A service connection establishment method, apparatus, equipment and medium

Abstract

This application provides a service connection establishment method, apparatus, device, and medium to improve the efficiency of establishing service connections between a server and a client, and to improve the efficiency of Single Packet Authorization (SPA) authentication. In this method, the client can determine the congestion status value of each candidate path between itself and the server based on the first network status parameter values ​​of each network node; based on the congestion status value, a first target path is selected from the candidate paths; based on the first target path, the data packet to be verified is quickly and efficiently sent to the server; the server can verify the data packet, and after successful verification, sends an encrypted temporary key to the client; the client can receive the encrypted temporary key and establish a service connection with the server based on the temporary key. Therefore, the efficiency of SPA authentication and the efficiency of establishing connections between the client and the server can be improved.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a service connection establishment method, apparatus, device and medium. Background Technology

[0002] Single Packet Authorization (SPA) is a lightweight security protocol that allows the server to authenticate the client before a service connection is established. SPA technology can prevent unauthorized clients from establishing service connections with the server, thereby identifying and blocking attackers' connection requests before a service connection is established.

[0003] However, in the process of SPA-related authentication, there is currently no good solution on how to improve the efficiency of establishing service connections between the server and legitimate clients and improve authentication efficiency. Summary of the Invention

[0004] This application provides a service connection establishment method, apparatus, device, and medium to improve the efficiency of establishing service connections between the server and the client, and to improve the efficiency of SPA authentication.

[0005] Firstly, this application provides a service connection establishment method, which is applied to a client and includes:

[0006] Based on the first network status parameter values ​​of each network node obtained, the congestion status value of each candidate path between the server and the server is determined; based on the congestion status value, the first target path is selected from each candidate path.

[0007] Based on the first target path, the data packet to be verified is sent to the server, so that the server can verify the data packet, and after the server verifies the data packet, it sends the encrypted temporary key to the client.

[0008] Receive the encrypted temporary key and establish a service connection with the server based on the temporary key.

[0009] In one possible implementation, selecting a first target path from candidate paths based on the congestion state value includes:

[0010] Any candidate path whose congestion status value is less than a determined congestion threshold is selected as the first target path.

[0011] In one possible implementation, the process of determining the congestion threshold includes:

[0012] Determine the average congestion status value of each candidate path;

[0013] The congestion threshold is determined based on the average value.

[0014] In one possible implementation, selecting a first target path from candidate paths based on the congestion state value includes:

[0015] Based on the congestion status value and abnormal status value of each candidate path, a first target path is selected from the candidate paths; wherein, for each candidate path, the abnormal status value of the candidate path is obtained based on the difference between the second network status parameter value of the candidate path and the corresponding historical network status parameter value.

[0016] In one possible implementation, selecting a first target path from the candidate paths based on the congestion status value and abnormal status value of each candidate path includes:

[0017] The first target path is selected from candidate paths whose congestion status value is less than a determined congestion threshold and whose abnormal status value is less than a preset abnormal threshold.

[0018] In one possible implementation, the data packet contains the first network condition parameter value.

[0019] Secondly, this application provides a service connection establishment method, which is applied to a server and includes:

[0020] The system receives a data packet to be verified sent by the client based on a first target path, and verifies the data packet; wherein, the first target path is a path selected by the client from each candidate path based on the congestion status value of each candidate path between the client and the server, determined by the client based on the first network status parameter value of each network node.

[0021] If the data packet is successfully verified, the encrypted temporary key is sent to the client, enabling the client to establish a connection with the server based on the temporary key.

[0022] In one possible implementation, if the data packet verification passes, before sending the encrypted temporary key to the client, the method further includes:

[0023] Based on the obtained third network status parameter values ​​of each network node, the congestion status value of each candidate path with the client is determined; based on the congestion status value, a second target path is selected from each candidate path.

[0024] Sending the encrypted temporary key to the client includes:

[0025] Based on the second target path, the encrypted temporary key is sent to the client.

[0026] In one possible implementation, selecting a second target path from candidate paths based on the congestion state value includes:

[0027] Based on the congestion status value and abnormal status value of each candidate path, a second target path is selected from the candidate paths; wherein, for each candidate path, the abnormal status value of the candidate path is obtained based on the difference between the fourth network status parameter value of the candidate path and the corresponding historical network status parameter value.

[0028] In one possible implementation, verifying the data packet includes:

[0029] If the data packet contains the first network status parameter value of each network node, compare whether the first network status parameter value in the data packet matches the corresponding network status parameter value obtained by the server from each network node, and determine the verification result of the data packet based on the comparison result.

[0030] Thirdly, this application provides a service connection establishment apparatus, which is applied to a client and includes:

[0031] The first selection module is used to determine the congestion status value of each candidate path between the server and the network node based on the obtained first network status parameter values ​​of each network node; and to select the first target path from each candidate path based on the congestion status value.

[0032] The first sending module is used to send the data packet to be verified to the server based on the first target path, so that the server can verify the data packet and send the encrypted temporary key to the client after the data packet is verified.

[0033] The first receiving module is used to receive the encrypted temporary key and establish a service connection with the server based on the temporary key.

[0034] In one possible implementation, the first selection module is specifically used for:

[0035] Any candidate path whose congestion status value is less than a determined congestion threshold is selected as the first target path.

[0036] In one possible implementation, the first selection module is specifically used for:

[0037] Determine the average congestion status value of each candidate path;

[0038] The congestion threshold is determined based on the average value.

[0039] In one possible implementation, the first selection module is specifically used for:

[0040] Based on the congestion status value and abnormal status value of each candidate path, a first target path is selected from the candidate paths; wherein, for each candidate path, the abnormal status value of the candidate path is obtained based on the difference between the second network status parameter value of the candidate path and the corresponding historical network status parameter value.

[0041] In one possible implementation, the first selection module is specifically used for:

[0042] The first target path is selected from candidate paths whose congestion status value is less than a determined congestion threshold and whose abnormal status value is less than a preset abnormal threshold.

[0043] In one possible implementation, the data packet contains the first network condition parameter value.

[0044] Fourthly, this application provides a service connection establishment apparatus, which is applied to a server and includes:

[0045] The second receiving module is used to receive the data packet to be verified sent by the client based on the first target path, and to verify the data packet; wherein, the first target path is the path selected by the client from each candidate path between the client and the server based on the congestion status value of each candidate path determined by the client based on the first network status parameter value of each network node obtained at the time.

