Content distribution network erection method based on anonymous communication

Abstract

The invention provides a content distribution network erection method based on anonymous communication, and aims to enhance anonymity and security on the basis of reducing link time delay. The method comprises the following steps: receiving a push-pull stream request of a client for a data stream; determining a transmission path corresponding to the push-pull stream request according to a transmission parameter corresponding to the push-pull stream request; determining an anonymous transmission link between adjacent nodes of the transmission path; the anonymous transmission link is determined after orientation exposure evaluation; and anonymously transmitting transmission data corresponding to the push-pull stream request through the transmission path and an anonymous transmission link between adjacent nodes of the transmission path.

Description

Technical Field

[0001] The present disclosure relates to the technical field of content distribution networks, and in particular to a method for establishing a content distribution network based on anonymous communication. Background Art

[0002] Content Delivery Network (CDN) can effectively improve the access speed and stability of websites, reduce the load pressure of the source site, improve the security of the website, and reduce the cost of the website. However, there is no invention to provide privacy protection for CDN anonymity, so the user's identity information and location may be exposed during the transmission process, especially in scenarios with high privacy requirements such as government, enterprises, institutions and the military.

[0003] Tor (The Onion Router) is a tool and network protocol for anonymous network communications. It is designed to ensure anonymity and privacy in network communications. When using Tor for anonymous communication, on the one hand, the more Tor clients are running, the more users are hidden in more relay nodes, and the Tor network will become faster and more secure; on the other hand, as the number of Tor relays increases, malicious nodes join the Tor network and engage in malicious or even illegal activities based on the anonymity characteristics of the Tor network.

[0004] Therefore, how to enhance anonymity and security while reducing link latency is an issue that needs to be addressed urgently. Summary of the invention

[0005] In order to overcome the problems existing in the related art, the present disclosure provides a method for setting up a content distribution network based on anonymous communication. The technical solution of the present disclosure is as follows: According to a first aspect of an embodiment of the present disclosure, a method for establishing a content distribution network based on anonymous communication is provided, comprising: Receive push and pull stream requests from the client for data streams; Determine a transmission path corresponding to the push-pull stream request according to a transmission parameter corresponding to the push-pull stream request; Determining an anonymous transmission link between adjacent nodes of the transmission path; the anonymous transmission link is determined after azimuth exposure evaluation; The transmission data corresponding to the push-pull stream request is anonymously transmitted through the transmission path and anonymous transmission links between adjacent nodes of the transmission path.

[0006] Optionally, between adjacent nodes of the transmission path, determining an anonymous transmission link includes: Obtaining a relay node list; the relay node list includes multiple relay nodes; Selecting an entry node, an intermediate node and an exit node from the relay node list; the entry node is a relay node carrying an entry label, and the exit node is a relay node carrying an exit label; Based on the azimuth exposure rate of the entry node, performing azimuth exposure evaluation on the entry node to obtain an exposure evaluation result; When the exposure evaluation result is greater than or equal to the exposure rate threshold, and when the number of selections of the entry node is less than or equal to the selection number threshold, discard the entry node, and reselect an entry node from the relay nodes carrying the entry tag in the relay node list to perform azimuth exposure evaluation; When the exposure evaluation result is less than an exposure rate threshold, and / or when the number of selections of the entry node is greater than a selection number threshold, the entry node is retained, and an anonymous transmission link is determined through the entry node, the intermediate node and the exit node.

[0007] Optionally, when the push-pull stream request is a pull stream request and is in the sending request stage, or when the push-pull stream request is a push stream request, anonymously transmitting the transmission data corresponding to the push-pull stream request through the transmission path and an anonymous transmission link between adjacent nodes of the transmission path, including: At a sending end node among adjacent nodes in the transmission path, encrypting the transmission data; the transmission data is a pull stream request content or a pushed data stream; The encrypted transmission data is decrypted and transmitted layer by layer through each hop relay node of the anonymous transmission link until the decrypted transmission data is transmitted to a receiving node in the adjacent nodes of the transmission path at the last hop relay node.

[0008] Optionally, at a sending end node among adjacent nodes in the transmission path, encrypting the transmission data comprises: Determine a relay node corresponding to an anonymous transmission link between adjacent nodes of the transmission path; According to the order of the relay nodes from far to near, the transmission data is encrypted layer by layer using the session keys corresponding to the relay nodes; The encrypted transmission data is decrypted layer by layer and transmitted through each hop relay node of the anonymous transmission link, including: For each relay node in the anonymous transmission link, after receiving the encrypted transmission data transmitted by the previous hop node, the relay node uses its own corresponding session key to perform a layer of decryption on the encrypted transmission data, and transmits the decrypted transmission data to the next hop node; The previous hop node is the sending node or the relay node, and the next hop node is the receiving node or the relay node.

[0009] Optionally, when the push-pull stream request is a pull stream request and is in the request response stage, anonymously transmitting the transmission data corresponding to the push-pull stream request through the transmission path and an anonymous transmission link between adjacent nodes of the transmission path, including: Through each hop relay node of the anonymous transmission link, the transmission data sent by the receiving end node in the adjacent node of the transmission path is encrypted and transmitted layer by layer; Until the last hop relay node transmits the encrypted transmission data to the sending end node in the adjacent node of the transmission path; The sending end node and the receiving end node are determined in the sending request phase of the stream pulling request.

[0010] Optionally, the transmission data sent by the receiving end node in the adjacent node of the transmission path is encrypted layer by layer through each hop relay node of the anonymous transmission link, including: For each relay node in the anonymous transmission link, after receiving the transmission data transmitted by the previous hop node, the transmission data is encrypted by the corresponding session key, and the encrypted transmission data is transmitted to the next hop node; The previous hop node is the receiving node or the relay node, and the next hop node is the sending node or the relay node.

[0011] Optionally, when the push-pull stream request is a push stream request, determining a transmission path corresponding to the push-pull stream request according to a transmission parameter corresponding to the push-pull stream request includes: Determining a first target edge node; Authenticating the data stream based on the first target edge node, and determining the first target central node according to the authentication result, the data stream being the data stream pushed by the push stream request; A first transmission path corresponding to the streaming request is obtained according to the first target edge node and the first target central node.

[0012] Optionally, when the push-pull stream request is a pull stream request, determining a transmission path corresponding to the push-pull stream request according to a transmission parameter corresponding to the push-pull stream request includes: According to the transmission parameters corresponding to the push-pull stream request, determine the transmission protocol and provision method corresponding to the data stream pulled by the pull stream request; the transmission protocol includes a first transmission protocol and a second transmission protocol; the second transmission protocol represents that the data stream is transmitted in the form of slices; the provision method includes source station provision and client push stream provision; According to the transmission protocol and the providing method, a transmission path corresponding to the push-pull stream request is determined.

[0013] Optionally, when the transmission protocol is a first transmission protocol, determining a transmission path corresponding to the push-pull stream request according to the transmission protocol and the providing mode includes: In the case where the providing mode is provided by the source station, determining a second transmission path, the second transmission path including: a second target edge node, a second target parent node, a second target central node and the source station; In the case where the providing mode is client streaming, a third transmission path is determined, and the third transmission path includes: a third target edge node, a third target parent node, and a third target central node.

[0014] Optionally, when the transmission protocol is a second transmission protocol, determining a transmission path corresponding to the push-pull stream request according to the transmission protocol and the providing mode includes: In the case where the providing mode is provided by the source station, determining a transmission protocol for the data stream provided by the source station; In the case where the source station provides the data stream in a second transmission protocol, a fourth transmission path is determined, the fourth transmission path includes a fourth target edge node, a fourth target parent node, a fourth target central node and the source station; the access terminal server of the fourth target central node is used to obtain the data stream from the source station, and transmit the data stream to the gateway of the fourth target central node; In the case where the source station provides the data stream using the first transmission protocol, determining a fifth transmission path, the fifth transmission path including a fifth target edge node, a fifth target parent node, a fifth target central node, and the source station; a gateway of the fifth target central node is used to obtain the data stream from the source station and slice the data stream; When the provision method is client streaming, a sixth transmission path is determined, and the sixth transmission path includes a sixth target edge node, a sixth target parent node and a sixth target central node; the gateway of the sixth target central node is used to slice the data stream.

