Service connection establishment method and device, equipment and medium

Abstract

The invention provides a service connection establishment method and device, equipment and a medium, which are used for improving the efficiency of establishing service connection between a server and a client and improving the efficiency of identifying and authenticating SPA (Single Packet Authorization). In the method, a client can determine a congestion state value of each candidate path between the client and a server based on an obtained first network condition parameter value of each network node; selecting a first target path from the candidate paths based on the congestion state value; according to the method, the to-be-verified data packet is quickly and efficiently sent to the server based on the first target path, the server can verify the data packet and send the encrypted temporary key to the client after the verification of the data packet is passed, and the client can receive the encrypted temporary key and establish service connection with the server based on the temporary key. On the basis, the purposes of improving the efficiency of SPA authentication and improving the efficiency of establishing connection between the client and the server can be achieved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method, device, equipment and medium for establishing a service connection. Background Art

[0002] Single Packet Authorization (SPA) is a lightweight security protocol that allows the server to authenticate the client before the client and the server establish a service connection. SPA technology can prevent unauthorized clients from establishing a service connection with the server, thereby identifying and blocking the attacker's connection request before the service connection is established.

[0003] However, in the process of SPA-related identification and authentication, there is currently no good solution for how to improve the efficiency of establishing service connections between the server and the legitimate client and improve the efficiency of identification and authentication. Summary of the invention

[0004] The present application provides a service connection establishment method, apparatus, device and medium, which are used to improve the efficiency of establishing a service connection between a server and a client, and improve the efficiency of SPA identification and authentication.

[0005] In a first aspect, the present application provides a method for establishing a service connection, the method being applied to a client, the method comprising:

[0006] Determine the congestion status value of each candidate path between the server and the server based on the first network status parameter value obtained for each network node; and select a first target path from each candidate path based on the congestion status value;

[0007] Based on the first target path, the data packet to be verified is sent to the server, so that the server verifies the data packet, and the server sends the encrypted temporary key to the client after the data packet is verified;

[0008] The encrypted temporary key is received, and a service connection is established with the server based on the temporary key.

[0009] In a possible implementation manner, selecting a first target path from each candidate path based on the congestion state value includes:

[0010] Any candidate path whose congestion status value is less than the determined congestion threshold is selected as the first target path.

[0011] In a possible implementation manner, the process of determining the congestion threshold includes:

[0012] Determine an average value of the congestion status values ​​of the candidate paths;

[0013] Based on the average value, the congestion threshold is determined.

[0014] In a possible implementation manner, selecting a first target path from each candidate path based on the congestion state value includes:

[0015] Based on the congestion state value and the abnormal state value of each candidate path, a first target path is selected from the candidate paths; wherein, for each candidate path, the abnormal state value of the candidate path is obtained based on the difference between the second network status parameter value of the candidate path and the corresponding historical network status parameter value.

[0016] In a possible implementation manner, the selecting the first target path from the candidate paths based on the congestion state value and the abnormal state value of each candidate path includes:

[0017] The first target path is selected from candidate paths whose congestion state values ​​are smaller than a determined congestion threshold and whose abnormal state values ​​are smaller than a preset abnormal threshold.

[0018] In a possible implementation manner, the data packet includes the first network status parameter value.

[0019] In a second aspect, the present application provides a method for establishing a service connection, the method being applied to a server, the method comprising:

[0020] Receiving a data packet to be verified sent by the client based on a first target path, and verifying the data packet; wherein the first target path is a path selected from each candidate path based on the congestion status value of each candidate path between the client and the server determined by the client based on the current first network status parameter value of each network node obtained;

[0021] If the data packet is verified successfully, the encrypted temporary key is sent to the client, so that the client establishes a connection with the server based on the temporary key.

[0022] In a possible implementation manner, if the data packet is verified to be successful, before sending the encrypted temporary key to the client, the method further includes:

[0023] Determine a congestion status value of each candidate path between the client and the client based on the acquired third network status parameter value of each network node; select a second target path from each candidate path based on the congestion status value;

[0024] The step of sending the encrypted temporary key to the client comprises:

[0025] Based on the second target path, the encrypted temporary key is sent to the client.

[0026] In a possible implementation manner, selecting the second target path from each candidate path based on the congestion state value includes:

[0027] Based on the congestion state value and the abnormal state value of each candidate path, a second target path is selected from the candidate paths; wherein, for each candidate path, the abnormal state value of the candidate path is obtained based on the difference between the fourth network status parameter value of the candidate path and the corresponding historical network status parameter value.

[0028] In a possible implementation manner, the verifying the data packet includes:

[0029] If the data packet contains the first network status parameter value of each network node, compare the first network status parameter value in the data packet with the corresponding network status parameter value obtained by the server from each network node to see whether they match, and determine the verification result of the data packet based on the comparison result.

[0030] In a third aspect, the present application provides a device for establishing a service connection, the device being applied to a client, the device comprising:

[0031] A first selection module is used to determine the congestion status value of each candidate path between the server and the server based on the first network status parameter value of each network node obtained; based on the congestion status value, select a first target path from each candidate path;

[0032] A first sending module, configured to send the data packet to be verified to the server based on the first target path, so that the server verifies the data packet, and sends the encrypted temporary key to the client after the data packet is verified;

[0033] The first receiving module is used to receive the encrypted temporary key and establish a service connection with the server based on the temporary key.

[0034] In a possible implementation manner, the first selection module is specifically configured to:

[0035] Any candidate path whose congestion status value is less than the determined congestion threshold is selected as the first target path.

[0036] In a possible implementation manner, the first selection module is specifically configured to:

[0037] Determine an average value of the congestion status values ​​of the candidate paths;

[0038] Based on the average value, the congestion threshold is determined.

[0039] In a possible implementation manner, the first selection module is specifically configured to:

[0040] Based on the congestion state value and the abnormal state value of each candidate path, a first target path is selected from the candidate paths; wherein, for each candidate path, the abnormal state value of the candidate path is obtained based on the difference between the second network status parameter value of the candidate path and the corresponding historical network status parameter value.

[0041] In a possible implementation manner, the first selection module is specifically configured to:

[0042] The first target path is selected from candidate paths whose congestion state values ​​are smaller than a determined congestion threshold and whose abnormal state values ​​are smaller than a preset abnormal threshold.

[0043] In a possible implementation manner, the data packet includes the first network status parameter value.

