socket.

[0065] Step S13, using the socket cache in the kernel state of the preset physical gateway to obtain the target string in the target option, and converting the target string into the client IP address, and changing the source IP address of the socket cache to the client IP address to obtain a forwarding data packet corresponding to the request data packet, and sending the forwarding data packet to the corresponding target business system; wherein the source IP address and destination IP address of the forwarding data packet are the client IP address and the target business system IP address, respectively.

[0066] In this embodiment, after the target string is stored in the target option in the target socket, the target socket needs to be transferred to the kernel in the user state, so as to obtain the socket cache at the first preset detection point from the preset outbound chain in the kernel state, and obtain the target string therefrom. Specifically, obtaining the target string in the target option using the socket cache in the kernel state of the preset physical gateway may include: placing a first hook at the first preset detection point of the preset outbound chain based on the Netfilter architecture; when the socket cache passes through the preset outbound chain and triggers the first hook, obtaining the socket cache at the first preset detection point from the preset outbound chain; obtaining the target string in the target option using the socket cache in the kernel state of the preset physical gateway; wherein the target socket is a socket socket, and the target option is the SO_MARK option (i.e., a socket option) of the socket socket.

[0067] It is worth mentioning that after obtaining the target option using the socket cache in the kernel state of the preset physical gateway, the target string in the target option needs to be extracted and the target string needs to be reverse parsed to obtain the client IP address. Specifically, converting the target string into the client IP address may include: converting the target string into the client IP address according to a preset reverse parsing rule corresponding to the preset conversion rule.

[0068] In this embodiment, after obtaining the client IP address corresponding to the request data packet, the source IP address corresponding to the socket cache needs to be changed to the client IP address, and the obtained socket cache needs to be checked and calculated, so as to further improve the security of the data communication process. Specifically, after changing the source IP address of the socket cache to the client IP address, it can also include: calculating the checksum of the socket cache, and judging whether the checksum result obtained after the calculation is consistent with the preset checksum; if the checksum result is consistent with the preset checksum, it can be regarded that the socket cache has not been tampered with during the transmission process, and the socket cache is put back into the preset outbound chain; if the checksum result is inconsistent with the preset checksum, it can be regarded that the socket cache has been tampered with during the transmission process, and the socket cache is discarded.

[0069] It is understandable that after the source IP address corresponding to the socket cache is changed to the client IP address, the embodiment of the present application will obtain a forwarding data packet corresponding to the request data packet, so that the preset physical gateway will send the forwarding data packet to the corresponding target business system; after the forwarding data packet is sent to the corresponding target business system, a second hook is required to obtain a response data packet sent by the target business system based on the forwarding data packet. Specifically, after the forwarding data packet is sent to the corresponding target business system, it can also include: placing a second hook at the second preset detection point of the preset inbound chain based on the Netfilter architecture; when the response data packet sent by the target business system based on the forwarding data packet passes through the preset inbound chain and triggers the second hook, the response data packet at the second preset detection point is obtained from the preset inbound chain.

[0070] It is worth mentioning that after obtaining the response data packet, it is necessary to determine whether the destination IP address of the socket cache corresponding to the response data packet is consistent with the IP address corresponding to the preset physical gateway; if not, the destination IP address of the socket cache corresponding to the response data packet is changed to the IP address corresponding to the preset physical gateway, and the socket cache corresponding to the response data packet is placed back into the preset inbound chain after calculating the corresponding checksum; wherein, the destination IP address of the response data packet and the return packet routing address are the client IP address and the IP address of the preset physical gateway, respectively. It can be understood that after the preset physical gateway sends the forwarding data packet to the corresponding target business system, it is also necessary to encapsulate and encrypt the socket cache corresponding to the response data packet, and send the encrypted socket cache to the client via the second preset encryption tunnel to further improve the security of data transmission. Specifically, after the preset physical gateway sends the forwarding data packet to the corresponding target business system, it can also include: encapsulating and encrypting the socket cache corresponding to the response data packet to obtain an encrypted socket cache; sending the encrypted socket cache to the client via the second preset encryption tunnel, so that the client decrypts the encrypted socket cache and transmits the decrypted data to the target application to complete the communication operation.