[0015] According to a second aspect of an embodiment of the present disclosure, there is provided a device for establishing a content distribution network based on anonymous communication, comprising: A receiving module, used for receiving push and pull stream requests from the client for data streams; A first determining module, configured to determine a transmission path corresponding to the push-pull stream request according to a transmission parameter corresponding to the push-pull stream request; A second determination module is used to determine an anonymous transmission link between adjacent nodes of the transmission path; the anonymous transmission link is determined after azimuth exposure evaluation; The transmission module is used to anonymously transmit the transmission data corresponding to the push-pull stream request through the transmission path and the anonymous transmission link between the adjacent nodes of the transmission path.

[0016] According to a third aspect of an embodiment of the present disclosure, an electronic device is provided, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the computer program is executed by the processor, the steps of the method for establishing a content distribution network based on anonymous communication as described in the first aspect are implemented.

[0017] According to a fourth aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method for establishing a content distribution network based on anonymous communication as described in the first aspect are implemented.

[0018] According to a fifth aspect of an embodiment of the present disclosure, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps of the method for establishing a content distribution network based on anonymous communication described in the first aspect are implemented.

[0019] The present disclosure introduces anonymous transmission links into the CDN architecture. This method can effectively hide the user's identity information and location information, especially in scenarios with high privacy requirements. It not only improves the performance of the CDN, but also provides users with a safer access experience. According to the transmission parameters of the push and pull stream requests, the optimal transmission path is determined, and an anonymous transmission link is established between adjacent nodes based on the link selection mechanism of the azimuth exposure evaluation. This can effectively avoid malicious nodes, reduce the risk of privacy leakage and attacks, and thus improve the security of the overall communication. Under the premise of ensuring anonymity and security, it can effectively reduce link delay and improve the efficiency of data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings required for use in the description of the embodiments of the present disclosure will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1It is a schematic diagram of the steps of a method for setting up a content distribution network based on anonymous communication shown in an embodiment of the present disclosure; Figure 2 is a schematic diagram of a flow-pushing installation shown in an embodiment of the present disclosure; Figure 3 It is a schematic diagram of a flow pulling installation shown in an embodiment of the present disclosure; Figure 4 is another schematic diagram of a flow-pulling installation shown in an embodiment of the present disclosure; Figure 5 It is a schematic diagram of an overall installation shown in an embodiment of the present disclosure; Figure 6 is a schematic diagram of an adaptive link selection process based on exposure rate shown in an embodiment of the present disclosure; Figure 7 is a schematic diagram of an internal data transmission process between adjacent nodes of a transmission path shown in an embodiment of the present disclosure; Figure 8 It is a block diagram of a device for setting up a content distribution network based on anonymous communication shown in an embodiment of the present disclosure; Fig. 9 It is a schematic diagram of an electronic device shown in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0022] The following will be combined with the drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, rather than all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0023] The terms "first", "second", etc. in the specification and claims of the present disclosure are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable when appropriate, so that the embodiments of the present disclosure can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally of the same type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0024] For ease of understanding, the professional terms involved in the present disclosure are first explained.

[0025] CDN: CDN makes full use of multiple servers in physical space to store various resources required by users in a distributed manner, so that users can obtain the required resources nearby and stably. It solves the distance and bandwidth problems caused by a large number of users accessing remote resources, allowing users to download from the CDN server closest to them, reducing the number of routing times, increasing download speed, and shortening transmission time to improve user experience.

[0026] Tor: It consists of a directory server, an onion router (OR), and an onion proxy (OP). Users can communicate anonymously on the Internet through Tor.

[0027] OR: It is a layered encryption service, also known as an "expandable entry-type subnet router", which allows users to protect their network data in terms of anonymity and privacy.

[0028] OP: A Tor user runs an OP on his / her local machine. The OP periodically communicates with other Tors, thus forming a virtual circuit in the Tor network.

[0029] The CDN process is as follows: (1) When a user requests resources from a CDN, the CDN node will comprehensively consider factors such as the geographic location and network where the request is sent, and select the node closest to the user to improve resource access efficiency.

[0030] (2) Upon receiving a request, the CDN node first checks whether it has the resources required by the user. If so, it returns the resources to the user directly. Otherwise, it continues to request the upper-level source server.

[0031] (3) When the CDN node requests resources from the origin station, the origin station will transfer the resources to the CDN node. When the CDN node receives the resources returned by the origin station, it will cache the resources on its own server and return the resources to the user.

[0032] (4) When the resources of the source site change, CDN will automatically update the resources in the cache to ensure that users obtain the latest resources.

[0033] Therefore, CDN can effectively improve the access speed and stability of websites, reduce the load pressure of the source station, improve the security of websites, and reduce the cost of websites. However, there is no invention to protect the privacy of CDN anonymity. In industries such as military, government, and finance that have extremely high requirements for anonymity, it is necessary to pay attention not only to the improvement of access speed, but also to the anonymity of privacy protection.

[0034] There is currently an anonymous communication system called Tor that allows users to communicate anonymously on the Internet. Tor was originally used for military purposes and was designed to ensure anonymity and privacy in network communications. Tor has been favored by many users and researchers in the field of anonymous communications due to its low latency, directory services, and simple configuration. It is a tool and network protocol for anonymous network communications. It hides the user's real identity and location information by adding the current node to the Tor network and establishing multiple layers of encryption and tunnel routing during the transmission process. The user's communication traffic will pass through multiple relays and be randomly routed in them, making it more difficult to track the user's source and destination, thereby achieving anonymity.

[0035] In industries such as military, government, and finance that require high anonymity, Tor is a safe and convenient solution.

[0036] However, as the number of Tor relays increases, malicious nodes join the Tor network and engage in malicious or even illegal activities based on the anonymity of the Tor network. Therefore, there will be certain problems in building CDN on the Tor network.

[0037] In order to solve the above technical problems, the present disclosure proposes a method for establishing a content distribution network based on anonymous communication, which can enhance anonymity and security while reducing link delay.

[0038] In order to achieve anonymous transmission of the CDN system, the CDN system needs to be built on the Tor network. The nodes of the entire CDN system are divided into three categories: edge nodes, parent nodes (zone) and center nodes (nation).

[0039] As the entry point for interacting with the client, the edge node undertakes the authentication and matching functions on the entire link.

[0040] The parent node is used to relieve the pressure on the central machine under a large number of requests and improve the distribution capability.

[0041] The central node is used for complex task processing. Its specific functions are as follows: 1. Media processing: covers multiple functions such as transcoding, recording, screenshots, content review, time-shifted playback and delayed broadcast, and works closely with professional transcoding equipment to ensure high-quality presentation and processing of media content.

[0042] 2. Stream name optimization: Since the user request parameters may not be able to directly implement specific stream processing requirements based on the stream name, especially when it comes to tasks such as transcoding and delayed broadcasting, the central node will intelligently rewrite the stream name to adapt to different processing logic.

[0043] 3. Streaming priority management: When faced with repeated streaming, the central node can automatically overwrite high-priority streams based on preset priority rules to ensure priority transmission of key content.

[0044] 4. HLS slicing service: For HLS protocol streaming requests, if the source station fails to provide ready-made slicing files, the central node will autonomously perform slicing operations to ensure continuous playback and efficient caching of HLS streams. To build CDN into the Tor network, all nodes at all levels and client nodes need to be connected to the Tor network, and the source station should also be connected to the Tor network when necessary. In order to implement the CDN gateway architecture in the Tor network, it is necessary to connect all levels of nodes and client nodes to the Tor network. If necessary, the source station should also be connected to the Tor network to ensure that all nodes in the entire architecture are in the anonymous network to achieve anonymous and secure information transmission.