[0044] In a fourth aspect, the present application provides a device for establishing a service connection, the device being applied to a server, and the device comprising:

[0045] a second receiving module, configured to receive a data packet to be verified sent by the client based on a first target path, and verify the data packet; wherein the first target path is a path selected from each candidate path based on the congestion state value of each candidate path between the client and the server determined by the client based on the current first network status parameter value of each network node obtained;

[0046] The second sending module is used to send the encrypted temporary key to the client if the data packet is verified successfully, so that the client can establish a connection with the server based on the temporary key.

[0047] In a possible implementation, the device further includes:

[0048] A second selection module is used to determine the congestion status value of each candidate path between the client and the client based on the third network status parameter value of each network node obtained; based on the congestion status value, select a second target path from each candidate path;

[0049] Based on the second target path, the encrypted temporary key is sent to the client.

[0050] In a possible implementation manner, the second selection module is specifically configured to:

[0051] Based on the congestion state value and the abnormal state value of each candidate path, a second target path is selected from the candidate paths; wherein, for each candidate path, the abnormal state value of the candidate path is obtained based on the difference between the fourth network status parameter value of the candidate path and the corresponding historical network status parameter value.

[0052] In a possible implementation manner, the second receiving module is specifically configured to:

[0053] If the data packet contains the first network status parameter value of each network node, compare the first network status parameter value in the data packet with the corresponding network status parameter value obtained by the server from each network node to see whether they match, and determine the verification result of the data packet based on the comparison result.

[0054] In a fifth aspect, an embodiment of the present application provides a service connection establishment system, the system comprising at least the service connection establishment device applied to the client as described in the third aspect, and the service connection establishment device applied to the server as described in the fourth aspect.

[0055] In a sixth aspect, an embodiment of the present application provides an electronic device, which includes at least a processor and a memory, and the processor is used to implement the steps of any of the above methods when executing a computer program stored in the memory.

[0056] In a seventh aspect, an embodiment of the present application provides a computer-readable storage medium storing a computer program, which implements the steps of any of the above methods when executed by a processor.

[0057] In an eighth aspect, an embodiment of the present application provides a computer program product, which includes: a computer program code, and when the computer program code is run on a computer, the computer executes the steps of any of the above-mentioned methods.

[0058] In the embodiment of the present application, the client can determine the congestion status value of each candidate path between the client and the server based on the first network status parameter value of each network node obtained; based on the congestion status value, select the first target path from each candidate path; based on the first target path, send the data packet to be verified to the server, the server can verify the data packet, and send the encrypted temporary key to the client after the data packet is verified, the client can receive the encrypted temporary key, and establish a service connection with the server based on the temporary key. Since the network status parameter value can be shared between the network nodes in the embodiment of the present application, the client can determine the congestion status value of each candidate path between the client and the server based on the first network status parameter value of each network node obtained; the client can start from a global perspective, based on the congestion status value of each candidate path, intelligently select the first target path from each candidate path, and when sending the data packet to be verified to the server based on the first target path, the efficiency of sending (transmitting) the data packet to be verified to the server can be improved. Based on this, the efficiency of SPA authentication and the efficiency of establishing a connection between the client and the server can be improved.

[0059] In addition, in the embodiment of the present application, based on the congestion status value of each candidate path, an intelligent method of selecting a target path for transmitting information (traffic) between the client and the server from each candidate path can not only improve the transmission efficiency, but also achieve balanced distribution of transmission traffic between the candidate paths, avoid the situation where some paths are overloaded while some paths are too idle, reduce network congestion, and improve transmission stability. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the implementation methods in the embodiments of the present application or the related technologies, the following is a brief introduction to the drawings required for use in the embodiments or the related technology descriptions. Obviously, the drawings described below are some embodiments of the present application, and a person skilled in the art can also obtain other drawings based on these drawings.

[0061] Figure 1 A schematic diagram of a first service connection establishment process provided by some embodiments of the present application is shown;

[0062] Figure 2 A schematic diagram of a second service connection establishment process provided by some embodiments of the present application is shown;

[0063] Figure 3 A schematic diagram of a third service connection establishment process provided by some embodiments of the present application is shown;

[0064] Figure 4 A schematic diagram of a fourth service connection establishment process provided by some embodiments of the present application is shown;

[0065] Figure 5 A schematic diagram of a fifth service connection establishment process provided by some embodiments of the present application is shown;

[0066] Figure 6 A schematic diagram of a sixth service connection establishment process provided by some embodiments of the present application is shown;

[0067] Figure 7 A schematic diagram of a seventh service connection establishment process provided by some embodiments of the present application is shown;

[0068] Figure 8 A schematic diagram of a first service connection establishment device provided in some embodiments of the present application is shown;

[0069] Fig. 9 A schematic diagram of a second service connection establishment device provided in some embodiments of the present application is shown;

[0070] Fig.10 A schematic diagram of the structure of a service connection establishment system provided in some embodiments of the present application is shown;

[0071] Fig.11 A schematic diagram of the structure of an electronic device provided in some embodiments of the present application is shown. DETAILED DESCRIPTION

[0072] In order to make the purpose, technical solutions and advantages of this application clearer, this application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the embodiments described in this application are only part of the embodiments of this application, rather than all the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0073] It should be noted that the brief description of terms in this application is only for the convenience of understanding the embodiments described below, and is not intended to limit the embodiments of this application. Unless otherwise specified, these terms should be understood according to their common and usual meanings.

[0074] The terms "first", "second", "third", etc. in the specification and claims of this application and the above drawings are used to distinguish similar or similar objects or entities, and do not necessarily mean to limit a specific order or sequence, unless otherwise noted. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances.

[0075] The terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover but not exclude inclusion, for example, a product or device comprising a list of components is not necessarily limited to all the components expressly listed but may include other components not expressly listed or inherent to such product or device.

[0076] The term "module" refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic or combination of hardware and / or software code that is capable of performing the functions associated with that element.