[0046] The second sending module is used to send an encrypted temporary key to the client if the data packet is verified, so that the client can establish a connection with the server based on the temporary key.

[0047] In one possible implementation, the device further includes:

[0048] The second selection module is used to determine the congestion status value of each candidate path between the client and the client based on the obtained third network status parameter values ​​of each network node; and to select a second target path from each candidate path based on the congestion status value.

[0049] Based on the second target path, the encrypted temporary key is sent to the client.

[0050] In one possible implementation, the second selection module is specifically used for:

[0051] Based on the congestion status value and abnormal status value of each candidate path, a second target path is selected from the candidate paths; wherein, for each candidate path, the abnormal status value of the candidate path is obtained based on the difference between the fourth network status parameter value of the candidate path and the corresponding historical network status parameter value.

[0052] In one possible implementation, the second receiving module is specifically used for:

[0053] If the data packet contains the first network status parameter value of each network node, compare whether the first network status parameter value in the data packet matches the corresponding network status parameter value obtained by the server from each network node, and determine the verification result of the data packet based on the comparison result.

[0054] Fifthly, embodiments of this application provide a service connection establishment system, the system including at least the service connection establishment device applied to the client as described in the third aspect, and the service connection establishment device applied to the server as described in the fourth aspect.

[0055] Sixthly, embodiments of this application provide an electronic device, which includes at least a processor and a memory, wherein the processor is configured to execute a computer program stored in the memory to implement the steps of any of the methods described above.

[0056] In a seventh aspect, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of any of the methods described above.

[0057] Eighthly, embodiments of this application provide a computer program product comprising: computer program code, which, when executed on a computer, causes the computer to perform the steps of any of the methods described above.

[0058] In this embodiment, the client can determine the congestion status value of each candidate path between itself and the server based on the first network status parameter values ​​of each network node. Based on the congestion status values, a first target path is selected from the candidate paths. Based on the first target path, the data packet to be verified is sent to the server. The server can verify the data packet and, after successful verification, sends an encrypted temporary key to the client. The client can receive the encrypted temporary key and establish a service connection with the server based on it. Since the network status parameter values ​​can be shared among the network nodes in this embodiment, the client can determine the congestion status value of each candidate path between itself and the server based on the first network status parameter values ​​of each network node. From a global perspective, the client can intelligently select the first target path from the candidate paths based on their congestion status values. When sending the data packet to be verified to the server based on the first target path, the efficiency of sending (transmitting) the data packet to the server can be improved. Therefore, the efficiency of SPA authentication and the efficiency of establishing a connection between the client and the server can be improved.

[0059] In addition, the method of intelligently selecting the target path for transmitting information (traffic) between the client and the server based on the congestion status value of each candidate path in this embodiment can not only improve transmission efficiency, but also achieve balanced distribution of transmission traffic among each candidate path, avoid the situation where some paths are overloaded while some paths are too idle, reduce network congestion, and improve transmission stability. Attached Figure Description

[0060] To more clearly illustrate the implementation methods in the embodiments of this application or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings.

[0061] Figure 1 This illustration shows a schematic diagram of a first service connection establishment process provided by some embodiments of this application;

[0062] Figure 2 This illustration shows a schematic diagram of a second service connection establishment process provided in some embodiments of this application;

[0063] Figure 3 This application provides a schematic diagram of a third service connection establishment process according to some embodiments.

[0064] Figure 4 This application illustrates a schematic diagram of a fourth service connection establishment process provided in some embodiments;

[0065] Figure 5 This application provides a schematic diagram of a fifth service connection establishment process according to some embodiments;

[0066] Figure 6 This application illustrates a sixth service connection establishment process according to some embodiments;

[0067] Figure 7 This paper illustrates a schematic diagram of a seventh service connection establishment process provided in some embodiments of this application;

[0068] Figure 8 A schematic diagram of a first service connection establishment apparatus provided in some embodiments of this application is shown;

[0069] Figure 9 A schematic diagram of a second service connection establishment apparatus provided in some embodiments of this application is shown;

[0070] Figure 10 This application provides a schematic diagram of the structure of a service connection establishment system according to some embodiments;

[0071] Figure 11 The diagram shows a schematic representation of an electronic device structure provided in some embodiments of this application. Detailed Implementation

[0072] To make the objectives, technical solutions, and advantages of this application clearer, a further detailed description of this application will be provided below with reference to the accompanying drawings. Obviously, the embodiments described in this application are merely some embodiments, not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0073] It should be noted that the brief descriptions of terms in this application are only for the convenience of understanding the embodiments described below, and are not intended to limit the embodiments of this application. Unless otherwise stated, these terms should be understood in their ordinary and common meaning.

[0074] The terms "first," "second," "third," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar or related objects or entities, and do not necessarily imply a specific order or sequence, unless otherwise specified. It should be understood that such terms are interchangeable where appropriate.

[0075] The terms “comprising” and “having”, and any variations thereof, are intended to cover but not exclude inclusion, for example, a product or device that includes a range of components is not necessarily limited to all of the components that are clearly listed, but may include other components that are not clearly listed or that are inherent to such product or device.

[0076] The term "module" refers to any known or subsequently developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware and / or software code that is capable of performing the functions associated with that element.

[0077] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0078] To improve the efficiency of establishing service connections between the server and client during SPA-related authentication and verification, this application provides a service connection establishment method, apparatus, device, and medium. In this method, the client can determine the congestion status value of each candidate path between itself and the server based on the first network status parameter values ​​of each network node; based on the congestion status value, a first target path is selected from the candidate paths; based on the first target path, the data packet to be verified is sent to the server; the server can verify the data packet, and after successful verification, sends an encrypted temporary key to the client; the client can receive the encrypted temporary key and establish a service connection with the server based on the temporary key. In this embodiment, network nodes can share network status parameter values. The client can determine the congestion status value of each candidate path with the server based on the first network status parameter values ​​of each network node. From a global perspective, the client can intelligently select the first target path from each candidate path based on the congestion status value of each candidate path. When sending the data packet to be verified to the server based on the first target path, the efficiency of sending (transmitting) the data packet to be verified to the server can be improved. Based on this, the efficiency of SPA authentication and the efficiency of establishing a connection between the client and the server can be improved.