[0045] Figure 1 This is a schematic diagram of the steps of a method for setting up a content distribution network based on anonymous communication shown in an embodiment of the present disclosure. Figure 1 As shown, the method may specifically include the following steps: Step S11: receiving a push or pull stream request from a client for a data stream.

[0046] The CDN gateway listens for push and pull stream requests from the client on a specified network interface or port. The push and pull stream request contains the data stream information that the user wants to transmit. When receiving the request, the CDN gateway can verify the format and integrity of the request to ensure that it is a valid push and pull stream request. Subsequent operations will be performed only after it is determined to be a valid push and pull stream request. The CDN gateway can be a live CDN gateway.

[0047] Step S12: Determine the transmission path corresponding to the push-pull stream request according to the transmission parameters corresponding to the push-pull stream request.

[0048] Parse the received push and pull stream requests to extract relevant transmission parameters, including data type, transmission rate, delay requirements, etc. Determine the optimal transmission path based on the parsed transmission parameters.

[0049] Step S13: determining an anonymous transmission link between adjacent nodes of the transmission path; the anonymous transmission link is determined after azimuth exposure evaluation.

[0050] A secure anonymous transmission link is established between adjacent nodes of the selected transmission path. Each relay node in the anonymous transmission link can be evaluated for location exposure to calculate the exposure rate of each node and identify potential malicious nodes, thereby ensuring that the selected anonymous transmission link can effectively avoid malicious nodes.

[0051] Step S14: anonymously transmitting the transmission data corresponding to the push-pull stream request through the transmission path and anonymous transmission links between adjacent nodes of the transmission path.

[0052] By establishing anonymous transmission links between adjacent nodes in the transmission path, anonymous transmission of transmission data corresponding to push and pull stream requests can be achieved.

[0053] By adopting the embodiments of the present disclosure, potential malicious nodes can be effectively identified and avoided through azimuth exposure assessment, ensuring the anonymity of data during transmission and protecting user identity information from being leaked. Based on the push and pull stream requests and related transmission parameters of the client, the system can intelligently select the optimal transmission path, improve the efficiency of data transmission, and reduce latency. By establishing anonymous transmission links between adjacent nodes in the transmission path, the system can effectively reduce the risk of user privacy leakage and ensure the security of data during transmission.

[0054] Among them, in an optional embodiment, when the push-pull stream request is a push stream request, the transmission path corresponding to the push-pull stream request is determined according to the transmission parameters corresponding to the push-pull stream request, including: determining a first target edge node; authenticating the data stream based on the first target edge node, and determining a first target central node according to the authentication result, the data stream being the data stream pushed by the push stream request; obtaining a first transmission path corresponding to the push stream request according to the first target edge node and the first target central node.

[0055] First, a push stream request is received from the client, which contains the data stream information and related transmission parameters that the user wants to push. The received push stream request can be parsed to extract necessary parameters, including data stream type, push stream target, bandwidth requirements, etc. The push stream request can be based on the RTMP protocol.

[0056] The transmission path of the push request adopts a two-layer model. The two-layer model means that the transmission of data streams is mainly carried out between two levels: edge nodes and central nodes. Edge nodes are the entrances for direct interaction with clients, while central nodes are responsible for more complex data processing and storage.

[0057] Therefore, the streaming request will be transmitted through the first target central node and the first target edge node.

[0058] A suitable first target edge node can be determined based on the request parameters and the network topology. The node should have sufficient bandwidth and processing power to receive the streaming data. The node status of the first target edge node can be monitored to ensure that the selected edge node is available under the current network status and can effectively process the streaming request from the client.

[0059] On the first target edge node, the pushed data stream is authenticated to ensure that only authorized users can push the stream. Authentication can be achieved in many ways, such as using a username and password, a push key, etc.

[0060] Based on the authentication result, determine whether the push request is authorized. If the authentication fails, the system will reject the push request and feedback the corresponding error information to the client. If the authentication is successful, the system will determine a suitable first target central node based on the status of the first target edge node and network conditions. The first target central node is responsible for processing and distributing these data streams, which may involve operations such as transcoding and storage.

[0061] Based on the determined first target edge node and first target central node, the system constructs the first transmission path corresponding to the push request. The first transmission path will connect the client, edge node and central node to ensure smooth data flow transmission. While constructing the path, the system can optimize the path according to the real-time network status and select a better link to improve transmission efficiency.

[0062] The determined first transmission path information is fed back to the client to inform it of the processing status of the push request and the transmission path of the data stream. After confirming the transmission path, the client can start pushing the data stream to the first target edge node, and then the data stream will be transmitted to the first target central node for subsequent processing.

[0063] In addition, if the central node is configured with active media tasks, for example, a task of triggering transcoding by streaming is set, then after receiving the streaming data, the central node will interact with the transcoding machine. The role of the transcoding machine is to convert the pushed audio and video streams into different formats or resolutions to adapt to different playback requirements and network conditions.

[0064] Figure 2 Schematic diagram of a streaming installation shown in an embodiment of the present disclosure. Figure 2 As shown, the CDN is set up on the Tor network, and the client pushes the data stream to the edge node, which is then forwarded to the central node. After receiving the data stream, the central node interacts with the transcoding machine when the active media task is configured on the central node to process the pushed data stream.

[0065] By adopting the embodiments of the present disclosure, by determining the transmission path according to the transmission parameters of the streaming request, a real-time response to network conditions can be achieved, and the optimal edge node and central node can be selected according to the current network status and load conditions, thereby improving the efficiency and stability of data transmission. After determining the edge node, the data stream is authenticated based on the node, which can effectively prevent unauthorized access and data leakage, thereby improving the security of the entire system. The system is allowed to flexibly adjust the transmission path according to different streaming requests and transmission parameters to adapt to different business needs and network environments. This flexibility enables the system to better serve a variety of scenarios and user needs.

[0066] Among them, in an optional embodiment, when the push-pull stream request is a pull stream request, the transmission path corresponding to the push-pull stream request is determined according to the transmission parameters corresponding to the push-pull stream request, including: according to the transmission parameters corresponding to the push-pull stream request, the transmission protocol and provision method corresponding to the data stream pulled by the pull stream request are determined; the transmission protocol includes a first transmission protocol and a second transmission protocol; the second transmission protocol characterizes that the data stream is transmitted in the form of slices; the provision method includes source station provision and client push stream provision; according to the transmission protocol and the provision method, the transmission path corresponding to the push-pull stream request is determined.

[0067] The client sends a pull request to the CDN gateway, which includes the target stream information and related transmission parameters. The system parses the transmission parameters in the pull request and determines the transmission protocol and provision method.

[0068] The transmission protocol includes a first transmission protocol and a second transmission protocol.

[0069] The first transmission protocol can be flv (Flash Video) or rtmp (Real-Time Messaging Protocol). The flv protocol is suitable for web video on demand and live broadcast. The rtmp protocol is designed for real-time data transmission with low latency.

[0070] The second transmission protocol may be the HLS (HTTP Live Streaming) protocol. The HLS protocol implements streaming media transmission by splitting the entire video stream into a series of small HTTP file fragments. Each fragment describes a short period of time in the video stream, and the client downloads and plays these fragments in sequence to achieve real-time playback of streaming media. Therefore, when the pull stream request is pulled based on the HLS protocol, the data stream is transmitted in the form of fragments.

[0071] The supply methods include source station supply and client push stream supply. If it is provided by the source station, then it is necessary to establish a transmission path to the source station to obtain the target data stream from the source station; if it is provided by the client push stream, then it is necessary to establish a transmission path to the central node, and the intermediate node is the central node corresponding to the client push stream, so as to obtain the target data stream from the intermediate node.

[0072] By adopting the embodiments of the present disclosure, the system can dynamically construct a transmission path according to the transmission protocol and provision method. This dynamic path construction mechanism can respond to network changes in real time, optimize the quality of streaming media transmission, and ensure that users can obtain a good viewing experience in different network environments. By optimizing the transmission path and protocol selection, the system can significantly reduce latency, improve the smoothness of streaming media playback, reduce buffering, and thus enhance the user's overall viewing experience. It can adapt to different streaming media requirements and support a variety of transmission protocols and provision methods, so that the system has good scalability and can be adjusted and optimized as technology develops and user needs change.