[0077] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

[0078] In order to improve the efficiency of establishing a service connection between the server and the client during the SPA-related authentication process, and to improve the efficiency of SPA authentication, the present application provides a service connection establishment method, device, equipment and medium. In this method, the client can determine the congestion status value of each candidate path between the server and the client based on the first network status parameter value of each network node obtained; based on the congestion status value, select the first target path from each candidate path; based on the first target path, send the data packet to be verified to the server, the server can verify the data packet, and after the data packet is verified, send the encrypted temporary key to the client, the client can receive the encrypted temporary key, and establish a service connection with the server based on the temporary key. Since in the embodiment of the present application, network status parameter values ​​can be shared between network nodes, the client can determine the congestion status value of each candidate path between the client and the server based on the first network status parameter value of each network node obtained; the client can, from a global perspective, based on the congestion status value of each candidate path, intelligently select the first target path from each candidate path, and when sending the data packet to be verified to the server based on the first target path, the efficiency of sending (transmitting) the data packet to be verified to the server can be improved. Based on this, the efficiency of SPA authentication and the efficiency of establishing a connection between the client and the server can be improved.

[0079] In addition, since the target path for transmitting information (traffic) between the client and the server can be intelligently selected from the candidate paths based on the congestion status value of each candidate path, it is possible to not only improve the transmission efficiency, but also achieve balanced distribution of transmission traffic among the candidate paths, avoid the situation where some paths are overloaded while some paths are too idle, reduce network congestion, and improve transmission stability.

[0080] Embodiment 1:

[0081] See also Figure 1 , Figure 1 A schematic diagram of a first service connection establishment process provided by some embodiments of the present application is shown, and the process includes the following steps:

[0082] S101: The client determines a congestion status value of each candidate path between the client and the server based on the acquired first network status parameter value of each network node; and selects a first target path from each candidate path based on the congestion status value.

[0083] The service connection establishment method provided in the embodiment of the present application is applied to a client, which may be a mobile terminal, a PC or other device, for example.

[0084] In a possible implementation, in order to improve the efficiency of SPA authentication, each network node can share (exchange) the latest network status parameter value (for ease of description, referred to as the first network status parameter value) obtained in real time. For each network node, the first network status parameter value of the network node may include sub-parameter values ​​such as the round-trip time (RTT), packet loss rate (Loss Rate) and bandwidth estimation value (BandwidthEstimate) of the network node. The process of each network node obtaining the first network status parameter value can adopt the existing technology, which will not be repeated here.

[0085] In a possible implementation, in order to improve the efficiency of SPA authentication, before any client in a network node wants to establish a connection with a server, the client can determine the congestion state value of each candidate path between the client and the server based on the first network status parameter value of each network node obtained. Exemplarily, for each network node, the weighted sum of each sub-parameter value and the corresponding weight coefficient in the first network status parameter value of the network node can be determined, and the weighted sum can be used as the congestion state vector (CSV) of the network node. For each candidate path, the congestion state value of the candidate path can be determined based on the congestion state vector of each network node contained in the candidate path.

[0086] For example, the first network status parameter value of the network node i includes the round trip delay (RTT i ), packet loss rate (L i ) and bandwidth estimate (B i ) The weight coefficient of the round-trip delay is α, the weight coefficient of the packet loss rate is β, and the weight coefficient of the bandwidth estimation value is γ. The congestion state vector C of the network node i i It can be: α×RTT i +β×L i +γ×B i . Among them, the present application does not make any specific limitation on the size of α, β, and γ. α, β, and γ can be positive or negative numbers, and can be flexibly set according to needs. For each candidate path, the sum of the congestion state vectors of each network node contained in the candidate path can be determined as the congestion state value of the candidate path. Among them, the larger the numerical value of the congestion state value, the larger the network load of the corresponding candidate path is considered to be, and the more congested it is. Of course, it can also be that the smaller the numerical value of the congestion state value, the larger the network load of the corresponding candidate path is considered to be, and the more congested it is. This application does not make any specific limitation on this. For ease of understanding, this application takes the larger the numerical value of the congestion state value, the larger the network load of the corresponding candidate path, and the more congested it is as an example to explain the service connection establishment process provided by this application.

[0087] In a possible implementation, in order to improve the authentication efficiency of SPA, a first target path for transmitting a data packet for SPA authentication of the client can be selected from each candidate path based on the congestion status value of the candidate path. Exemplarily, the candidate path with the smallest congestion status value can be selected as the first target path, and based on the first target path, the above data packet is transmitted quickly and efficiently to improve the authentication efficiency of SPA.

[0088] In a possible implementation, in order to improve the efficiency of selecting the first target path, when selecting the first target path from each candidate path based on the congestion status value, any candidate path whose congestion status value is less than a determined congestion threshold value can also be selected as the first target path. Exemplarily, assuming that there are 3 candidate paths available from a certain client to a certain server, one of which is candidate path A, which is relatively congested, and its congestion status value exceeds the congestion threshold value, and the congestion status values ​​of the remaining two candidate paths B and candidate path C do not exceed the congestion threshold value, then candidate path B or candidate path C can be selected as the first target path, and the client's data packet can be sent to the server based on candidate path B or candidate path C.

[0089] In a possible implementation, in order to disperse the traffic load and improve the transmission efficiency, the data packet to be verified can be configured into multiple sub-data packets, and different sub-data packets can be sent to the server through different paths. Exemplarily, multiple candidate paths can be arbitrarily selected from the candidate paths whose congestion status values ​​are less than the congestion threshold, and the selected multiple candidate paths can be respectively used as the first target paths, and the data packet to be verified can be sent to the server based on the multiple first target paths. This application does not specifically limit the number of target paths.

[0090] In one possible implementation, in order to improve the flexibility and accuracy of the process of selecting the first target path, the congestion threshold can be configured as a value that can be adaptively and dynamically adjusted according to the congestion conditions of each candidate path. Specifically, the average value of the congestion state value of each candidate path can be determined, and the congestion threshold can be determined based on the average value of the congestion state value of each candidate path. Exemplarily, the average value (C) of the congestion state value of each candidate path can be directly determined as the congestion threshold (T). The product (δ×C) of the average value (C) of the congestion state value of each candidate path and the set coefficient (δ) can also be determined as the congestion threshold, and this application does not make specific restrictions on this.

[0091] In a possible implementation, in addition to selecting the first target path from each candidate path based on the congestion state value, the abnormal state value of the candidate path can also be determined, and the congestion state value and the abnormal state value can be combined to quickly and accurately select the first target path from each candidate path. For each candidate path, when determining the abnormal state value of the candidate path, the abnormal state value of the candidate path can be obtained based on the difference between the second network status parameter value of the candidate path and the corresponding historical network status parameter value.