[0071] As can be seen from the above, before performing data communication, the present application needs to obtain the request data packet sent by the client and the client IP address and the target business system IP address corresponding to the request data packet; initiate a connection for the client IP address in the user state of the preset physical gateway and create a corresponding target socket, then convert the client IP address into a target string and store the target string in the target option in the target socket; in the kernel state of the preset physical gateway, use the socket cache to obtain the target string in the target option, convert the target string into the client IP address, and change the source IP address of the socket cache to the client IP address to obtain a forwarding data packet corresponding to the request data packet, and send the forwarding data packet to the corresponding target business system; wherein the source IP address and destination IP address of the forwarding data packet are the client IP address and the target business system IP address, respectively. It can be seen that the present application initiates a connection and creates a target socket for the client IP address in the user state of the preset physical gateway, and converts the client IP address into a target string and stores it in the target option in the target socket, so as to obtain the target string in the target option in the kernel state, and then reversely parse it into the client IP address, and change the source IP address of the socket cache to the client IP address. In this way, the operation of mutual communication between the user state and the kernel state can be simplified during the data communication process, which improves the user experience.

[0072] To further explain the process of communication between the preset physical gateway in user mode and kernel mode, see Figure 3 As shown, an embodiment of the present invention discloses a data communication method, which is applied to a preset physical gateway, including:

[0073] In this embodiment, after the client receives the data request, it extracts the data request to obtain the specific content in the data request, and then encapsulates the extracted specific content, wherein the specific content includes a request data packet, and the request data packet includes the corresponding source IP address and destination IP address; subsequently, the client needs to encrypt the encapsulated request data packet so that the client can forward the encrypted data packet to the preset physical gateway through the first preset transmission tunnel in the public network, and then decrypt the encrypted data packet through the preset physical gateway to obtain the request data packet, so as to initiate a Socket connection to the client IP address. Among them, the source IP address corresponding to the request data packet is the client IP address, and the destination address corresponding to the request data packet is the target business system IP address. In a specific implementation manner, Figure 4 As shown, the preset physical gateway is the VPN gateway, and the gateway IP address corresponding to the VPN gateway is 10.50.111.111; the client IP addresses are 10.50.50.111, 10.50.50.112 and 10.50.50.113 respectively, and the destination IP addresses corresponding to the request data packets are the database physical address, the bastion host physical address and the OA office physical address, among which the database, bastion host and OA office are all target business systems.

[0074] It is worth mentioning that when creating a socket, the client IP address needs to be converted to obtain a target string. In a specific implementation, the target string may be a 32-bit byte string, and the target string is stored in the target option of the socket, where the target option is the SO_MARK option.

[0075] Subsequently, the VPN gateway is set to kernel state, wherein the operation flow of the VPN gateway in kernel state is as follows: the kernel hooks the NF_IP_LOCAL_OUT chain (i.e., a link for processing data packets sent by the local machine) by utilizing the netfilter architecture. When the hook is triggered, the target string in the SO_MARK option stored in the socket socket by the VPN gateway in user state can be obtained through the obtained socket cache, and then the target string is reversely parsed using the preset reverse parsing rule corresponding to the preset conversion rule to obtain the client IP address, and the source IP address of the socket cache is changed to the client IP address. It is worth mentioning that after the source IP address of the socket cache is changed to the client IP address, the socket cache needs to be checked and calculated; if the result obtained after the calculation passes the verification, the embodiment of the present application can be considered that the security and integrity of the above-mentioned data packet meet the return condition, and the above-mentioned data packet is returned to the original path so that the data packet can be sent to the target business system; if the result obtained after the calculation fails the verification, the embodiment of the present application can be considered that the security and integrity of the above-mentioned data packet do not meet the return condition, and the above-mentioned data packet is discarded. It is worth mentioning that different data packets correspond to different checksums.

[0076] In this embodiment, after the above data packet is sent to the OA office business system corresponding to the OA address: 10.50.11.55, the OA office business system will process the data packet accordingly according to its own business function, generate a response data packet, and then send it back to the source address corresponding to the request data packet. It is worth mentioning that in the process of the OA office business system sending the response data packet back to the source address, the response data packet needs to be sent to the VPN gateway first, and then the response data packet is sent to the client via the VPN gateway.