[0073] Among them, in an optional embodiment, when the transmission protocol is the first transmission protocol, the transmission path corresponding to the push-pull stream request is determined according to the transmission protocol and the providing method, including: when the providing method is provided by the source station, the second transmission path is determined, and the second transmission path includes: a second target edge node, a second target parent node, a second target central node and the source station; when the providing method is client push streaming providing, a third transmission path is determined, and the third transmission path includes: a third target edge node, a third target parent node and a third target central node.

[0074] The system parses the pull stream request and confirms that the transmission protocol used is the first transmission protocol, such as rtmp or flv. It determines whether the provision method is provided by the source station or the client push stream.

[0075] In the case where the provision mode is provided by the source station, it indicates that the current mode is back-to-source mode, select a suitable second target edge node; determine the second target parent node of the second target edge node, which is responsible for coordinating the data flows of multiple edge nodes; select a second target central node; determine the address and access method of the source station to obtain the target data flow from the source station. Establish a second transmission path through the second target edge node, the second target parent node, the second target central node and the source station.

[0076] In the case where the provision method is client push streaming, it means that the current mode is push-pull streaming. Except for the client that currently initiates the pull stream request, other clients actively push the live stream to a central node of the CDN. Select a suitable third target edge node; determine the third target parent node of the third target edge node, and the third target parent node is responsible for coordinating the data streams of multiple edge nodes; determine the central node corresponding to the client push stream, and determine the central node as the third target central node. The third target central node already has the data stream corresponding to the pull stream request at this time, so the data stream can be obtained directly from the third target central node. Establish a third transmission path through the third target edge node, the third target parent node, and the third target central node.

[0077] In addition, if the stream pull request initiated by the client requires a media transcoding task, the central node will interact with the transcoding machine, process the data stream, and transmit the processed data stream to the client.

[0078] Figure 3 This is a schematic diagram of a flow-pulling installation shown in an embodiment of the present disclosure. Figure 3 As shown in the figure, CDN is set up on the Tor network. When the pull stream request is initiated based on rtmp / flv, there are two different transmission paths according to the data stream provision method. When the data stream is provided by the source station, when the client requests the live stream, the pull stream request initiated based on flv / rtmp is sent to the edge node, then it is returned from the parent node to the source, then it goes to the central node to return to the source, the central node goes to the source station to pull the stream, and then it is transmitted to the edge node step by step through the CDN network, and finally transmitted to the client. When the data stream is provided by the client push stream, when the client requests the live stream, the pull stream request initiated based on flv / rtmp is sent to the edge node, then it is returned from the parent node to the source, then it goes to the central node to return to the source, and then the central node obtains the data stream, and then it is transmitted to the edge node step by step through the CDN network, and finally transmitted to the client. In addition, if the client has a media task requirement, then after the central node obtains the data stream, it will interact with the transcoding machine, process the data stream, and then transmit the processed data stream to the client step by step.

[0079] By adopting the embodiments of the present disclosure, the system can dynamically select a suitable transmission path according to different provision modes. This flexibility ensures that the CDN can efficiently process streaming media requests under different network conditions and business requirements. By selecting appropriate edge nodes, parent nodes, and central nodes, the system can optimize resource utilization and reduce unnecessary data transmission and delays. Supporting multiple streaming media transmission modes (such as back-to-source mode and push-pull streaming mode) enables the CDN to adapt to different business scenarios and customer needs and enhance the applicability of the system. In the push-pull streaming mode, the third target central node can directly obtain the existing data stream, reducing the delay in data transmission and ensuring that users can receive the live content in real time.

[0080] Among them, in an optional embodiment, when the transmission protocol is the second transmission protocol, according to the transmission protocol and the providing method, the transmission path corresponding to the push-pull stream request is determined, including: when the providing method is provided by the source station, the transmission protocol of the data stream provided by the source station is determined; when the source station provides the data stream with the second transmission protocol, a fourth transmission path is determined, and the fourth transmission path includes a fourth target edge node, a fourth target parent node, a fourth target central node and the source station; the access terminal server of the fourth target central node is used to obtain the data stream from the source station and transmit the data stream to the gateway of the fourth target central node; when the source station provides the data stream with the first transmission protocol, a fifth transmission path is determined, and the fifth transmission path includes a fifth target edge node, a fifth target parent node, a fifth target central node and the source station; the gateway of the fifth target central node is used to obtain the data stream from the source station and slice the data stream; when the providing method is client push streaming, a sixth transmission path is determined, and the sixth transmission path includes a sixth target edge node, a sixth target parent node and a sixth target central node; the gateway of the sixth target central node is used to slice the data stream.

[0081] Confirm whether the data stream is provided by the source station or by the client.

[0082] When the data stream is provided by the source station, the fourth target edge node is determined according to the current network status and load conditions. The fourth target edge node is responsible for receiving the user's pull stream request; the fourth target parent node is determined. The fourth target parent node is responsible for coordinating the data streams of multiple edge nodes to ensure efficient transmission of the data stream; the fourth target central node is determined. The fourth target central node is responsible for obtaining the data stream from the source station and processing it.

[0083] Since the current pull request is a pull request initiated based on the second transmission protocol, the node's ATS (Access Terminal Server) will be used when transmitting the data stream through the CDN node. ATS is responsible for caching and forwarding data to reduce the access pressure on the upstream server.

[0084] When the source station provides data streams, the source station can provide data streams based on the rtmp / flv protocol or the hls protocol. Depending on which transmission protocol the source station uses to provide the data stream, there will be two transmission paths.

[0085] When the source station provides data streams using the second transmission protocol, that is, when providing data streams based on the HLS protocol, the source station will cut the video content into a series of small segments, which are provided to the downstream server via the HLS protocol. The ATS of the central node will be used, and the ATS of the central node will initiate a request to the source station to obtain the slice files of the data stream, and then transmit the slice files to the gateway of the central node.

[0086] Therefore, when the source station provides data streams with the second transmission protocol, the data transmission process of the fourth transmission path is as follows: the request is sent from the client, and after preliminary processing by the fourth target edge node nginx, it is forwarded to the fourth target edge node ATS for caching and forwarding; then, the request continues to be transmitted through the hierarchical level of the fourth target parent node gateway nginx and the fourth target parent node ATS; finally, the request arrives at the fourth target central node gateway nginx. Here, the fourth target central node gateway nginx will first try to obtain the hls slice from the fourth target central node ATS directly connected to it. If the required slice is not cached in the fourth target central node ATS, the back-to-source mechanism will be triggered, and the fourth target central node ATS will directly request and obtain the hls slice file from the source station.

[0087] When the source station provides the data stream using the first transmission protocol, that is, when the data stream is provided based on the rtmp / flv protocol, the source station will not cut the video content into a series of small segments. Therefore, the central node needs to segment the data stream. The central node's gateway nginx obtains the data stream from the source station and then segments the data stream for easy caching and on-demand transmission. The slices are then transmitted to the downstream server.

[0088] Therefore, when the source station provides data stream with the first transmission protocol, the data transmission process of the fifth transmission path is as follows: the request is sent from the client, and after preliminary processing by the fifth target edge node nginx, it is forwarded to the fifth target edge node ATS for caching and forwarding; then, the request continues to be transmitted through the hierarchy of the fifth target parent node gateway nginx and the fifth target parent node ATS; finally, the request arrives at the fifth target central node gateway nginx, and the nginx gateway of the fifth target central node actively pulls the rtmp / flv stream from the source station. After receiving the stream, the nginx of the fifth target central node will slice it into small pieces, and the sliced ​​files are stored on the disk of the central node for subsequent distribution and access; when the fifth target parent node ATS returns to the source to the nginx of the fifth target central node, the data stream fragments are obtained from the nginx of the fifth target central node.