[0092] For example, taking the second network status parameter value including the bandwidth estimation value, packet loss rate, delay (Delay) and network jitter value as an example, each sub-parameter value (S t) and the corresponding historical network status parameter value (H) (for ease of description, referred to as the difference corresponding to the sub-parameter value), then the weighted sum of the difference corresponding to each sub-parameter value and the weight coefficient of each sub-parameter value can be determined as the abnormal state value of the candidate path. Among them, for each network node, the historical network status parameter value of the network node can be the network status parameter value of the network node within a preset historical time period. The present application does not make specific restrictions on the historical time period, and can be flexibly set according to needs. The present application also does not make specific restrictions on the weight coefficient of each sub-parameter value in the second network status parameter value, and can be flexibly set according to needs. Among them, based on the weighted sum of the difference corresponding to each sub-parameter value in the second network status parameter value and the weight coefficient of each sub-parameter value, the process of determining the abnormal state value of the candidate path is similar to the process of determining the congestion state vector of the network node based on the weighted sum of each sub-parameter value in the first network status parameter value of the network node and the corresponding weight coefficient introduced in the above embodiment, which will not be repeated here.

[0093] The higher the abnormal state value of the candidate route, the greater the difference between the candidate route and the corresponding historical data, and the greater the probability that the candidate route is currently abnormal. In a possible implementation, when selecting the first target path from each candidate path based on the congestion state value and the abnormal state value of each candidate path, the first target path can be selected from the candidate paths whose congestion state value is less than the congestion threshold and whose abnormal state value is less than the preset abnormal threshold.

[0094] Exemplarily, any path among the candidate paths whose congestion state value is less than the congestion threshold and whose abnormal state value is less than the preset abnormal threshold can be selected as the first target path. Alternatively, for each candidate path whose congestion state value is less than the congestion threshold and whose abnormal state value is less than the preset abnormal threshold, the sum of the congestion state value and the abnormal state value of each candidate path is calculated, and the candidate path with the smallest sum is selected as the first target path, which is not specifically limited in this application.

[0095] Since the target path for transmitting information (data) can be selected by combining the abnormal state value and the congestion state value, not only the transmission efficiency can be improved, but also network anomalies can be discovered in time, avoiding the use of abnormal network paths for data transmission, and ensuring the stability of data transmission.

[0096] S102: Based on the first target path, the client sends the data packet to be verified to the server, so that the server verifies the data packet, and sends the encrypted temporary key to the client after the data packet is verified.

[0097] In a possible implementation, after the client sends the data packet to be verified to the server based on the first target path, the server can verify the data packet, that is, the process of performing SPA authentication on the client based on the data packet. Exemplarily, the data packet may include information such as a timestamp, a client identifier, a random number, and the first network status parameter value of each network node obtained by the client, and the server can verify each information contained in the data packet. Among them, the process of the server verifying the timestamp, client identifier and random number contained in the data packet can adopt the existing technology, which will not be repeated here.

[0098] It is worth noting that when the data packet contains the first network status parameter value of each network node obtained by the client, when the server verifies the information in the data packet, it can compare the first network status parameter value of each network node in the data packet with the corresponding network status parameter value obtained by the server itself from each network node to see if it matches, and determine the verification result of the data packet based on the comparison result. Exemplarily, when the first network status parameter value of each network node in the data packet matches the corresponding network status parameter value obtained by the server itself from each network node, it can be considered that the client is likely to be a legitimate client, and the verification result of the information in the data packet can be determined as passed. Otherwise, when it is considered that the first network status parameter value of each network node in the data packet does not match the corresponding network status parameter value obtained by the server itself from each network node, it can be considered that the client is likely to be an illegal client, and the verification result of the information in the data packet can be determined as failed.

[0099] In a possible implementation, when determining whether the first network status parameter value of each network node in the data packet matches the corresponding network status parameter value obtained by the server itself from each network node, it can be that when the deviation value between the first network status parameter value of each network node (all network nodes) in the data packet and the corresponding network status parameter value obtained by the server itself from the corresponding network node is lower than the preset deviation threshold, the two are considered to match; otherwise, the two are considered to be mismatched. It can also be that when the deviation value between the first network status parameter value of a preset number of network nodes (a part of the network nodes) in the data packet and the corresponding network status parameter value obtained by the server itself from the corresponding network node is lower than the preset deviation threshold, the two are considered to match; otherwise, the two are considered to be mismatched, and this application does not make specific limitations on this.

[0100] In one possible implementation, when the verification result of each information in the data packet is passed, the data packet is considered to have been verified. Otherwise, if the verification result of any information in the data packet is failed, the verification result of the data packet is considered to have failed, the client can be considered to be an illegal client, and no connection is established with the client.

[0101] In a possible implementation, when the data verification is passed, the client can be considered to be a legitimate client, and the server can generate a temporary key, encrypt the temporary key with a private key, and send the encrypted temporary key to the client.

[0102] In one possible implementation, when the server sends the encrypted temporary key to the client, in order to improve the efficiency of establishing a connection between the client and the server, the server can determine the congestion status value of each candidate path between the client and the server based on the current latest third network status parameter value of each network node obtained in real time; from a global perspective, based on the congestion status value of each candidate path, the second target path is intelligently selected from each candidate path, and then, based on the second target path, the encrypted temporary key can be sent to the client quickly and efficiently.

[0103] Among them, the third network status parameter value and the first network status parameter value may be the same or different, and this application does not make specific restrictions on this. The process of determining the congestion state value of the candidate path based on the third network status parameter value and selecting the second target path based on the congestion state value is similar to the process of determining the congestion state value based on the first network status parameter value and selecting the first target path described in the above embodiment. Specifically, when the server determines the congestion state value of each candidate path between the client and the client based on the latest third network status parameter value of each network node obtained in real time, for each network node, the server can determine the weighted sum of each sub-parameter value and the corresponding weight coefficient in the third network status parameter value of the network node, and use the weighted sum as the congestion state vector (CSV) of the network node. For each candidate path, the congestion state value of the candidate path can be determined based on the sum of the congestion state vectors of each network node contained in the candidate path. The server can select a second target path for transmitting a temporary key from each candidate path based on the congestion state value of each candidate path. Exemplarily, the candidate path with the smallest congestion status value can be selected as the second target path. Based on the second target path, the temporary key can be transmitted quickly and efficiently to improve the efficiency of establishing a connection between the client and the server and improve the identification and authentication efficiency of the SPA.