[0077] It is worth mentioning that after the response data packet is sent to the VPN gateway, since the destination IP address of the response data packet sent by the OA office system is the client IP address, and since the client IP address does not exist in the operating system, the network protocol stack cannot forward the response data packet to the application layer. It is necessary to modify the destination IP address of the response data packet before forwarding the response data packet to the application layer. The specific process is as follows: the kernel state hooks the NF_IP_LOCAL_IN chain (i.e., a link for receiving and processing IP packets sent to the local machine) through the netfilter architecture. When the hook is triggered, it first determines whether the destination IP address of the socket cache corresponding to the response data packet is the IP address of the VPN gateway, where the IP address of the VPN gateway is 10.50.111.111; if not, it is necessary to update the destination IP address of the socket cache corresponding to the response data packet to the IP address of the preset physical network card, and put the socket cache back to the original path after calculating the checksum, so that the VPN gateway can encapsulate and encrypt the response data packet in the user state, and then send it back to the client through the preset transmission tunnel, so that the client can decapsulate and decrypt the received response data packet and pass it to the application, such as a browser, thereby completing a complete communication process between the user state and the kernel state.

[0078] As can be seen from the above, before performing data communication, the present application needs to obtain the request data packet sent by the client and the client IP address and the target business system IP address corresponding to the request data packet; initiate a connection for the client IP address in the user state of the preset physical gateway and create a corresponding target socket, then convert the client IP address into a target string and store the target string in the target option in the target socket; in the kernel state of the preset physical gateway, use the socket cache to obtain the target string in the target option, convert the target string into the client IP address, and change the source IP address of the socket cache to the client IP address to obtain a forwarding data packet corresponding to the request data packet, and send the forwarding data packet to the corresponding target business system; wherein the source IP address and destination IP address of the forwarding data packet are the client IP address and the target business system IP address, respectively. It can be seen that the present application initiates a connection and creates a target socket for the client IP address in the user state of the preset physical gateway, and converts the client IP address into a target string and stores it in the target option in the target socket, so as to obtain the target string in the target option in the kernel state, and then reversely parse it into the client IP address, and change the source IP address of the socket cache to the client IP address. In this way, the operation of mutual communication between the user state and the kernel state can be simplified during the data communication process, which improves the user experience.

[0079] Accordingly, see Figure 5 As shown, the present application also provides a data communication device, which is applied to a preset physical gateway, including:

[0080] The information acquisition module 11 is used to acquire the request data packet sent by the client; the request data packet includes the client IP address and the target business system IP address;

[0081] A socket creation module 12, configured to initiate a connection for the client IP address and create a corresponding target socket in the user state of the preset physical gateway, and then convert the client IP address into a target string and store the target string in a target option in the target socket;

[0082] The data packet forwarding module 13 is used to use the socket cache in the kernel state of the preset physical gateway to obtain the target string in the target option, convert the target string into the client IP address, and change the source IP address of the socket cache to the client IP address to obtain a forwarding data packet corresponding to the request data packet, and send the forwarding data packet to the corresponding target business system; wherein the source IP address and destination IP address of the forwarding data packet are the client IP address and the target business system IP address, respectively.

[0083] As can be seen from the above, before performing data communication, the present application needs to obtain the request data packet sent by the client and the client IP address and the target business system IP address corresponding to the request data packet; initiate a connection for the client IP address in the user state of the preset physical gateway and create a corresponding target socket, then convert the client IP address into a target string and store the target string in the target option in the target socket; in the kernel state of the preset physical gateway, use the socket cache to obtain the target string in the target option, convert the target string into the client IP address, and change the source IP address of the socket cache to the client IP address to obtain a forwarding data packet corresponding to the request data packet, and send the forwarding data packet to the corresponding target business system; wherein the source IP address and destination IP address of the forwarding data packet are the client IP address and the target business system IP address, respectively. It can be seen that the present application initiates a connection and creates a target socket for the client IP address in the user state of the preset physical gateway, and converts the client IP address into a target string and stores it in the target option in the target socket, so as to obtain the target string in the target option in the kernel state, and then reversely parse it into the client IP address, and change the source IP address of the socket cache to the client IP address. In this way, the operation of mutual communication between the user state and the kernel state can be simplified during the data communication process, which improves the user experience.