[0089] In the case where the client pushes the stream to provide a data stream, when a client initiates a pull stream request based on the HLS protocol to obtain a data stream pushed by another client, the gateway nginx of the central node corresponding to the client push stream will slice the data stream to meet the pull stream request to obtain a data stream in the form of slices. And these sliced ​​video files will be stored on the disk of the central node for subsequent distribution and playback. At this time, the data stream no longer needs to be obtained from the source station, but only needs to be obtained from the central node. Therefore, it can be determined that the sixth target edge node, the sixth target parent node and the sixth target central node are included. The sixth target central node is the central node that receives the data stream pushed by another client, and the gateway of the central node will slice the pushed data stream.

[0090] Therefore, when the client pushes the stream to provide data stream, the data transmission process of the sixth transmission path is as follows: the request is sent from the client, and after preliminary processing by the sixth target edge node nginx, it is forwarded to the sixth target edge node ATS for caching and forwarding; then, the request continues to be transmitted through the hierarchical level of the sixth target parent node gateway nginx and the sixth target parent node ATS; finally, the request arrives at the sixth target central node gateway nginx, and the nginx of the sixth target central node slices the pushed data stream into small blocks, and the sliced ​​files are stored on the disk of the central node for subsequent distribution and access; when the sixth target parent node ATS returns to the source from the nginx of the sixth target central node, the data stream fragments are obtained from the nginx of the sixth target central node.

[0091] Figure 4 FIG. 1 is another schematic diagram of a flow-pulling installation shown in an embodiment of the present disclosure. Figure 4As shown in the figure, CDN is set up on the Tor network. When the pull stream request is initiated based on hls, there are three different transmission paths. The three different transmission paths have the same unified process. When the client pulls the data stream through the hls protocol, its return path passes through the edge node gateway Nginx server, edge node ATS server, parent node gateway Nginx server, parent node ATS server, and finally reaches the central node gateway Nginx server. When the data stream is provided by the client push stream, the central node gateway Nginx server slices the data stream and stores it on the central disk. The parent node ATS server directly goes back to the central node gateway Nginx server to obtain the data stream slice. When the data stream is provided by the source station with the hls protocol, the central node gateway Nginx server goes to the central node gateway ATS server to return to the source. The central node ATS server is responsible for directly obtaining the hls slice file from the source station. When the data stream is provided by the source station using the rtmp / flv protocol, the central node gateway Nginx server obtains the rtmp / flv data stream from the source station, slices the data stream, and stores it on the central disk. The parent node ATS server directly goes back to the central node gateway Nginx server to obtain the slices of the data stream.

[0092] In addition, if the stream pull request initiated by the client requires a media transcoding task, the central node will interact with the transcoding machine, process the data stream, and transmit the processed data stream to the client.

[0093] By adopting the embodiments of the present disclosure, the system can dynamically determine the optimal transmission path according to the data stream provision method and the transmission protocol. This flexibility ensures that the data stream can be transmitted to the client in the most efficient way under different scenarios and conditions. It also supports multiple transmission protocols such as rtmp / flv and hls to meet the needs of different application scenarios; for scenarios that require higher real-time performance, the rtmp / flv protocol can be selected; for scenarios that require wider compatibility and lower latency, the hls protocol can be selected. By dividing the system into multiple levels, such as edge nodes, parent nodes, and central nodes, and introducing ATS for caching and forwarding, the system achieves good scalability and stability.

[0094] Figure 5 This is a schematic diagram of an overall installation shown in an embodiment of the present disclosure. Figure 5As shown, the actual CDN system has different architecture models depending on customer needs and business acquisition methods. The nodes connected to the tor network need to support various setup scenarios, specifically, they need to support the setup scenario when the push-pull stream request is a push stream request, the setup scenario when the push-pull stream request is a pull stream request and the transmission protocol is the first transmission protocol, and the setup scenario when the push-pull stream request is a pull stream request and the transmission protocol is the second transmission protocol.

[0095] The CDN system architecture based on the Tor network can realize business scenarios based on flv / rtmp streaming, hls streaming, and rtmp streaming. It can overcome the privacy problem that there is no invention to protect the anonymity of CDN.

[0096] When CDN is actually used by the government, enterprises, institutions, and the military, the user nodes and CDN nodes are connected to the Tor network, which can not only obtain the required resources nearby and stably, but also ensure anonymity. For the participation of important roles, their identity information can be hidden, thus expanding the anonymity of CDN.

[0097] When the transmission path corresponding to the push-pull stream request is used to transmit the transmission data corresponding to the push-pull stream request, the transmission between adjacent nodes of the transmission path is implemented using an anonymous transmission link.

[0098] Among them, in an optional embodiment, an anonymous transmission link is determined between adjacent nodes of the transmission path, including: obtaining a relay node list; the relay node list includes multiple relay nodes; selecting an entry node, an intermediate node and an exit node from the relay node list; the entry node is a relay node carrying an entry tag, and the exit node is a relay node carrying an exit tag; based on the azimuth exposure rate of the entry node, performing an azimuth exposure evaluation on the entry node to obtain an exposure evaluation result; when the exposure evaluation result is greater than or equal to an exposure rate threshold, and when the number of selections of the entry node is less than or equal to a selection number threshold, discarding the entry node, and reselecting an entry node from the relay nodes carrying the entry tag in the relay node list for azimuth exposure evaluation; when the exposure evaluation result is less than the exposure rate threshold, and / or when the number of selections of the entry node is greater than the selection number threshold, retaining the entry node, and the anonymous transmission link determined by the entry node, the intermediate node and the exit node.

[0099] The currently available relay node information is extracted to form a list of multiple relay nodes. The relay node list includes multiple relay nodes, specifically relay nodes carrying ingress labels and relay nodes carrying egress labels.

[0100] In Tor network communication, information transmission between any two nodes will go through three hops: entry node, intermediate node, and exit node to finally reach the destination machine. The entry node, intermediate node, and exit node form an anonymous transmission link. The entry node is selected from each relay node carrying an entry label, and the exit node is selected from each relay node carrying an exit label. The intermediate node is a relay node that does not carry an entry label or an exit label.

[0101] From the perspective of performance optimization, the current location-aware link selection algorithms, such as Astoria, can intelligently prioritize shorter communication paths based on geographic location information, thereby significantly reducing communication latency. However, location-aware link selection algorithms may inadvertently leak the client's location information. In the Tor network, which places a high emphasis on anonymity, information leakage is particularly sensitive. In addition, the existence of malicious nodes also poses a severe challenge to the anonymity protection mechanism of the Tor network, because if the location information is exposed, the anonymity of the Tor network will be destroyed. In order to resist the destruction of Tor's anonymity by attackers, the possible attack scenarios of malicious nodes at different link locations are analyzed again, and malicious attacks are avoided based on actual scenarios.

[0102] Based on the Tor mechanism, triple proxy ensures that no matter which relay node is hijacked, the source address and destination address cannot be known at the same time, thus achieving anonymity. According to the principle of the link selection algorithm, each relay can only be selected once, and any two relays cannot belong to the same family, so the probability of a malicious node being deployed to three hops is extremely small. Therefore, the location exposure rate of the entry node can be used to approximate the location exposure rate of the entire anonymous transmission link.

[0103] The following evaluation model can be used to evaluate the orientation exposure of the entry node: Pr[as=ase:ase←A(BG(PSA,φ,gcn))]-δe≤eℇ•Pr[1 / ASE] Where E represents all relays with entry labels on the Tor network. For the entry node e∈E selected in the link selection, the location of the entry node is ase∈ASE, ASE represents the set of ASs to which all entry nodes belong, the malicious node is defined as BG(PSA,φ,gcn), the link selection algorithm is PSA, and δe is the azimuth exposure rate of the entry node.

[0104] Pr[as=ase:ase←A(BG(PSA,φ,gcn))] represents the probability that the link selection algorithm A selects a specific entry node e (whose position is ase) given a malicious node BG (defined by the PSA algorithm, parameters φ and gcn). eℇ is a constant or coefficient used to adjust or quantify the uncertainty or error range of the prediction. Pr[1 / ASE] represents the inverse of the probability of randomly selecting a location among all possible entry node locations (ASE set).