[0104] In a possible implementation, in order to improve the speed of selecting the second target path, when the server selects the second target path from the candidate paths based on the congestion status value, it can also select any candidate path whose congestion status value is less than a determined congestion threshold as the second target path.

[0105] In one possible implementation, in order to improve the flexibility and accuracy of the process of selecting the second target path, the congestion threshold can be configured as a value that can be adaptively and dynamically adjusted according to the congestion conditions of each candidate path. Specifically, the average value of the congestion status value of each candidate path can be determined, and the congestion threshold can be determined based on the average value of the congestion status value of each candidate path. Similar to the process of determining the congestion threshold by the client described above, the server can directly determine the average value of the congestion status value of each candidate path as the congestion threshold, or the product (δ×C) of the average value (C) of the congestion status value of each candidate path and the set coefficient (δ), etc., as the congestion threshold, and this application does not make specific restrictions on this.

[0106] In a possible implementation, similar to selecting the first target path, when selecting the second target path, the second target path can also be selected from each candidate path in combination with the congestion state value and the abnormal state value of the candidate path. Among them, the process of the server determining the abnormal state value of the path is similar to the process of the client determining the abnormal state value of the path introduced in the above embodiment. Specifically, for each candidate path, when the server determines the abnormal state value of the candidate path, it can obtain the abnormal state value of the candidate path based on the difference between the fourth network status parameter value of the candidate path and the corresponding historical network status parameter value.

[0107] Exemplarily, taking the sub-parameter values ​​of bandwidth estimation, packet loss rate, delay and network jitter value included in the fourth network status parameter value as an example, the server can respectively determine the difference between each sub-parameter value in the fourth network status parameter value and the corresponding historical network status parameter value (for ease of description, referred to as the corresponding difference of the sub-parameter value), and then the weighted sum of the corresponding difference of each sub-parameter value and the weight coefficient of each sub-parameter value can be determined as the abnormal state value of the candidate path. Among them, for each network node, the historical network status parameter value of the network node can be the network status parameter value of the network node within a preset historical time period. The present application does not make specific limitations on the historical time period, and can be flexibly set according to needs. The present application also does not make specific limitations on the weight coefficient of each sub-parameter value in the fourth network status parameter value, and can be flexibly set according to needs.

[0108] In a possible implementation, when the server selects the second target path from each candidate path based on the congestion status value and the abnormal status value of each candidate path, the second target path may be selected from the candidate paths whose congestion status value is less than the congestion threshold and whose abnormal status value is less than the preset abnormal threshold.

[0109] Exemplarily, any path among the candidate paths whose congestion state value is less than the congestion threshold and whose abnormal state value is less than the preset abnormal threshold can be selected as the second target path. Alternatively, for each candidate path whose congestion state value is less than the congestion threshold and whose abnormal state value is less than the preset abnormal threshold, the sum of the congestion state value and the abnormal state value of each candidate path is calculated, and the candidate path with the smallest sum is selected as the second target path, which is not specifically limited in the present application.

[0110] S103: The client receives the encrypted temporary key and establishes a connection with the server based on the temporary key.

[0111] In a possible implementation, the client can receive the encrypted temporary key sent by the server, and the client can use the corresponding public key to decrypt the temporary key, obtain the decrypted temporary key, and encrypt subsequent communication data based on the temporary key, and try to establish an actual service connection with the server based on the communication data. Exemplarily, the actual service connection can be established between the client and the server through protocols such as the Transmission Control Protocol (TCP), which will not be repeated here.

[0112] Since network status parameter values ​​can be shared between network nodes in the present application, the client can determine the congestion status value of each candidate path between the client and the server based on the first network status parameter value of each network node obtained; the client can intelligently select the first target path from each candidate path based on the congestion status value of each candidate path from a global perspective, and when sending the data packet to be verified to the server based on the first target path, the efficiency of sending (transmitting) the data packet to be verified to the server can be improved. Based on this, the efficiency of SPA authentication and the efficiency of establishing a connection between the client and the server can be improved.

[0113] In addition, based on the congestion status value of each candidate path, the present application intelligently selects the target path for transmitting information (traffic) between the client and the server from each candidate path, which can not only improve the transmission efficiency, but also achieve balanced distribution of transmission traffic between the candidate paths, avoid the situation where some paths are overloaded while some paths are too idle, reduce network congestion, and improve transmission stability.

[0114] For ease of understanding, the service connection establishment process provided by the present application is explained below through a specific embodiment. Figure 2 , Figure 2 A schematic diagram of a second service connection establishment process provided in some embodiments of the present application is shown, and the process includes the following steps:

[0115] S200: The server generates a pair of public and private keys, sends the public key to all legal clients, and stores the private key locally on the server. In addition, each network node including the server and all legal clients can share (exchange) their respective network status parameter values ​​in real time.

[0116] Each network node can exchange network status parameter values ​​with other network nodes through an information sharing layer configured in itself.

[0117] S201: When any client wants to establish a service connection with a server, it can first determine the congestion status value of each candidate path between the client and the server based on the first network status parameter value of each network node obtained, and select a first target path from each candidate path based on the congestion status value. In addition, the client can generate a data packet including a timestamp, a client identifier, a random number, and the first network status parameter value of each network node obtained by the client, encrypt the data packet with a public key received from the server, and send the encrypted data packet to be verified to the server through the first target path.

[0118] S202: After the server receives the data packet sent by the client, it can use the private key to decrypt the data packet and verify the validity of the data packet (the data packet can also be called a one-time key). If the verification is successful, the server can generate a temporary key and encrypt the temporary key using the private key. In addition, the server can determine the congestion status value of each candidate path between the client and the server based on the third network status parameter value of each network node obtained, and based on the congestion status value, select the second target path from each candidate path, and send the encrypted temporary key to the client through the second target path.

[0119] S203: After receiving the encrypted temporary key, the client can use the public key to decrypt the temporary key and use the temporary key to encrypt communication data to ensure the security of data transmission, and try to establish an actual service connection with the server based on the encrypted communication data.

[0120] For ease of understanding, the service connection establishment process provided by the present application is explained below through a specific embodiment. Figure 3 , Figure 3 A schematic diagram of a third service connection establishment process provided in some embodiments of the present application is shown, and the process includes the following steps:

[0121] S300: The server generates a pair of public and private keys, sends the public key to all legal clients, and stores the private key locally on the server. In addition, each network node including the server and all legal clients can share their respective network status parameter values ​​with each other in real time.