[0084] In some specific implementations, the information acquisition module 11 may specifically include:

[0085] A first data packet acquisition unit, used to acquire an encrypted data packet transmitted by the client through a first preset encryption tunnel;

[0086] The data packet decryption unit is used to decrypt the encrypted data packet to obtain the request data packet.

[0087] In some specific implementations, the socket creation module 12 may specifically include:

[0088] An address conversion unit, configured to convert the client IP address into a target string according to a preset conversion rule, and store the target string into a target option in the target socket;

[0089] Accordingly, in some specific implementations, the data packet forwarding module 13 may specifically include:

[0090] The character string conversion unit is used to convert the target character string into the client IP address according to a preset reverse parsing rule corresponding to the preset conversion rule.

[0091] In some specific implementations, the data packet forwarding module 13 may specifically include:

[0092] A first hook placement unit, configured to place a first hook at a first preset detection point of a preset outbound chain based on a Netfilter architecture;

[0093] a socket cache acquiring unit, configured to acquire the socket cache at the first preset detection point from the preset outbound chain when the socket cache passes through the preset outbound chain and triggers the first hook;

[0094] A string acquisition unit is used to use the socket cache to acquire the target string in the target option in the kernel state of the preset physical gateway; wherein the target socket is a socket socket, and the target option is the SO_MARK option of the socket socket.

[0095] In some specific implementations, the data packet forwarding module 13 may specifically include:

[0096] A checksum calculation unit, used to calculate a checksum for the socket buffer and determine whether the checksum result obtained after the calculation is consistent with a preset checksum;

[0097] A socket cache returning unit, configured to return the socket cache to the preset outbound chain if the checksum result is consistent with the preset checksum;

[0098] The socket cache discarding unit is used to discard the socket cache if the checksum result is inconsistent with a preset checksum.

[0099] In some specific implementations, the data packet forwarding module 13 may specifically include:

[0100] A second hook placement unit, used for placing a second hook at a second preset detection point of a preset inbound chain based on a Netfilter architecture;

[0101] A second data packet acquisition unit, configured to acquire the response data packet at the second preset detection point from the preset inbound chain when the response data packet sent by the target service system based on the forwarded data packet passes through the preset inbound chain and triggers the second hook;

[0102] An address determination unit, configured to determine whether a destination IP address of a socket buffer corresponding to the response data packet is consistent with an IP address corresponding to the preset physical gateway;

[0103] The address changing unit is used to change the destination IP address of the socket cache corresponding to the response data packet to the IP address corresponding to the preset physical gateway if there is inconsistency, and put the socket cache corresponding to the response data packet back into the preset inbound chain after calculating the corresponding checksum; wherein the destination IP address of the response data packet and the return packet routing address are the client IP address and the IP address of the preset physical gateway respectively.

[0104] In some specific implementations, the data packet forwarding module 13 may specifically include:

[0105] A socket buffer encapsulation unit, used for encapsulating and encrypting the socket buffer corresponding to the response data packet to obtain an encrypted socket buffer;

[0106] The socket buffer sending unit is used to send the encrypted socket buffer to the client via a second preset encryption tunnel, so that the client decrypts the encrypted socket buffer and transmits the decrypted data to the target application to complete the communication operation.

[0107] Furthermore, the present application also discloses an electronic device. Figure 6 2 is a structural diagram of an electronic device 20 according to an exemplary embodiment, and the content in the figure cannot be regarded as any limitation on the scope of use of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the data communication method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0108] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0109] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0110] The operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, and may be Windows Server, Netware, Unix, Linux, etc. In addition to computer programs that can be used to complete the data communication method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 may further include computer programs that can be used to complete other specific tasks.

[0111] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned disclosed data communication method. The specific steps of the method can refer to the corresponding contents disclosed in the aforementioned embodiments, and will not be repeated here.