[0079] In addition, since the target path for transmitting information (traffic) between the client and the server can be intelligently selected from the candidate paths based on the congestion status values ​​of each candidate path, it can not only improve transmission efficiency, but also achieve balanced distribution of transmission traffic among the candidate paths, avoid the situation where some paths are overloaded while others are too idle, reduce network congestion, and improve transmission stability.

[0080] Example 1:

[0081] Please see Figure 1 , Figure 1 This illustration shows a first service connection establishment process provided by some embodiments of this application, which includes the following steps:

[0082] S101: Based on the first network status parameter values ​​of each network node obtained, the client determines the congestion status value of each candidate path between itself and the server; based on the congestion status value, it selects the first target path from each candidate path.

[0083] The service connection establishment method provided in this application is applied to a client. The client may be a mobile terminal, PC, or other device.

[0084] In one possible implementation, to improve SPA authentication efficiency, network nodes can share (exchange) their latest real-time network status parameter values ​​(referred to as the first network status parameter value for ease of description). For each network node, the first network status parameter value may include sub-parameter values ​​such as the network node's round-trip time (RTT), packet loss rate, and bandwidth estimate. The process by which each network node acquires the first network status parameter value can employ existing technologies, which will not be elaborated upon here.

[0085] In one possible implementation, to improve SPA authentication efficiency, before any client in a network node wants to establish a connection with the server, it can determine the congestion state value of each candidate path between the client and the server based on the first network status parameter values ​​of each network node obtained. For example, for each network node, the weighted sum of each sub-parameter value and its corresponding weight coefficient in the first network status parameter value of that network node can be determined, and this weighted sum can be used as the congestion state vector (CSV) of that network node. For each candidate path, the congestion state value of that candidate path can be determined based on the congestion state vectors of each network node included in that candidate path.

[0086] For example, the first network condition parameter value of network node i includes round-trip time (RTT). i Packet loss rate (L) i ) and bandwidth estimates (B i Taking the three sub-parameter values, with round-trip delay weighted by α, packet loss rate weighted by β, and bandwidth estimate weighted by γ, as an example, the congestion state vector C of network node i... i It can be: α×RTT i +β×L i +γ×B i In this application, the magnitudes of α, β, and γ are not specifically limited; α, β, and γ can be positive or negative numbers and can be flexibly set according to requirements. For each candidate path, the sum of the congestion state vectors of each network node contained in the candidate path can be determined as the congestion state value of that candidate path. A larger congestion state value is considered to indicate a higher network load and greater congestion for the corresponding candidate path. Conversely, a smaller congestion state value is also considered to indicate a higher network load and greater congestion for the corresponding candidate path; this application does not impose a specific limitation on this. For ease of understanding, this application uses the example of a higher congestion state value indicating a higher network load and greater congestion for the corresponding candidate path to explain the service connection establishment process provided by this application.

[0087] In one possible implementation, to improve the authentication efficiency of an SPA, a first target path for transmitting data packets used for SPA authentication can be selected from among the candidate paths based on their congestion status values. For example, the candidate path with the lowest congestion status value can be selected as the first target path, and the data packets can be transmitted quickly and efficiently based on this first target path, thereby improving the authentication efficiency of the SPA.

[0088] In one possible implementation, to improve the speed of selecting the first target path, when selecting the first target path from among the candidate paths based on the congestion state value, any candidate path whose congestion state value is less than a determined congestion threshold can be selected as the first target path. For example, suppose there are three candidate paths available from a client to a server. One candidate path A is congested, with its congestion state value exceeding the congestion threshold. The remaining two candidate paths, B and C, have congestion state values ​​that do not exceed the congestion threshold. In this case, candidate path B or candidate path C can be selected as the first target path, and the client's data packets can be sent to the server based on candidate path B or candidate path C.

[0089] In one possible implementation, to distribute traffic load and improve transmission efficiency, the data packet to be verified can be configured into multiple sub-data packets, and these sub-data packets can be sent to the server via different paths. For example, multiple candidate paths can be arbitrarily selected from candidate paths whose congestion status value is less than a congestion threshold. These selected candidate paths can be used as first target paths, and the data packet to be verified can be sent to the server based on these first target paths. This application does not specifically limit the number of target paths.

[0090] In one possible implementation, to improve the flexibility and accuracy of the process of selecting the first target path, the congestion threshold can be configured as a value that can be adaptively and dynamically adjusted according to the congestion status of each candidate path. Specifically, the average value of the congestion status of each candidate path can be determined, and the congestion threshold can be determined based on the average value of the congestion status of each candidate path. For example, the average value (C) of the congestion status of each candidate path can be directly determined as the congestion threshold (T). Alternatively, the product (δ×C) of the average value (C) of the congestion status of each candidate path and a set coefficient (δ) can be determined as the congestion threshold; this application does not specifically limit this approach.

[0091] In one possible implementation, in addition to selecting a first target path from candidate paths based on congestion status values, abnormal status values ​​of candidate paths can also be determined. Combining the congestion status values ​​and abnormal status values ​​allows for the quick and accurate selection of the first target path from candidate paths. Specifically, for each candidate path, when determining its abnormal status value, the abnormal status value can be obtained based on the difference between the candidate path's second network condition parameter value and the corresponding historical network condition parameter value.

[0092] For example, taking the second network condition parameter value as including sub-parameter values ​​such as bandwidth estimate, packet loss rate, delay, and network jitter, each sub-parameter value (S) in the second network condition parameter value can be determined separately. tThe difference between the candidate path and the corresponding historical network condition parameter value (H) (referred to as the difference between the sub-parameter values ​​for ease of description) is then used. The weighted sum of the difference between each sub-parameter value and its corresponding weight coefficient is used to determine the abnormal state value of the candidate path. For each network node, the historical network condition parameter value can be the network condition parameter value within a preset historical time period. This application does not specifically limit the historical time period and can flexibly set it according to requirements. This application also does not specifically limit the weight coefficient of each sub-parameter value in the second network condition parameter value and can flexibly set it according to requirements. The process of determining the abnormal state value of the candidate path based on the weighted sum of the difference between each sub-parameter value and its corresponding weight coefficient in the second network condition parameter value is similar to the process described in the above embodiment of determining the congestion state vector of a network node based on the weighted sum of each sub-parameter value and its corresponding weight coefficient in the first network condition parameter value of the network node, and will not be repeated here.