[0105] The meaning of the above evaluation model is that the probability of the location prediction of the entry node e by the link selection algorithm A, taking into account the malicious node BG, minus the location exposure rate δe of the node, should be less than or equal to a threshold given by the product of the constant eℇ and the average probability of all entry node locations. The evaluation model is used to evaluate the performance of the link selection algorithm in protecting location privacy.

[0106] The value corresponding to Pr[as=ase:ase←A(BG(PSA,φ,gcn))]-δe is taken as the exposure evaluation result. eℇ•Pr[1 / ASE] is taken as the exposure rate threshold.

[0107] If the exposure evaluation result of the entry node is greater than or equal to the exposure rate threshold, it means that the currently selected entry node may not be safe. You can discard it and reselect a safer route.

[0108] When selecting the entry node, the number of selections must also be considered. In link selection, allowing a certain number of selections can find a balance between security and efficiency.

[0109] When the exposure evaluation result is greater than or equal to the exposure rate threshold, and when the number of selections of the entry node is less than or equal to the selection number threshold, the currently selected entry node is discarded, and an entry node is reselected from the relay nodes carrying the entry tag in the relay node list and an azimuth exposure evaluation is performed.

[0110] When the exposure evaluation result is less than an exposure rate threshold, and / or when the number of selections of the entry node is greater than a selection number threshold, the entry node is retained, and an anonymous transmission link is determined through the entry node, the intermediate node and the exit node.

[0111] Figure 6 FIG. 1 is a schematic diagram of an adaptive link selection process based on exposure rate shown in an embodiment of the present disclosure. Figure 6As shown, an anonymous transmission path is selected, and an exposure evaluation result is determined according to the evaluation model; it is judged whether the exposure evaluation result is greater than or equal to the exposure rate threshold; when the exposure evaluation result is less than the exposure rate threshold, the anonymous transmission path is determined; when the exposure evaluation result is greater than or equal to the exposure rate threshold, it is continued to be judged whether the number of selections is greater than the number of selections threshold; when the number of selections is less than or equal to the number of selections threshold, the anonymous transmission path is reselected; when the number of selections is greater than the number of selections threshold, the anonymous transmission path is determined.

[0112] When communicating between each business node on the live CDN architecture, the use of an adaptive anonymous transmission link selection mechanism based on location exposure rate can improve anonymity, avoid malicious nodes as much as possible, and reduce possible attacks. The core is to use the location exposure evaluation model to predict the location exposure rate of the anonymous transmission link by evaluating the location exposure rate of the entry node, and then dynamically select anonymous transmission links with higher anonymity according to the exposure rate threshold. The security and anonymity of the CDN system are guaranteed to be better applied in important confidential roles such as the military and government.

[0113] By adopting the embodiments of the present disclosure, by evaluating the position exposure rate of the entry node, the anonymity performance of the node in the network can be effectively judged. In the embodiments, a dual judgment mechanism of the selection number threshold and the exposure rate threshold is introduced to make the link selection process more flexible and adaptive. By evaluating the position exposure rate of the relay node and limiting the number of selections, potential malicious nodes can be effectively avoided, thereby improving the security of the entire anonymous transmission link and reducing the risk of being attacked.

[0114] Among them, in an optional embodiment, when the push-pull stream request is a pull stream request and is in the sending request stage, or when the push-pull stream request is a push stream request, anonymously transmitting the transmission data corresponding to the push-pull stream request through the transmission path and the anonymous transmission link between the adjacent nodes of the transmission path, including: At the sending end node among the adjacent nodes of the transmission path, the transmission data is encrypted; the transmission data is the pull stream request content or the pushed data stream; through each hop relay node of the anonymous transmission link, the encrypted transmission data is decrypted and transmitted layer by layer until the last hop relay node transmits the decrypted transmission data to the receiving end node among the adjacent nodes of the transmission path.

[0115] Select appropriate entry nodes, intermediate nodes and exit nodes from the relay node list, and the entry nodes, intermediate nodes and exit nodes form an effective anonymous transmission link.

[0116] At the sending node, the data to be transmitted is encrypted. Encryption algorithms such as AES and RSA can be used to ensure data security. The session key of the relay node in the anonymous transmission link can be used to encrypt the pull request content or the pushed data stream to form an encrypted data packet.

[0117] The first relay node of the anonymous transmission link receives the encrypted data and uses the corresponding key to perform a layer of decryption. The data after a layer of decryption continues to be transmitted along the anonymous transmission link. Each time it passes through a relay node, it will be decrypted by the key corresponding to the relay node. Finally, after the last hop relay node performs a layer of decryption on the encrypted data packet, the decrypted transmission data is obtained and the decrypted data is transmitted to the receiving node in the adjacent node of the transmission path.

[0118] By adopting the embodiments of the present disclosure, the transmission data is encrypted at the sending node to ensure that the data is not stolen or tampered with by unauthorized third parties during the transmission process. By using an anonymous transmission link, the real identity and location of the sender are hidden, protecting the privacy of the user, and meeting the needs of application scenarios that require anonymous transmission. By decrypting layer by layer at each hop relay node, the risk of single point failure can be effectively reduced. Each relay node can only decrypt the part of the data it is responsible for, further enhancing the security of data transmission. Whether it is a pull stream request or a push stream request, the system can use the same encryption and decryption processing strategy to show good flexibility and adaptability.

[0119] Among them, in an optional embodiment, at the sending end node among the adjacent nodes of the transmission path, the transmission data is encrypted, including: determining the relay node corresponding to the anonymous transmission link between the adjacent nodes of the transmission path; encrypting the transmission data layer by layer using the session key corresponding to the relay node in the order of the relay nodes from far to near; decrypting and transmitting the encrypted transmission data layer by layer through each hop relay node of the anonymous transmission link, including: for each relay node in the anonymous transmission link, after receiving the encrypted transmission data transmitted by the previous hop node, using its own corresponding session key to perform a layer of decryption on the encrypted transmission data, and transmitting the transmission data after a layer of decryption to the next hop node; wherein the previous hop node is the sending end node or the relay node, and the next hop node is the receiving end node or the relay node.

[0120] After determining a valid anonymous transmission link, the various relay nodes included in the anonymous transmission link can be identified through information such as identifiers. Each relay node includes an exit node, an intermediate node, and an entry node. The entry node is a node that continues data transmission with the sending node. From the perspective of data transmission, the entry node is the node closest to the sending node; the exit node is a node that continues data transmission with the receiving node. From the perspective of data transmission, the exit node is the node farthest from the sending node.

[0121] After determining the relay node, the system needs to obtain the session key corresponding to each relay node. The session key is used to perform encryption and decryption operations when transmitting data in the anonymous transmission link.

[0122] Encryption is performed layer by layer in the order of relay nodes from far to near. The specific steps may be to use the session key of the exit node to encrypt the transmission data for the first time to form the innermost encrypted data. Use the session key of the intermediate node to encrypt the encrypted data obtained in the previous step for the second time to form the middle layer encrypted data. Use the session key of the entry node to encrypt the middle layer encrypted data for the last time to form the outermost encrypted data, thus forming the final encrypted data packet.

[0123] The sending node transmits the final encrypted data packet to the entry node. The entry node uses its corresponding session key to decrypt the encrypted data to obtain the middle layer encrypted data. The decrypted middle layer encrypted data is transmitted to the middle node.

[0124] The intermediate node receives the intermediate layer encrypted data from the entry node, decrypts the intermediate layer encrypted data using its own corresponding session key, obtains the innermost layer encrypted data, and transmits the innermost layer encrypted data to the exit node.

[0125] The exit node receives the innermost encrypted data from the intermediate node. It uses its own corresponding session key to decrypt the innermost encrypted data and obtain the decrypted transmission data, which is the original data sent by the client. The decrypted original data is transmitted in plain text to the receiving node.

[0126] After receiving the plaintext data, the receiving node performs corresponding processing. If it is a pull stream request, the receiving node transmits the data stream to the client. If it is a push stream request, the receiving node stores or forwards the data stream to the target server.