[0122] S301: When any client wants to establish a service connection with a server, it can first determine the congestion status value of each candidate path between the client and the server based on the first network status parameter value of each network node obtained, and select any candidate path whose congestion status value is less than the determined congestion threshold as the first target path. In addition, the client can generate a data packet including a timestamp, a client identifier, a random number, and the first network status parameter value of each network node obtained by the client.

[0123] S302: The client encrypts the data packet to be verified using the public key received from the server, and sends the encrypted data packet to be verified to the server through the first target path.

[0124] S303: After receiving the data packet sent by the client, the server can use the private key to decrypt the data packet and verify the validity of the data packet. If the verification is successful, the server can generate a temporary key and encrypt the temporary key using the private key. In addition, the server can determine the congestion status value of each candidate path between the client and the client based on the third network status parameter value of each network node obtained, and select any candidate path whose congestion status value is less than the determined congestion threshold as the second target path.

[0125] S304: The server sends the encrypted temporary key to the client via the second target path.

[0126] S305: After receiving the encrypted temporary key, the client can use the public key to decrypt the temporary key and use the temporary key to encrypt communication data to ensure the security of data transmission. Based on the encrypted communication data, the client attempts to establish an actual service connection with the server.

[0127] For ease of understanding, the service connection establishment process provided by the present application is explained below through a specific embodiment. Figure 4 , Figure 4 A schematic diagram of a fourth service connection establishment process provided in some embodiments of the present application is shown, and the process includes the following steps:

[0128] S400: The server generates a pair of public and private keys, sends the public key to all legal clients, and stores the private key locally on the server. In addition, each network node including the server and all legal clients can share their respective network status parameter values ​​with each other in real time.

[0129] S401: When any client wants to establish a service connection with a server, it can first determine the congestion status value of each candidate path between the client and the server based on the first network status parameter value of each network node obtained. In addition, the client can also calculate the abnormal status value of each candidate path based on the difference between the second network status parameter value of the candidate path and the corresponding historical network status parameter value for each candidate path; select the first target path from the candidate paths whose congestion status value is less than the determined congestion threshold and whose abnormal status value is less than the preset abnormal threshold. In addition, the client can generate a data packet containing a timestamp, a client identifier, a random number, and the first network status parameter value of each network node obtained by the client.

[0130] S402: The client encrypts the data packet to be verified using the public key received from the server, and sends the encrypted data packet to be verified to the server through the first target path.

[0131] S403: After receiving the data packet sent by the client, the server can use the private key to decrypt the data packet and verify the validity of the data packet. If the verification is successful, the server can generate a temporary key and encrypt the temporary key using the private key. In addition, the server can determine the congestion status value of each candidate path between the client and the client based on the third network status parameter value of each network node obtained, and select any candidate path whose congestion status value is less than the determined congestion threshold as the second target path.

[0132] S404: The server sends the encrypted temporary key to the client via the second target path.

[0133] S405: After receiving the encrypted temporary key, the client can use the public key to decrypt the temporary key and use the temporary key to encrypt communication data to ensure the security of data transmission. Based on the encrypted communication data, the client attempts to establish an actual service connection with the server.

[0134] For ease of understanding, the service connection establishment process provided by the present application is explained below through a specific embodiment. Figure 5 , Figure 5 A schematic diagram of a fifth service connection establishment process provided by some embodiments of the present application is shown, and the process includes the following steps:

[0135] S500: The server generates a pair of public and private keys, sends the public key to all legal clients, and stores the private key locally on the server. In addition, each network node including the server and all legal clients can share their respective network status parameter values ​​with each other in real time.

[0136] S501: When any client wants to establish a service connection with a server, it can first determine the congestion status value of each candidate path between the client and the server based on the first network status parameter value of each network node obtained. In addition, the client can also calculate the abnormal status value of each candidate path based on the difference between the second network status parameter value of the candidate path and the corresponding historical network status parameter value for each candidate path; select the first target path from the candidate paths whose congestion status value is less than the determined congestion threshold and whose abnormal status value is less than the preset abnormal threshold. In addition, the client can generate a data packet containing a timestamp, a client identifier, a random number, and the first network status parameter value of each network node obtained by the client.

[0137] S502: The client encrypts the data packet to be verified using the public key received from the server, and sends the encrypted data packet to be verified to the server through the first target path.

[0138] S503: After the server receives the data packet sent by the client, it can use the private key to decrypt the data packet and verify the validity of the data packet. If the verification is successful, the server can generate a temporary key and encrypt the temporary key using the private key. In addition, the server can determine the congestion state value of each candidate path between the client and the client based on the third network status parameter value of each network node obtained, and for each candidate path, calculate the abnormal state value of the candidate path based on the difference between the fourth network status parameter value of the candidate path and the corresponding historical network status parameter value; select the second target path from the candidate paths whose congestion state value is less than the determined congestion threshold and whose abnormal state value is less than the preset abnormal threshold.

[0139] S504: The server sends the encrypted temporary key to the client via the second target path.

[0140] S505: After receiving the encrypted temporary key, the client can use the public key to decrypt the temporary key and use the temporary key to encrypt communication data to ensure the security of data transmission. Based on the encrypted communication data, the client attempts to establish an actual service connection with the server.

[0141] For ease of understanding, the service connection establishment process provided by the present application is explained below through a specific embodiment. Figure 6 , Figure 6 A schematic diagram of a sixth service connection establishment process provided in some embodiments of the present application is shown, and the process includes the following steps:

[0142] S600: The server generates a pair of public and private keys, sends the public key to all legal clients, and stores the private key locally on the server. In addition, each network node including the server and all legal clients can share their respective network status parameter values ​​with each other in real time.

[0143] S601: When any client wants to establish a service connection with a server, it can first determine the congestion status value of each candidate path between the client and the server based on the first network status parameter value of each network node obtained, and select the candidate path with the smallest congestion status value as the first target path. In addition, the client can generate a data packet including a timestamp, a client identifier, a random number, and the first network status parameter value of each network node obtained by the client.

[0144] S602: The client encrypts the data packet to be verified using the public key received from the server, and sends the encrypted data packet to be verified to the server through the first target path.