[0093] The higher the abnormal state value of a candidate path, the greater the difference between the candidate path and the corresponding historical data, and the greater the probability that the candidate path is currently abnormal. In one possible implementation, when selecting the first target path from each candidate path based on the congestion state value and abnormal state value of each candidate path, the first target path may be selected from candidate paths whose congestion state value is less than the congestion threshold and whose abnormal state value is less than a preset abnormal threshold.

[0094] For example, any path among the candidate paths whose congestion state value is less than the congestion threshold and whose abnormal state value is less than a preset abnormal threshold can be selected as the first target path. Alternatively, for each candidate path whose congestion state value is less than the congestion threshold and whose abnormal state value is less than the preset abnormal threshold, the sum of the congestion state value and the abnormal state value of each candidate path can be calculated, and the candidate path with the smallest sum can be selected as the first target path. This application does not specifically limit this approach.

[0095] Since the target path for transmitting information (data) can be selected by combining abnormal state values ​​and congestion state values, it can not only improve transmission efficiency, but also detect network anomalies in a timely manner, avoid using abnormal network paths for data transmission, and ensure the stability of data transmission.

[0096] S102: The client sends the data packet to be verified to the server based on the first target path, so that the server can verify the data packet and send the encrypted temporary key to the client after the data packet is verified.

[0097] In one possible implementation, after the client sends the data packet to be verified to the server based on the first destination path, the server can verify the data packet, that is, perform SPA authentication on the client based on the data packet. For example, the data packet may contain information such as a timestamp, client identifier, random number, and first network status parameter values ​​of each network node obtained by the client. The server can verify each piece of information contained in the data packet. The process of the server verifying the timestamp, client identifier, and random number contained in the data packet can employ existing technology, which will not be elaborated here.

[0098] It's worth noting that when a data packet contains the first network status parameter values ​​of each network node obtained by the client, the server, when verifying this information, can compare these values ​​with the corresponding network status parameter values ​​it obtains from each network node. Based on the comparison result, the server determines the verification result of the data packet. For example, if the first network status parameter values ​​of each network node in the data packet match the corresponding values ​​obtained by the server, the client is likely a legitimate client, and the verification result for this information in the data packet can be determined as passed. Otherwise, if the first network status parameter values ​​of each network node in the data packet do not match the corresponding values ​​obtained by the server, the client is highly likely an illegitimate client, and the verification result for this information in the data packet can be determined as failed.

[0099] In one possible implementation, when determining whether the first network status parameter value of each network node in the data packet matches the corresponding network status parameter value obtained by the server from each network node, the two can be considered to match if the deviation between the first network status parameter value of each network node (all network nodes) in the data packet and the corresponding network status parameter value obtained by the server from the corresponding network node is lower than a preset deviation threshold; otherwise, they are considered not to match. Alternatively, the two can be considered to match if the deviation between the first network status parameter values ​​of a preset number of network nodes (a portion of network nodes) in the data packet and the corresponding network status parameter values ​​obtained by the server from the corresponding network node is lower than a preset deviation threshold; otherwise, they are considered not to match. This application does not specifically limit this approach.

[0100] In one possible implementation, the data packet is considered to have passed verification if the verification result of each piece of information in the data packet is successful. Otherwise, if the verification result of any piece of information in the data packet is unsuccessful, the data packet is considered to have failed verification, the client is considered an illegitimate client, and no connection is established with the client.

[0101] In one possible implementation, when the data verification is successful, the client can be considered a legitimate client. The server can generate a temporary key, encrypt the temporary key using the private key, and send the encrypted temporary key to the client.

[0102] In one possible implementation, when the server sends the encrypted temporary key to the client, in order to improve the efficiency of establishing a connection between the client and the server, the server can determine the congestion status value of each candidate path between the server and the client based on the latest third network status parameter value of each network node obtained in real time; from a global perspective, based on the congestion status value of each candidate path, the server can intelligently select a second target path from each candidate path, and then send the encrypted temporary key to the client quickly and efficiently based on the second target path.

[0103] The third network condition parameter value can be the same as or different from the first network condition parameter value; this application does not impose specific limitations on this. The process of determining the congestion state value of candidate paths based on the third network condition parameter value and selecting the second target path based on the congestion state value is similar to the process of determining the congestion state value and selecting the first target path based on the first network condition parameter value described in the above embodiments. Specifically, when the server determines the congestion state value of each candidate path with the client based on the latest third network condition parameter values ​​of each network node obtained in real time, for each network node, the server can determine the weighted sum of each sub-parameter value and its corresponding weight coefficient in the third network condition parameter value of that network node, and use this weighted sum as the congestion state vector (CSV) of that network node. For each candidate path, the congestion state value of that candidate path can be determined based on the sum of the congestion state vectors of each network node included in that candidate path. The server can select a second target path for transmitting the temporary key from among the candidate paths based on the congestion state values ​​of each candidate path. For example, the candidate path with the smallest congestion state value can be selected as the second target path. Based on the second target path, the temporary key can be transmitted quickly and efficiently to improve the efficiency of establishing a connection between the client and the server and improve the authentication efficiency of the SPA.

[0104] In one possible implementation, to improve the speed of selecting the second target path, when the server selects the second target path from each candidate path based on the congestion status value, it may also select any candidate path whose congestion status value is less than a determined congestion threshold as the second target path.

[0105] In one possible implementation, to improve the flexibility and accuracy of the process of selecting the second target path, the congestion threshold can be configured as a value that can be dynamically adjusted adaptively according to the congestion status of each candidate path. Specifically, the average value of the congestion status of each candidate path can be determined, and the congestion threshold can be determined based on the average value of the congestion status of each candidate path. Similar to the process of the client determining the congestion threshold described above, the server can directly determine the congestion threshold as the average value of the congestion status of each candidate path, or it can determine the congestion threshold as the product of the average value (C) of the congestion status of each candidate path and a set coefficient (δ), etc. This application does not specifically limit this.