[0127] By adopting the embodiments of the present disclosure, the security of data during transmission can be ensured by encrypting the transmission data at the sending end node in the adjacent nodes of the transmission path. The layer-by-layer encryption method enables each layer of relay nodes to only decrypt the data of its corresponding encryption layer, thereby failing to obtain the complete content of the entire data packet. The encryption method of this embodiment effectively prevents the data from being intercepted and parsed by unauthorized third parties during transmission, thereby improving the overall security of data transmission.

[0128] If it is a pull stream request, the system will transmit the data stream to the client after receiving the request. In the process of transmitting the data stream to the client, an anonymous transmission link is also used, and the transmitted data stream also needs to be encrypted and decrypted.

[0129] Among them, in an optional embodiment, when the push-pull stream request is a pull stream request and is in the response request stage, the transmission data corresponding to the push-pull stream request is anonymously transmitted through the anonymous transmission link between the transmission path and the adjacent nodes of the transmission path, including: through each hop relay node of the anonymous transmission link, the transmission data sent by the receiving node in the adjacent node of the transmission path is encrypted and transmitted layer by layer; until the encrypted transmission data is transmitted to the sending node in the adjacent node of the transmission path at the last hop relay node; wherein the sending node and the receiving node are determined in the sending request stage of the pull stream request.

[0130] The data stream corresponding to the pull request is returned to the client through the transmission path, and is transmitted using an anonymous transmission link between every two adjacent nodes of the transmission path. Every two adjacent nodes of the transmission path are defined as a sending node and a receiving node.

[0131] In the sending request phase of the pull request, the sending end node and the receiving end node of the two adjacent nodes are determined. The sending end node is the node that is closer to the client from the transmission logic, and the receiving end node is the node that is closer to the data source or streaming media server from the transmission logic. In the response request phase, the node that is closer to the client of the two adjacent nodes is determined as the sending end node, and the node that is closer to the data source or streaming media server of the two adjacent nodes is determined as the receiving end node.

[0132] The anonymous transmission link includes three-hop relay nodes, including an exit node, an intermediate node, and an entry node.

[0133] In the process of transmitting the data stream using the transmission path, each time it passes through a relay node, it is encrypted and the encrypted data stream is transmitted to the next hop node. After the last hop relay node encrypts the received data, it transmits the data to the sending node.

[0134] With the embodiment of the present disclosure, during the data return process, each relay node is encrypted to ensure that the data is not stolen or tampered with during the transmission process. By encrypting the returned data, the real identity information between the target server and the client is hidden, protecting the user's privacy and reducing the risk of being monitored.

[0135] Among them, in an optional embodiment, the transmission data sent by the receiving node in the adjacent node of the transmission path is encrypted and transmitted layer by layer through each hop relay node of the anonymous transmission link, including: for each relay node in the anonymous transmission link, after receiving the transmission data transmitted by the previous hop node, the transmission data is encrypted by a layer using its own corresponding session key, and the transmission data after the layer of encryption is transmitted to the next hop node; wherein the previous hop node is the receiving node or the relay node, and the next hop node is the sending node or the relay node.

[0136] The anonymous transmission link includes three-hop relay nodes: exit node, intermediate node and entry node.

[0137] The exit node and the receiving node transmit plain text data. After receiving the data stream sent by the receiving node, the exit node uses the session key corresponding to the exit node to perform the first layer of encryption on the transmitted data to form the innermost layer of encrypted data. The exit node transmits the innermost layer of encrypted data to the intermediate node. After receiving the innermost encrypted data, the intermediate node uses the session key corresponding to the intermediate node to perform a second layer of encryption on the innermost encrypted data to form the intermediate layer encrypted data. The intermediate node transmits the intermediate layer encrypted data to the entry node.

[0138] After receiving the middle-layer encrypted data, the entry node uses the session key corresponding to the entry node to perform the third-layer encryption on the middle-layer encrypted data to obtain the innermost encrypted data, which is the final encrypted data packet. The final encrypted data packet is transmitted to the receiving node.

[0139] After receiving the data stream after three layers of encryption, the receiving node can use the corresponding session key to decrypt the final encrypted data packet to obtain the data stream sent by the receiving node.

[0140] With the embodiments of the present disclosure, during the data transmission process, each relay node will use its corresponding session key to perform a layer of encryption on the received data, and each relay node has a unique session key, which further enhances the security of data transmission. Each relay node encrypts and forwards the received data, ensuring that the data is processed and confirmed at each hop, reducing the risk of data loss or damage.

[0141] Figure 7 It is a schematic diagram of an internal data transmission process between adjacent nodes of a transmission path shown in an embodiment of the present disclosure. Figure 7 Taking the specific communication process between the client and the CDN edge node server in the Tor network as an example, the communication process of the other layers of nodes in the CDN in the Tor network can be referred to Figure 7 According to the workflow. Figure 7 As shown, Step 1: The user starts the Tor client and first sends a request to the directory server in the Tor network. The directory server sends the client a list of all relay nodes and corresponding public keys currently available on the Tor network. The process of the client sending a request to the directory server and the process of the directory server returning the relay nodes and corresponding public key lists to the client are encrypted. The public key list includes the session key information of each relay node.

[0142] Step 2: The client determines the anonymous transmission link based on the relay list information. The list corresponding to the relay node provides relay nodes marked with Guard and Exit. The random routing selection algorithm selects the entry node from the relay node marked with Guard and the exit node from the relay node marked with Exit according to the node flag information. The probability of random selection is determined by the weight of the bandwidth reported by the relay node in the total bandwidth. The weight represents the azimuth exposure evaluation result of the relay node.

[0143] Step 3: After selecting three-hop relay nodes, the client obtains the session key information of the three-hop nodes respectively, and establishes an anonymous transmission link including these relay nodes according to the identity information such as the IP address of the relay node. The anonymous transmission link is used to encrypt the transmission data.

[0144] Step 4: The client initiates a request to the target server and encrypts the request content to be sent in the form of an onion wrapper. The target server is the CDN edge node server. Layer-by-layer encryption means that the next layer of encryption is encrypted again on the basis of the previous layer of encryption. The order of layer-by-layer encryption is: from far to near, the request content is encrypted in sequence using the session keys corresponding to the three-hop nodes. The encrypted request content is transmitted through an anonymous transmission link.

[0145] The relay nodes in the anonymous transmission link will decrypt the encrypted request content layer by layer in sequence. The specific operation is that after receiving the data, the entry node uses the session key to decrypt the outermost layer and obtain the node information of the next hop; the entry node forwards the data after the outermost decryption to the intermediate node; the intermediate node uses the corresponding session key to decrypt the intermediate layer and forwards it to the exit node after decryption; finally, the exit node decrypts the innermost layer to obtain the plaintext request content and transmits it to the target server. Only the transmission connection between the exit node and the target server is unencrypted.

[0146] Step 5: The target server receives the original request information data and replies to the user. During the return process, the reply content will be encrypted using the session key corresponding to the relay node each time it passes through the relay node, and finally the encrypted information will be returned to the client, completing a complete communication.

[0147] Figure 8 1 is a block diagram of a device for setting up a content distribution network based on anonymous communication shown in an embodiment of the present disclosure. Figure 8 As shown, the device comprises: The receiving module 810 is used to receive a push or pull stream request from a client for a data stream; A first determining module 820, configured to determine a transmission path corresponding to the push-pull stream request according to a transmission parameter corresponding to the push-pull stream request; A second determination module 830 is used to determine an anonymous transmission link between adjacent nodes of the transmission path; the anonymous transmission link is determined after azimuth exposure evaluation; The transmission module 840 is used to anonymously transmit the transmission data corresponding to the push-pull stream request through the transmission path and the anonymous transmission link between the adjacent nodes of the transmission path.