[0145] S603: After the server receives the data packet sent by the client, it can use the private key to decrypt the data packet and verify the validity of the data packet. For example, the first network status parameter value in the data packet can be compared with the corresponding network status parameter value obtained by the server from each network node to see if it matches, and the verification result of the data packet can be determined based on the comparison result. If the verification passes (the verification result is passed), the server can generate a temporary key and encrypt the temporary key using the private key. In addition, the server can determine the congestion state value of each candidate path between the client and the client based on the third network status parameter value of each network node obtained, and for each candidate path, calculate the abnormal state value of the candidate path based on the difference between the fourth network status parameter value of the candidate path and the corresponding historical network status parameter value; select the second target path from the candidate paths whose congestion state value is less than the determined congestion threshold and whose abnormal state value is less than the preset abnormal threshold.

[0146] S604: The server sends the encrypted temporary key to the client via the second target path.

[0147] S605: After receiving the encrypted temporary key, the client can use the public key to decrypt the temporary key and use the temporary key to encrypt communication data to ensure the security of data transmission. Based on the encrypted communication data, the client attempts to establish an actual service connection with the server.

[0148] Embodiment 2:

[0149] Based on the same technical concept, this application provides a service connection establishment method, which is applied to the server, see Figure 7 , Figure 7 A schematic diagram of a seventh service connection establishment process provided in some embodiments of the present application is shown, and the process includes the following steps:

[0150] S701: The server receives a data packet to be verified sent by the client based on a first target path, and verifies the data packet; wherein, the first target path is a path selected from each candidate path based on the congestion status value determined by the client based on the current first network status parameter value of each network node and the acquired congestion status value of each candidate path between the client and the server.

[0151] S702: If the data packet is verified successfully, the server sends the encrypted temporary key to the client, so that the client establishes a connection with the server based on the temporary key.

[0152] In a possible implementation manner, if the data packet is verified to be successful, before sending the encrypted temporary key to the client, the method further includes:

[0153] Determine a congestion status value of each candidate path between the client and the client based on the acquired third network status parameter value of each network node; select a second target path from each candidate path based on the congestion status value;

[0154] The step of sending the encrypted temporary key to the client comprises:

[0155] Based on the second target path, the encrypted temporary key is sent to the client.

[0156] In a possible implementation manner, selecting the second target path from each candidate path based on the congestion state value includes:

[0157] Based on the congestion state value and the abnormal state value of each candidate path, a second target path is selected from the candidate paths; wherein, for each candidate path, the abnormal state value of the candidate path is obtained based on the difference between the fourth network status parameter value of the candidate path and the corresponding historical network status parameter value.

[0158] In a possible implementation manner, the verifying the data packet includes:

[0159] If the data packet contains the first network status parameter value of each network node, compare the first network status parameter value in the data packet with the corresponding network status parameter value obtained by the server from each network node to see whether they match, and determine the verification result of the data packet based on the comparison result.

[0160] Embodiment 3:

[0161] Based on the same technical concept, the present application provides a service connection establishment device, which is applied to a client, see Figure 8 , Figure 8 A schematic diagram of a first connection establishment device provided in some embodiments of the present application is shown, wherein the device comprises:

[0162] The first selection module 801 is used to determine the congestion status value of each candidate path between the server and the server based on the first network status parameter value of each network node obtained; based on the congestion status value, select a first target path from each candidate path;

[0163] A first sending module 802 is used to send the data packet to be verified to the server based on the first target path, so that the server verifies the data packet, and the server sends the encrypted temporary key to the client after the data packet is verified;

[0164] The first receiving module 803 is used to receive the encrypted temporary key and establish a service connection with the server based on the temporary key.

[0165] In a possible implementation manner, the first selection module 801 is specifically configured to:

[0166] Any candidate path whose congestion status value is less than the determined congestion threshold is selected as the first target path.

[0167] In a possible implementation manner, the first selection module 801 is specifically configured to:

[0168] Determine an average value of the congestion status values ​​of the candidate paths;

[0169] Based on the average value, the congestion threshold is determined.

[0170] In a possible implementation manner, the first selection module 801 is specifically configured to:

[0171] Based on the congestion state value and the abnormal state value of each candidate path, a first target path is selected from the candidate paths; wherein, for each candidate path, the abnormal state value of the candidate path is obtained based on the difference between the second network status parameter value of the candidate path and the corresponding historical network status parameter value.

[0172] In a possible implementation manner, the first selection module 801 is specifically configured to:

[0173] The first target path is selected from candidate paths whose congestion state values ​​are smaller than a determined congestion threshold and whose abnormal state values ​​are smaller than a preset abnormal threshold.

[0174] In a possible implementation manner, the data packet includes the first network status parameter value.

[0175] Embodiment 4:

[0176] Based on the same technical concept, the present application provides a service connection establishment device, see Fig. 9 , Fig. 9 A schematic diagram of a second connection establishment device provided in some embodiments of the present application is shown, wherein the device is applied to a server, and the device includes:

[0177] The second receiving module 901 is used to receive a data packet to be verified sent by the client based on the first target path, and verify the data packet; wherein the first target path is a path selected from each candidate path based on the congestion state value of each candidate path between the client and the server determined by the client based on the current first network status parameter value of each network node obtained;

[0178] The second sending module 902 is used to send the encrypted temporary key to the client if the data packet is verified successfully, so that the client can establish a connection with the server based on the temporary key.

[0179] In a possible implementation, the device further includes:

[0180] The second selection module 903 is used to determine the congestion status value of each candidate path between the client and the client based on the third network status parameter value of each network node obtained; based on the congestion status value, select a second target path from each candidate path;

[0181] Based on the second target path, the encrypted temporary key is sent to the client.

[0182] In a possible implementation manner, the second selection module 903 is specifically configured to:

[0183] Based on the congestion state value and the abnormal state value of each candidate path, a second target path is selected from the candidate paths; wherein, for each candidate path, the abnormal state value of the candidate path is obtained based on the difference between the fourth network status parameter value of the candidate path and the corresponding historical network status parameter value.

[0184] In a possible implementation manner, the second receiving module 901 is specifically configured to:

[0185] If the data packet contains the first network status parameter value of each network node, compare the first network status parameter value in the data packet with the corresponding network status parameter value obtained by the server from each network node to see whether they match, and determine the verification result of the data packet based on the comparison result.

[0186] Embodiment 5:

[0187] Based on the same technical concept, the present application also provides a service connection establishment system. Fig.10 A schematic diagram of a service connection establishment system structure provided by some embodiments of the present application is shown. Fig.10 As shown, the system includes a client 1001 and a server 1002 .