[0106] In one possible implementation, similar to selecting the first target path, selecting the second target path can also involve combining the congestion status value and abnormal status value of the candidate paths from among them. The process by which the server determines the abnormal status value of a path is similar to the process described in the previous embodiments where the client determines the abnormal status value of a path. Specifically, for each candidate path, the server can determine the abnormal status value of that candidate path based on the difference between the fourth network condition parameter value of the candidate path and the corresponding historical network condition parameter value.

[0107] For example, taking the fourth network condition parameter value as including sub-parameter values ​​such as bandwidth estimate, packet loss rate, latency, and network jitter value, the server can determine the difference between each sub-parameter value and its corresponding historical network condition parameter value (for ease of description, referred to as the difference between the corresponding sub-parameter values). Then, the weighted sum of the difference between each sub-parameter value and the weight coefficient of each sub-parameter value can be determined as the abnormal state value of the candidate path. For each network node, the historical network condition parameter value can be the network condition parameter value of that network node within a preset historical time period. This application does not specifically limit the historical time period and can flexibly set it according to requirements. This application also does not specifically limit the weight coefficient of each sub-parameter value in the fourth network condition parameter value and can flexibly set it according to requirements.

[0108] In one possible implementation, when the server selects a second target path from each candidate path based on the congestion status value and the abnormal status value of each candidate path, it may select the second target path from the candidate paths whose congestion status value is less than the congestion threshold and whose abnormal status value is less than the preset abnormal threshold.

[0109] For example, any path among the candidate paths whose congestion state value is less than the congestion threshold and whose abnormal state value is less than a preset abnormal threshold can be selected as the second target path. Alternatively, for each candidate path whose congestion state value is less than the congestion threshold and whose abnormal state value is less than the preset abnormal threshold, the sum of the congestion state value and the abnormal state value of each candidate path can be calculated, and the candidate path with the smallest sum can be selected as the second target path. This application does not specifically limit this approach.

[0110] S103: The client receives the encrypted temporary key and establishes a connection with the server based on the temporary key.

[0111] In one possible implementation, the client can receive an encrypted temporary key sent by the server. The client can then use its corresponding public key to decrypt the temporary key, obtain the decrypted temporary key, and use this temporary key to encrypt subsequent communication data. Based on this communication data, the client attempts to establish an actual service connection with the server. For example, the client and server can establish an actual service connection through protocols such as Transmission Control Protocol (TCP), which will not be elaborated further here.

[0112] Since network status parameter values ​​can be shared among network nodes in this application, the client can determine the congestion status value of each candidate path between itself and the server based on the first network status parameter values ​​of each network node. From a global perspective, the client can intelligently select the first target path from among the candidate paths based on the congestion status values ​​of each candidate path. When sending the data packet to be verified to the server based on the first target path, the efficiency of sending (transmitting) the data packet to be verified to the server can be improved. Based on this, the efficiency of SPA authentication and the efficiency of establishing a connection between the client and the server can be improved.

[0113] In addition, this application intelligently selects the target path for transmitting information (traffic) between the client and the server based on the congestion status value of each candidate path. This not only improves transmission efficiency but also achieves balanced distribution of transmission traffic among the candidate paths, avoiding situations where some paths are overloaded while others are too idle, thus reducing network congestion and improving transmission stability.

[0114] For ease of understanding, the service connection establishment process provided in this application will be explained below through a specific embodiment. (See reference...) Figure 2 , Figure 2 This illustration shows a second service connection establishment process provided by some embodiments of this application, which includes the following steps:

[0115] S200: The server generates a public and private key pair, sends the public key to all authorized clients, and stores the private key locally on the server. Furthermore, each network node, including the server and all authorized clients, can share (exchange) their respective network status parameter values ​​with each other in real time.

[0116] Each network node can exchange network status parameter values ​​with other network nodes through the information sharing layer configured in itself.

[0117] S201: When any client wants to establish a service connection with the server, it can first determine the congestion status value of each candidate path between the client and the server based on the first network status parameter values ​​of each network node obtained from the client. Based on the congestion status values, it selects the first target path from the candidate paths. In addition, the client can generate a data packet containing a timestamp, a client identifier, a random number, and the first network status parameter values ​​of each network node obtained by the client. The client encrypts the data packet using the public key received from the server and sends the encrypted data packet to be verified to the server through the first target path.

[0118] S202: After receiving the data packet sent by the client, the server can decrypt the data packet using its private key and verify the validity of the data packet (which can also be called a one-time key). If the verification is successful, the server can generate a temporary key and encrypt the temporary key using its private key. Additionally, based on the obtained third network status parameter values ​​of each network node, the server can determine the congestion status value of each candidate path between the server and the client. Based on this congestion status value, the server selects a second target path from the candidate paths and sends the encrypted temporary key to the client through the second target path.

[0119] S203: After receiving the encrypted temporary key, the client can use the public key to decrypt the temporary key and use the temporary key to encrypt the communication data to ensure the security of data transmission. Based on the encrypted communication data, the client attempts to establish an actual service connection with the server.

[0120] To facilitate understanding, the service connection establishment process provided in this application will be explained below through a specific embodiment. (See attached document.) Figure 3 , Figure 3 This application provides a schematic diagram of a third service connection establishment process according to some embodiments, which includes the following steps:

[0121] S300: The server generates a public and private key pair, sends the public key to all authorized clients, and stores the private key locally on the server. Furthermore, each network node, including the server and all authorized clients, can share their respective network status parameter values ​​with each other in real time.

[0122] S301: When any client wants to establish a service connection with the server, it can first determine the congestion status value of each candidate path to the server based on the first network status parameter values ​​of each network node obtained. Any candidate path with a congestion status value less than a determined congestion threshold is selected as the first target path. Additionally, the client can generate a data packet containing a timestamp, a client identifier, a random number, and the first network status parameter values ​​of each network node obtained by the client.

[0123] S302: The client encrypts the data packet to be verified using the public key received from the server, and sends the encrypted data packet to be verified to the server through the first target path.

[0124] S303: After receiving a data packet from the client, the server can decrypt the packet using its private key and verify its validity. If the verification is successful, the server can generate a temporary key and encrypt it using its private key. Additionally, based on the obtained third network status parameter values ​​of each network node, the server can determine the congestion status value of each candidate path between the server and the client, and select any candidate path with a congestion status value less than a determined congestion threshold as the second target path.