[0112] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0113] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0114] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0115] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0116] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A data communication method, characterized in that: Applicable to preset physical gateways, including: Obtaining a request data packet sent by a client; the request data packet includes the client IP address and the target business system IP address; Initiate a connection for the client IP address in the user state of the preset physical gateway and create a corresponding target socket, then convert the client IP address into a target string and store the target string in a target option in the target socket; In the kernel state of the preset physical gateway, the target string in the target option is obtained by using the socket cache, and the target string is converted into the client IP address, and the source IP address of the socket cache is changed to the client IP address to obtain a forwarding data packet corresponding to the request data packet, and the forwarding data packet is sent to the corresponding target service system; The source IP address and the destination IP address of the forwarded data packet are respectively the client IP address and the target service system IP address.

2. The data communication method according to claim 1, characterized in that: The step of obtaining a request data packet sent by the client includes: Obtaining an encrypted data packet transmitted by the client through a first preset encryption tunnel; The encrypted data packet is decrypted to obtain the request data packet.

3. The data communication method according to claim 1, characterized in that: The converting the client IP address into a target string and storing the target string into a target option in the target socket comprises: Convert the client IP address into a target string according to a preset conversion rule, and store the target string into a target option in the target socket; Accordingly, converting the target character string into the client IP address includes: The target character string is converted into the client IP address according to a preset reverse parsing rule corresponding to the preset conversion rule.

4. The data communication method according to any one of claims 1 to 3, characterized in that: The obtaining the target string in the target option by using a socket cache in the kernel state of the preset physical gateway includes: Placing a first hook at a first preset detection point of a preset outbound chain based on the Netfilter architecture; When the socket cache passes through the preset outbound chain and triggers the first hook, obtaining the socket cache at the first preset detection point from the preset outbound chain; Acquire the target character string in the target option by using the socket cache in the kernel state of the preset physical gateway; The target socket is a socket, and the target option is a SO_MARK option of the socket.

5. The data communication method according to claim 4, characterized in that: After the source IP address of the socket buffer is changed to the client IP address, the method further includes: Calculating a checksum for the socket buffer, and determining whether the checksum result obtained after the calculation is consistent with a preset checksum; If the checksum result is consistent with the preset checksum, the socket buffer is put back into the preset outbound chain; If the checksum result is inconsistent with the preset checksum, the socket buffer is discarded.

6. The data communication method according to claim 4, characterized in that: After sending the forwarded data packet to the corresponding target service system, the method further includes: Placing a second hook at a second preset detection point of a preset inbound chain based on the Netfilter architecture; When the response data packet sent by the target business system based on the forwarded data packet passes through the preset inbound chain and triggers the second hook, obtaining the response data packet at the second preset detection point from the preset inbound chain; Determine whether the destination IP address of the socket cache corresponding to the response data packet is consistent with the IP address corresponding to the preset physical gateway; If they are inconsistent, the destination IP address of the socket buffer corresponding to the response data packet is changed to the IP address corresponding to the preset physical gateway, and the socket buffer corresponding to the response data packet is put back into the preset inbound chain after calculating the corresponding checksum; The destination IP address and the return packet routing address of the response data packet are respectively the client IP address and the IP address of the preset physical gateway.

7. The data communication method according to claim 6, characterized in that: After sending the forwarded data packet to the corresponding target service system, the method further includes: Encapsulating and encrypting the socket buffer corresponding to the response data packet to obtain an encrypted socket buffer; The encrypted socket buffer is sent to the client via a second preset encryption tunnel so that the client decrypts the encrypted socket buffer and transmits the decrypted data to a target application to complete a communication operation.

8. A data communication device, characterized in that: include: An information acquisition module is used to acquire a request data packet sent by a client; the request data packet includes the client IP address and the target business system IP address; A socket creation module, used for initiating a connection for the client IP address and creating a corresponding target socket in the user state of the preset physical gateway, and then converting the client IP address into a target string and storing the target string in a target option in the target socket; A data packet forwarding module is used to use the socket cache in the kernel state of the preset physical gateway to obtain the target string in the target option, convert the target string into the client IP address, and change the source IP address of the socket cache to the client IP address to obtain a forwarding data packet corresponding to the request data packet, and send the forwarding data packet to the corresponding target business system; wherein the source IP address and destination IP address of the forwarding data packet are the client IP address and the target business system IP address, respectively.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the steps of the data communication method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the steps of the data communication method according to any one of claims 1 to 7 are implemented.

Images