[0188] The service connection establishment device in the above-mentioned embodiment 3 is applied to the client 1001. The specific description of the client can be found in the introduction of the above-mentioned embodiment, which will not be repeated here.

[0189] The service connection establishment device in the above-mentioned embodiment 4 is applied to the server 1002. The specific description of the server can be found in the introduction of the above-mentioned embodiment, which will not be repeated here.

[0190] Since the network status parameter values ​​can be shared between the network nodes in the present application, the client and the server can determine the congestion status value of each candidate path for transmitting information based on the obtained network status parameter values ​​of each network node. From a global perspective, based on the congestion status values ​​of each candidate path, the target path can be intelligently selected from each candidate path, and information can be transmitted based on the target path, which can improve the sending (transmission) efficiency. Based on this, the efficiency of SPA identification and authentication can be improved, and the efficiency of establishing a connection between the client and the server can be improved.

[0191] In addition, the present application intelligently selects the target path for transmitting information between the client and the server from each candidate path based on the congestion status value of each candidate path, which can not only improve the transmission efficiency, but also achieve balanced distribution of transmission traffic between the candidate paths, avoid the situation where some paths are overloaded while some paths are too idle, reduce network congestion, and improve transmission stability.

[0192] Embodiment 6:

[0193] Based on the same technical concept, the present application also provides an electronic device, Fig.11 A schematic diagram of the structure of an electronic device provided by some embodiments of the present application is shown. Fig.11As shown, the electronic device includes: a processor 1101, a communication interface 1102, a memory 1103 and a communication bus 1104, wherein the processor 1101, the communication interface 1102, and the memory 1103 communicate with each other through the communication bus 1104;

[0194] The memory 1103 stores a computer program, and when the program is executed by the processor 1101, the processor 1101 executes the steps of any of the above methods.

[0195] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0196] The communication interface 1102 is used for communication between the above electronic device and other devices.

[0197] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0198] The above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor (Network Processor, NP), etc.; it can also be a digital signal processing processor (Digital Signal Processing, DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0199] Embodiment 6:

[0200] Based on the same technical concept, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program that can be executed by an electronic device. When the program runs on the electronic device, the electronic device implements the steps of any of the above methods when executed.

[0201] The above-mentioned computer-readable storage medium can be any available medium or data storage device that can be accessed by the processor in the electronic device, including but not limited to magnetic storage such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc., optical storage such as CD, DVD, BD, HVD, etc., and semiconductor storage such as ROM, EPROM, EEPROM, non-volatile memory (NANDFLASH), solid-state drive (SSD), etc.

[0202] Based on the same technical concept, the present application provides a computer program product, which includes: computer program code, when the computer program code runs on a computer, the computer implements the method described in any method embodiment applied to an electronic device.

[0203] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof, and all or part of the embodiments may be implemented in the form of a computer program product. The computer program product includes one or more computer instructions, and when the computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated.

[0204] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0205] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0206] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0207] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0208] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for establishing a service connection, characterized in that: The method is applied to a client, and the method comprises: Determine the congestion status value of each candidate path between the server and the server based on the first network status parameter value obtained for each network node; and select a first target path from each candidate path based on the congestion status value; Based on the first target path, the data packet to be verified is sent to the server, so that the server verifies the data packet, and the server sends the encrypted temporary key to the client after the data packet is verified; The encrypted temporary key is received, and a service connection is established with the server based on the temporary key.

2. The method according to claim 1, characterized in that The selecting a first target path from each candidate path based on the congestion state value includes: Any candidate path whose congestion status value is less than the determined congestion threshold is selected as the first target path.

3. The method according to claim 2, characterized in that The process of determining the congestion threshold includes: Determine an average value of the congestion status values ​​of the candidate paths; Based on the average value, the congestion threshold is determined.

4. The method according to any one of claims 1 to 3, characterized in that: The selecting a first target path from each candidate path based on the congestion state value includes: Based on the congestion state value and the abnormal state value of each candidate path, a first target path is selected from the candidate paths; wherein, for each candidate path, the abnormal state value of the candidate path is obtained based on the difference between the second network status parameter value of the candidate path and the corresponding historical network status parameter value.

5. The method according to claim 4, characterized in that The selecting a first target path from the candidate paths based on the congestion state value and the abnormal state value of each candidate path includes: The first target path is selected from candidate paths whose congestion state values ​​are smaller than a determined congestion threshold and whose abnormal state values ​​are smaller than a preset abnormal threshold.

6. The method according to claim 1, characterized in that The data packet includes the first network status parameter value.

7. A method for establishing a service connection, characterized in that: The method is applied to the server, and the method includes: Receiving a data packet to be verified sent by the client based on a first target path, and verifying the data packet; wherein the first target path is a path selected from each candidate path based on the congestion status value of each candidate path between the client and the server determined by the client based on the current first network status parameter value of each network node obtained; If the data packet is verified successfully, the encrypted temporary key is sent to the client, so that the client establishes a connection with the server based on the temporary key.

8. The method according to claim 7, characterized in that If the data packet is verified to be successful, before sending the encrypted temporary key to the client, the method further includes: Determine a congestion status value of each candidate path between the client and the client based on the acquired third network status parameter value of each network node; select a second target path from each candidate path based on the congestion status value; The step of sending the encrypted temporary key to the client comprises: Based on the second target path, the encrypted temporary key is sent to the client.

9. The method according to claim 8, characterized in that The selecting a second target path from each candidate path based on the congestion status value includes: Based on the congestion state value and the abnormal state value of each candidate path, a second target path is selected from the candidate paths; wherein, for each candidate path, the abnormal state value of the candidate path is obtained based on the difference between the fourth network status parameter value of the candidate path and the corresponding historical network status parameter value.

10. The method according to any one of claims 7 to 9, characterized in that: The verifying the data packet includes: If the data packet contains the first network status parameter value of each network node, compare the first network status parameter value in the data packet with the corresponding network status parameter value obtained by the server from each network node to see whether they match, and determine the verification result of the data packet based on the comparison result.

11. An electronic device, characterized in that: The electronic device includes at least a processor and a memory, and the processor is used to implement the steps of the method as described in any one of claims 1 to 6 when executing a computer program stored in the memory; or, is used to implement the steps of the method as described in any one of claims 7 to 10 when executing a computer program stored in the memory.

Images