[0125] S304: The server sends the encrypted temporary key to the client via the second target path.

[0126] S305: After receiving the encrypted temporary key, the client can use the public key to decrypt the temporary key and use the temporary key to encrypt communication data to ensure the security of data transmission. Based on the encrypted communication data, the client attempts to establish an actual service connection with the server.

[0127] To facilitate understanding, the service connection establishment process provided in this application will be explained below through a specific embodiment. (See attached document.) Figure 4 , Figure 4 This application provides a schematic diagram of a fourth service connection establishment process according to some embodiments, which includes the following steps:

[0128] S400: The server generates a public and private key pair, sends the public key to all authorized clients, and stores the private key locally on the server. Furthermore, each network node, including the server and all authorized clients, can share their respective network status parameter values ​​with each other in real time.

[0129] S401: When any client wants to establish a service connection with the server, it can first determine the congestion status value of each candidate path between the client and the server based on the first network status parameter values ​​of each network node obtained. Additionally, for each candidate path, the client can calculate the abnormal status value of that candidate path based on the difference between the second network status parameter value of that candidate path and the corresponding historical network status parameter value; and select a first target path from candidate paths whose congestion status values ​​are less than a determined congestion threshold and whose abnormal status values ​​are less than a preset abnormal threshold. Furthermore, the client can generate a data packet containing a timestamp, a client identifier, a random number, and the first network status parameter values ​​of each network node obtained by the client.

[0130] S402: The client encrypts the data packet to be verified using the public key received from the server, and sends the encrypted data packet to be verified to the server through the first target path.

[0131] S403: After receiving the data packet sent by the client, the server can decrypt the data packet using its private key and verify its validity. If the verification is successful, the server can generate a temporary key and encrypt it using its private key. Additionally, based on the obtained third network status parameter values ​​of each network node, the server can determine the congestion status value of each candidate path between the server and the client, and select any candidate path with a congestion status value less than a determined congestion threshold as the second target path.

[0132] S404: The server sends the encrypted temporary key to the client via the second target path.

[0133] S405: After receiving the encrypted temporary key, the client can use the public key to decrypt the temporary key and use the temporary key to encrypt communication data to ensure the security of data transmission. Based on the encrypted communication data, the client attempts to establish an actual service connection with the server.

[0134] To facilitate understanding, the service connection establishment process provided in this application will be explained below through a specific embodiment. (See attached document.) Figure 5 , Figure 5 This illustration shows a fifth service connection establishment process provided in some embodiments of this application, which includes the following steps:

[0135] S500: The server generates a public and private key pair, sends the public key to all authorized clients, and stores the private key locally on the server. Furthermore, each network node, including the server and all authorized clients, can share their respective network status parameter values ​​with each other in real time.

[0136] S501: When any client wants to establish a service connection with the server, it can first determine the congestion status value of each candidate path between the client and the server based on the first network status parameter values ​​of each network node obtained. Additionally, for each candidate path, the client can calculate the abnormal status value of that candidate path based on the difference between the second network status parameter value of that candidate path and the corresponding historical network status parameter value; and select a first target path from candidate paths whose congestion status values ​​are less than a determined congestion threshold and whose abnormal status values ​​are less than a preset abnormal threshold. Furthermore, the client can generate a data packet containing a timestamp, a client identifier, a random number, and the first network status parameter values ​​of each network node obtained by the client.

[0137] S502: The client encrypts the data packet to be verified using the public key received from the server, and sends the encrypted data packet to be verified to the server through the first target path.

[0138] S503: After receiving the data packet sent by the client, the server can decrypt the data packet using its private key and verify its validity. If the verification is successful, the server can generate a temporary key and encrypt it using its private key. Additionally, the server can determine the congestion status value of each candidate path between itself and the client based on the obtained third network status parameter values ​​of each network node. For each candidate path, the server calculates its abnormal status value based on the difference between its fourth network status parameter value and the corresponding historical network status parameter value. A second target path is selected from candidate paths whose congestion status values ​​are less than a determined congestion threshold and whose abnormal status values ​​are less than a preset abnormal threshold.

[0139] S504: The server sends the encrypted temporary key to the client via the second target path.

[0140] S505: After receiving the encrypted temporary key, the client can use the public key to decrypt the temporary key and use the temporary key to encrypt communication data to ensure the security of data transmission. Based on the encrypted communication data, the client attempts to establish an actual service connection with the server.

[0141] To facilitate understanding, the service connection establishment process provided in this application will be explained below through a specific embodiment. (See attached document.) Figure 6 , Figure 6 This illustration shows a sixth service connection establishment process provided in some embodiments of this application, which includes the following steps:

[0142] S600: The server generates a public and private key pair, sends the public key to all authorized clients, and stores the private key locally on the server. Furthermore, each network node, including the server and all authorized clients, can share their respective network status parameter values ​​with each other in real time.

[0143] S601: When any client wants to establish a service connection with the server, it can first determine the congestion status value of each candidate path between the client and the server based on the obtained first network status parameter values ​​of each network node, and select the candidate path with the smallest congestion status value as the first target path. Additionally, the client can generate a data packet containing a timestamp, client identifier, random number, and the first network status parameter values ​​of each network node obtained by the client.

[0144] S602: The client encrypts the data packet to be verified using the public key received from the server, and sends the encrypted data packet to be verified to the server through the first target path.

[0145] S603: After receiving the data packet sent by the client, the server can decrypt the data packet using its private key and verify its validity. For example, it can compare the first network condition parameter value in the data packet with the corresponding network condition parameter values ​​obtained by the server from each network node. Based on the comparison result, the server determines the verification result of the data packet. If the verification passes (the verification result is "pass"), the server can generate a temporary key and encrypt the temporary key using its private key. Additionally, the server can determine the congestion status value of each candidate path between itself and the client based on the obtained third network condition parameter values ​​of each network node. For each candidate path, the server calculates the abnormal status value of the candidate path based on the difference between the fourth network condition parameter value and the corresponding historical network condition parameter value. A second target path is selected from candidate paths whose congestion status value is less than a determined congestion threshold and whose abnormal status value is less than a preset abnormal threshold.

[0146] S604: The server sends the encrypted temporary key to the client via the second target path.