[0148] The present disclosure also provides an electronic device, referring to Fig. 9 , Fig. 9 is a schematic diagram of an electronic device shown in an embodiment of the present disclosure. Fig. 9 As shown, the electronic device 900 includes: a memory 910 and a processor 920. The memory 910 and the processor 920 are connected via a bus communication. A computer program is stored in the memory 910. The computer program can be run on the processor 920 to implement the steps in the method for establishing a content distribution network based on anonymous communication disclosed in the embodiment of the present disclosure.

[0149] The embodiment of the present disclosure further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method for establishing a content distribution network based on anonymous communication disclosed in the embodiment of the present disclosure are implemented.

[0150] The embodiment of the present disclosure further provides a computer program product, including a computer program. When the computer program is executed by a processor, the steps in the method for establishing a content distribution network based on anonymous communication disclosed in the embodiment of the present disclosure are implemented.

[0151] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0152] It should be understood by those skilled in the art that the embodiments of the present disclosure may be provided as methods, devices or computer program products. Therefore, the embodiments of the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present disclosure may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0153] The embodiments of the present disclosure are described with reference to the flowcharts and / or block diagrams of the methods, apparatuses, electronic devices, and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0154] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0155] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1The steps for the functions specified in one or more boxes.

[0156] Although some embodiments of the present disclosure have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiment and all changes and modifications that fall within the scope of the present disclosure.

[0157] The above is a detailed introduction to a method for establishing a content distribution network based on anonymous communication provided by the present disclosure. Specific examples are used in this article to illustrate the principles and implementation methods of the present disclosure. The description of the above embodiments is only used to help understand the method of the present disclosure and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present disclosure, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present disclosure.

Claims

1. A method for establishing a content distribution network based on anonymous communication, characterized in that: include: Receive push and pull stream requests from the client for data streams; Determine a transmission path corresponding to the push-pull stream request according to a transmission parameter corresponding to the push-pull stream request; Determining an anonymous transmission link between adjacent nodes of the transmission path; the anonymous transmission link is determined after azimuth exposure evaluation; The transmission data corresponding to the push-pull stream request is anonymously transmitted through the transmission path and anonymous transmission links between adjacent nodes of the transmission path.

2. The method according to claim 1, characterized in that Determining an anonymous transmission link between adjacent nodes of the transmission path includes: Obtaining a relay node list; the relay node list includes multiple relay nodes; Selecting an entry node, an intermediate node and an exit node from the relay node list; the entry node is a relay node carrying an entry label, and the exit node is a relay node carrying an exit label; Based on the azimuth exposure rate of the entry node, performing azimuth exposure evaluation on the entry node to obtain an exposure evaluation result; When the exposure evaluation result is greater than or equal to the exposure rate threshold, and when the number of selections of the entry node is less than or equal to the selection number threshold, discard the entry node, and reselect an entry node from the relay nodes carrying the entry tag in the relay node list to perform azimuth exposure evaluation; When the exposure evaluation result is less than an exposure rate threshold, and / or when the number of selections of the entry node is greater than a selection number threshold, the entry node is retained, and an anonymous transmission link is determined through the entry node, the intermediate node and the exit node.

3. The method according to claim 1, characterized in that When the push-pull stream request is a pull stream request and is in the sending request stage, or when the push-pull stream request is a push stream request, anonymously transmitting the transmission data corresponding to the push-pull stream request through the transmission path and the anonymous transmission link between the adjacent nodes of the transmission path, including: At a sending end node among adjacent nodes in the transmission path, encrypting the transmission data; the transmission data is a pull stream request content or a pushed data stream; The encrypted transmission data is decrypted and transmitted layer by layer through each hop relay node of the anonymous transmission link until the decrypted transmission data is transmitted to a receiving node in the adjacent nodes of the transmission path at the last hop relay node.

4. The method according to claim 3, characterized in that At a sending end node among the adjacent nodes in the transmission path, encrypting the transmission data comprises: Determine a relay node corresponding to an anonymous transmission link between adjacent nodes of the transmission path; According to the order of the relay nodes from far to near, the transmission data is encrypted layer by layer using the session keys corresponding to the relay nodes; The encrypted transmission data is decrypted layer by layer and transmitted through each hop relay node of the anonymous transmission link, including: For each relay node in the anonymous transmission link, after receiving the encrypted transmission data transmitted by the previous hop node, the relay node uses its own corresponding session key to perform a layer of decryption on the encrypted transmission data, and transmits the decrypted transmission data to the next hop node; The previous hop node is the sending node or the relay node, and the next hop node is the receiving node or the relay node.

5. The method according to claim 1, characterized in that When the push-pull stream request is a pull stream request and is in a request response phase, anonymously transmitting the transmission data corresponding to the push-pull stream request through the transmission path and an anonymous transmission link between adjacent nodes of the transmission path, including: Through each hop relay node of the anonymous transmission link, the transmission data sent by the receiving end node in the adjacent node of the transmission path is encrypted and transmitted layer by layer; Until the last hop relay node transmits the encrypted transmission data to the sending end node in the adjacent node of the transmission path; The sending end node and the receiving end node are determined in the sending request phase of the stream pulling request.

6. The method according to claim 5, characterized in that The transmission data sent by the receiving end node in the adjacent node of the transmission path is encrypted layer by layer through each hop relay node of the anonymous transmission link, including: For each relay node in the anonymous transmission link, after receiving the transmission data transmitted by the previous hop node, the transmission data is encrypted by the corresponding session key, and the encrypted transmission data is transmitted to the next hop node; The previous hop node is the receiving node or the relay node, and the next hop node is the sending node or the relay node.

7. The method according to claim 1, characterized in that In the case where the push-pull stream request is a push stream request, determining a transmission path corresponding to the push-pull stream request according to a transmission parameter corresponding to the push-pull stream request includes: Determining a first target edge node; Authenticating the data stream based on the first target edge node, and determining the first target central node according to the authentication result, the data stream being the data stream pushed by the push stream request; A first transmission path corresponding to the streaming request is obtained according to the first target edge node and the first target central node.

8. The method according to claim 1, characterized in that In the case where the push-pull stream request is a pull stream request, determining a transmission path corresponding to the push-pull stream request according to a transmission parameter corresponding to the push-pull stream request includes: According to the transmission parameters corresponding to the push-pull stream request, determine the transmission protocol and provision method corresponding to the data stream pulled by the pull stream request; the transmission protocol includes a first transmission protocol and a second transmission protocol; the second transmission protocol represents that the data stream is transmitted in the form of slices; the provision method includes source station provision and client push stream provision; According to the transmission protocol and the providing method, a transmission path corresponding to the push-pull stream request is determined.

9. The method according to claim 8, characterized in that In the case where the transmission protocol is the first transmission protocol, determining the transmission path corresponding to the push-pull stream request according to the transmission protocol and the providing method includes: In the case where the providing mode is provided by the source station, determining a second transmission path, the second transmission path including: a second target edge node, a second target parent node, a second target central node and the source station; In the case where the providing mode is client streaming, a third transmission path is determined, and the third transmission path includes: a third target edge node, a third target parent node, and a third target central node.

10. The method according to claim 8, characterized in that In the case where the transmission protocol is the second transmission protocol, determining the transmission path corresponding to the push-pull stream request according to the transmission protocol and the providing method includes: In the case where the providing mode is provided by the source station, determining a transmission protocol for the data stream provided by the source station; In the case where the source station provides the data stream in a second transmission protocol, a fourth transmission path is determined, the fourth transmission path includes a fourth target edge node, a fourth target parent node, a fourth target central node and the source station; the access terminal server of the fourth target central node is used to obtain the data stream from the source station, and transmit the data stream to the gateway of the fourth target central node; In the case where the source station provides the data stream using the first transmission protocol, determining a fifth transmission path, the fifth transmission path including a fifth target edge node, a fifth target parent node, a fifth target central node, and the source station; a gateway of the fifth target central node is used to obtain the data stream from the source station and slice the data stream; When the provision method is client streaming, a sixth transmission path is determined, and the sixth transmission path includes a sixth target edge node, a sixth target parent node and a sixth target central node; the gateway of the sixth target central node is used to slice the data stream.

Images