[0147] S605: After receiving the encrypted temporary key, the client can use the public key to decrypt the temporary key and use the temporary key to encrypt communication data to ensure the security of data transmission. Based on the encrypted communication data, the client attempts to establish an actual service connection with the server.

[0148] Example 2:

[0149] Based on the same technical concept, this application provides a service connection establishment method, which is applied to the server side. (See attached document.) Figure 7 , Figure 7 This application illustrates a seventh service connection establishment process according to some embodiments, which includes the following steps:

[0150] S701: The server receives a data packet to be verified sent by the client based on the first target path, and verifies the data packet; wherein, the first target path is the path selected by the client from each candidate path based on the congestion status value of each candidate path between the client and the server determined by the client based on the first network status parameter value of each network node.

[0151] S702: If the data packet is verified, the server sends the encrypted temporary key to the client, enabling the client to establish a connection with the server based on the temporary key.

[0152] In one possible implementation, if the data packet verification passes, before sending the encrypted temporary key to the client, the method further includes:

[0153] Based on the obtained third network status parameter values ​​of each network node, the congestion status value of each candidate path with the client is determined; based on the congestion status value, a second target path is selected from each candidate path.

[0154] Sending the encrypted temporary key to the client includes:

[0155] Based on the second target path, the encrypted temporary key is sent to the client.

[0156] In one possible implementation, selecting a second target path from candidate paths based on the congestion state value includes:

[0157] Based on the congestion status value and abnormal status value of each candidate path, a second target path is selected from the candidate paths; wherein, for each candidate path, the abnormal status value of the candidate path is obtained based on the difference between the fourth network status parameter value of the candidate path and the corresponding historical network status parameter value.

[0158] In one possible implementation, verifying the data packet includes:

[0159] If the data packet contains the first network status parameter value of each network node, compare whether the first network status parameter value in the data packet matches the corresponding network status parameter value obtained by the server from each network node, and determine the verification result of the data packet based on the comparison result.

[0160] Example 3:

[0161] Based on the same technical concept, this application provides a service connection establishment apparatus, which is applied to a client. (See attached document.) Figure 8 , Figure 8 The diagram illustrates a first connection establishment apparatus according to some embodiments of this application, the apparatus comprising:

[0162] The first selection module 801 is used to determine the congestion status value of each candidate path between the server and the network node based on the obtained first network status parameter values ​​of each network node; and to select the first target path from each candidate path based on the congestion status value.

[0163] The first sending module 802 is used to send the data packet to be verified to the server based on the first target path, so that the server can verify the data packet, and after the server verifies the data packet, send the encrypted temporary key to the client.

[0164] The first receiving module 803 is used to receive the encrypted temporary key and establish a service connection with the server based on the temporary key.

[0165] In one possible implementation, the first selection module 801 is specifically used for:

[0166] Any candidate path whose congestion status value is less than a determined congestion threshold is selected as the first target path.

[0167] In one possible implementation, the first selection module 801 is specifically used for:

[0168] Determine the average congestion status value of each candidate path;

[0169] The congestion threshold is determined based on the average value.

[0170] In one possible implementation, the first selection module 801 is specifically used for:

[0171] Based on the congestion status value and abnormal status value of each candidate path, a first target path is selected from the candidate paths; wherein, for each candidate path, the abnormal status value of the candidate path is obtained based on the difference between the second network status parameter value of the candidate path and the corresponding historical network status parameter value.

[0172] In one possible implementation, the first selection module 801 is specifically used for:

[0173] The first target path is selected from candidate paths whose congestion status value is less than a determined congestion threshold and whose abnormal status value is less than a preset abnormal threshold.

[0174] In one possible implementation, the data packet contains the first network condition parameter value.

[0175] Example 4:

[0176] Based on the same technical concept, this application provides a service connection establishment apparatus, see reference. Figure 9 , Figure 9 This application provides a schematic diagram of a second connection establishment apparatus according to some embodiments. The apparatus is applied to a server and includes:

[0177] The second receiving module 901 is used to receive the data packet to be verified sent by the client based on the first target path, and to verify the data packet; wherein, the first target path is the path selected by the client from each candidate path based on the congestion status value of each candidate path between the client and the server, which is determined by the client based on the first network status parameter value of each network node.

[0178] The second sending module 902 is used to send an encrypted temporary key to the client if the data packet is verified, so that the client can establish a connection with the server based on the temporary key.

[0179] In one possible implementation, the device further includes:

[0180] The second selection module 903 is used to determine the congestion status value of each candidate path between the client and the client based on the obtained third network status parameter values ​​of each network node; and to select a second target path from each candidate path based on the congestion status value.

[0181] Based on the second target path, the encrypted temporary key is sent to the client.

[0182] In one possible implementation, the second selection module 903 is specifically used for:

[0183] Based on the congestion status value and abnormal status value of each candidate path, a second target path is selected from the candidate paths; wherein, for each candidate path, the abnormal status value of the candidate path is obtained based on the difference between the fourth network status parameter value of the candidate path and the corresponding historical network status parameter value.

[0184] In one possible implementation, the second receiving module 901 is specifically used for:

[0185] If the data packet contains the first network status parameter value of each network node, compare whether the first network status parameter value in the data packet matches the corresponding network status parameter value obtained by the server from each network node, and determine the verification result of the data packet based on the comparison result.

[0186] Example 5:

[0187] Based on the same technical concept, this application also provides a service connection establishment system. Figure 10 The following is a schematic diagram of a service connection establishment system architecture provided by some embodiments of this application, such as... Figure 10 As shown, the system includes a client 1001 and a server 1002.

[0188] In this embodiment, the service connection establishment device is applied to the client 1001. For a detailed description of the client, please refer to the description of the above embodiments, which will not be repeated here.

[0189] The service connection establishment device in Embodiment 4 above is applied to the server 1002. For a detailed description of the server, please refer to the introduction of the above embodiments, which will not be repeated here.

[0190] Since network status parameter values ​​can be shared among network nodes in this application, the client and server can determine the congestion status value of each candidate path for transmitting information based on the obtained network status parameter values ​​of each network node. From a global perspective, based on the congestion status values ​​of each candidate path, the target path is intelligently selected from each candidate path, and information is transmitted based on the target path, which can improve the sending (transmission) efficiency. Based on this, the efficiency of SPA authentication and the efficiency of establishing a connection between the client and the server can be improved.

[0191] In addition, this application intelligently selects the target path for transmitting information between the client and the server based on the congestion status value of each candidate path. This not only improves transmission efficiency but also achieves balanced distribution of transmission traffic among the candidate paths, avoiding situations where some paths are overloaded while others are too idle, thus reducing network congestion and improving transmission stability.

[0192] Example 6:

[0193] Based on the same technical concept, this application also provides an electronic device. Figure 11 The present application provides schematic diagrams of the structure of an electronic device according to some embodiments, such as... Figure 11As shown, the electronic device includes: a processor 1101, a communication interface 1102, a memory 1103, and a communication bus 1104, wherein the processor 1101, the communication interface 1102, and the memory 1103 communicate with each other through the communication bus 1104.

[0194] The memory 1103 stores a computer program, which, when executed by the processor 1101, causes the processor 1101 to perform the steps of any of the above methods.

[0195] The communication bus mentioned in the above electronic devices can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0196] Communication interface 1102 is used for communication between the above-mentioned electronic device and other devices.

[0197] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0198] The processors mentioned above can be general-purpose processors, including central processing units, network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits, field-programmable gate arrays or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0199] Example 6:

[0200] Based on the same technical concept, embodiments of this application provide a computer-readable storage medium storing a computer program executable by an electronic device. When the program is run on the electronic device, it causes the electronic device to perform the steps of any of the above methods.

[0201] The aforementioned computer-readable storage medium can be any available medium or data storage device that can be accessed by the processor in an electronic device, including but not limited to magnetic storage such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), optical storage such as CDs, DVDs, BDs, HVDs, etc., and semiconductor storage such as ROMs, EPROMs, EEPROMs, non-volatile memory (NAND flash), solid-state drives (SSDs), etc.

[0202] Based on the same technical concept, this application provides a computer program product, which includes: computer program code, which, when run on a computer, causes the computer to implement the method described in any of the above-described method embodiments applied to electronic devices.

[0203] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof, or in whole or in part, as a computer program product. The computer program product includes one or more computer instructions, which, when loaded and executed on a computer, generate, in whole or in part, the processes or functions described in the embodiments of this application.

[0204] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0205] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0206] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0207] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0208] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for establishing a service connection, characterized in that, The method is applied to a client, and the method includes: Based on the first network status parameter values ​​of each network node obtained, the congestion status value of each candidate path between the server and the server is determined; based on the congestion status value, the first target path is selected from each candidate path. If there are multiple first target paths, the data packet to be verified is configured into multiple sub-data packets, and the multiple sub-data packets are sent to the server through multiple first target paths, wherein different paths send different sub-data packets; the server verifies the data packet by comparing whether the first network status parameter values ​​of each network node contained in the data packet match the corresponding network status parameter values ​​obtained by the server from each network node, and after the data packet is verified, the server sends an encrypted temporary key to the client; wherein the data packet is the data packet for the client to perform SPA authentication; Receive the encrypted temporary key and establish a service connection with the server based on the temporary key.

2. The method according to claim 1, characterized in that, The step of selecting a first target path from candidate paths based on the congestion state value includes: Any candidate path whose congestion status value is less than a determined congestion threshold is selected as the first target path.

3. The method according to claim 2, characterized in that, The process of determining the congestion threshold includes: Determine the average congestion status value of each candidate path; The congestion threshold is determined based on the average value.

4. The method according to any one of claims 1-3, characterized in that, The step of selecting a first target path from candidate paths based on the congestion state value includes: Based on the congestion status value and abnormal status value of each candidate path, a first target path is selected from the candidate paths; wherein, for each candidate path, the abnormal status value of the candidate path is obtained based on the difference between the second network status parameter value of the candidate path and the corresponding historical network status parameter value.

5. The method according to claim 4, characterized in that, The step of selecting a first target path from the candidate paths based on their congestion and abnormal status values ​​includes: The first target path is selected from candidate paths whose congestion status value is less than a determined congestion threshold and whose abnormal status value is less than a preset abnormal threshold.

6. The method according to claim 1, characterized in that, The data packet contains the value of the first network condition parameter.

7. A service connection establishment method, characterized in that, The method is applied to the server side, and the method includes: Receive a data packet to be verified sent by the client based on a first target path, wherein the data packet is a data packet for SPA authentication by the client; The data packet is verified by comparing whether the first network status parameter values ​​of each network node contained in the data packet match the corresponding network status parameter values ​​obtained by the server from each network node. The first target path is the path selected by the client based on the congestion status value of each candidate path between the client and the server, determined by the client based on the current first network status parameter values ​​of each network node. If there are multiple first target paths, the data packet is configured as multiple sub-data packets, and these sub-data packets are sent to the server through multiple first target paths, with different sub-data packets sent for different paths. If the data packet is successfully verified, the encrypted temporary key is sent to the client, enabling the client to establish a connection with the server based on the temporary key.

8. The method according to claim 7, characterized in that, If the data packet passes verification, before sending the encrypted temporary key to the client, the method further includes: Based on the obtained third network status parameter values ​​of each network node, the congestion status value of each candidate path with the client is determined; based on the congestion status value, a second target path is selected from each candidate path. Sending the encrypted temporary key to the client includes: Based on the second target path, the encrypted temporary key is sent to the client.

9. The method according to claim 8, characterized in that, The step of selecting a second target path from candidate paths based on the congestion state value includes: Based on the congestion status value and abnormal status value of each candidate path, a second target path is selected from the candidate paths; wherein, for each candidate path, the abnormal status value of the candidate path is obtained based on the difference between the fourth network status parameter value of the candidate path and the corresponding historical network status parameter value.

10. The method according to any one of claims 7-9, characterized in that, The verification of the data packet includes: If the data packet contains the first network status parameter value of each network node, compare whether the first network status parameter value in the data packet matches the corresponding network status parameter value obtained by the server from each network node, and determine the verification result of the data packet based on the comparison result.

11. An electronic device, characterized in that, The electronic device includes at least a processor and a memory, wherein the processor is configured to implement the steps of the method as described in any one of claims 1-6 when executing a computer program stored in the memory; or, when executing a computer program stored in the memory, to implement the steps of the method as described in any one of claims 7-10.

Images