Communication connection establishment method and device, equipment and medium

Abstract

The invention provides a communication connection establishment method and device, equipment and a medium, and relates to the technical field of network security. The method comprises the steps that an identity verification request is sent to a server side, the identity verification request carries identity information of a client side and a first connection identifier, and the first connection identifier is used for establishing QUIC connection between the client side and the server side and uniquely identifies the identifier of the client side; monitoring whether a second connection identifier returned by the server is received or not; if a second connection identifier returned by the server is received, communication connection between the client and the server is established according to the second connection identifier and the QUIC protocol, the second connection identifier is a connection identifier generated by the server based on the first connection identifier, and the second connection identifier is used for establishing QUIC connection between the client and the server and uniquely identifies the identifier of the server. According to the method and the device, the access continuity between the client and the server can be kept under the condition that the IP address changes, and the security in the access process is improved.

Description

Background Art

[0002] Port Knocking is a network security technique that requires a client to send a series of connection requests to a specific port in a specific order to a server before attempting to access a service. If the sequence is correct, the server temporarily allows access to the client.

[0003] Software-defined perimeter (SDP) is a new generation of network security technology architecture based on the concept of zero trust. Its main functions include infrastructure hiding, reducing DoS attacks, detecting error packets, preventing unauthorized access to the network, and controlling access to applications and services. Zero trust SDP uses single packet authorization (SPA) technology to implement network authorization. SPA is a lightweight network security protocol and one of the core functions of SDP.

[0004] In the related technologies, the traditional SPA technology has the problem of multiple devices sharing the source IP being authorized at the same time, that is, the source network address translation SNAT port amplification vulnerability problem. At the same time, the single-packet authorization UDP-SPA based on the User Datagram Protocol often uses the source IP to determine whether the verification packet and the communication establishment packet are from the same sender. That is, if one of the terminals passes the authentication after knocking on the door, all devices under the same SNAT can bypass the verification and directly establish communication.

[0005] In addition, by obtaining the client-side external network IP and putting it in the SPA request packet to request authorization, the connection established based on the transmission control protocol TCP may be disconnected due to IP changes. If you still want to transmit data at this time, you need to re-establish the connection, which often causes network lag. Therefore, the method of establishing a communication connection based on IP may affect the user experience in an environment with multiple external network exit IPs or IP drift.

[0006] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0007] The present disclosure provides a method, apparatus, device and medium for establishing a communication connection, which at least to a certain extent overcomes the problem in the related art of disconnection between a client and a server due to a change in an IP address.

[0008] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0009] According to one aspect of the present disclosure, a method for establishing a communication connection is provided, which is applied to a client, and includes: sending an identity authentication request to a server, wherein the identity authentication request carries the identity information of the client and a first connection identifier, the first connection identifier is used by the client to establish a Fast User Datagram Protocol Internet Connection QUIC connection with the server and is an identifier that uniquely identifies the client; monitoring whether a second connection identifier returned by the server is received, wherein the second connection identifier is a connection identifier generated by the server based on the first connection identifier, the second connection identifier is used by the client to establish a QUIC connection with the server and is an identifier that uniquely identifies the server; if the second connection identifier returned by the server is received, establishing a communication connection between the client and the server according to the second connection identifier and the QUIC protocol.

[0010] In some embodiments, after monitoring whether the second connection identifier returned by the server is received, the method also includes: if the second connection identifier returned by the server is not received, resending an identity authentication request to the server within a preset time period until the second connection identifier returned by the server is received.

[0011] In some embodiments, after establishing a communication connection between the client and the server according to the second connection identifier and the QUIC protocol, the method further includes: detecting whether the IP address of the client has changed; in the case where the IP address of the client has changed, verifying whether the first connection identifier is valid; if so, maintaining the communication connection between the client and the server; if not, re-sending an identity authentication request to the server to re-establish the communication connection between the client and the server.

[0012] According to another aspect of the present disclosure, a method for establishing a communication connection is also provided, which is applied to a server, and includes: receiving an identity authentication request sent by a client, wherein the identity authentication request carries the identity information of the client and a first connection identifier, and the first connection identifier is used by the client to establish a Fast User Datagram Protocol Internet Connection QUIC connection with the server and uniquely identifies the client; according to a predetermined verification rule, verifying whether the first connection identifier is valid; if so, generating a second connection identifier based on the first connection identifier, and returning the second connection identifier to the client, wherein the second connection identifier is used by the client to establish a QUIC connection with the server and uniquely identifies the server.

[0013] According to another aspect of the present disclosure, a communication system is also provided, including: a client and a server; wherein the client is used to send an authentication request to the server, wherein the authentication request carries the identity information of the client and a first connection identifier, and the first connection identifier is used by the client to establish a Fast User Datagram Protocol Internet Connection QUIC connection with the server and uniquely identifies the client; the server is used to receive the authentication request sent by the client; wherein the server is also used to verify whether the first connection identifier is valid according to a predetermined verification rule, and if so, generate a second connection identifier based on the first connection identifier, and return the second connection identifier to the client, wherein the second connection identifier is used by the client to establish a QUIC connection with the server and uniquely identifies the server; wherein the client is also used to establish a communication connection between the client and the server according to the second connection identifier and the QUIC protocol if the second connection identifier returned by the server is received.

[0014] According to another aspect of the present disclosure, a terminal device is also provided, including: a verification request sending module, used to send an identity authentication request to a server, wherein the identity authentication request carries the identity information of the client and a first connection identifier, the first connection identifier is used by the client to establish a Fast User Datagram Protocol Internet Connection QUIC connection with the server and is an identifier that uniquely identifies the client; a connection identifier detection module, used to monitor whether a second connection identifier returned by the server is received, wherein the second connection identifier is a connection identifier generated by the server based on the first connection identifier, the second connection identifier is used by the client to establish a QUIC connection with the server and is an identifier that uniquely identifies the server; a communication connection establishment module, used to establish a communication connection between the client and the server according to the second connection identifier and the QUIC protocol if the second connection identifier returned by the server is received.

[0015] According to another aspect of the present disclosure, a server is also provided, including: a verification request receiving module, used to receive an identity authentication request sent by a client, wherein the identity authentication request carries the identity information of the client and a first connection identifier, the first connection identifier is used by the client to establish a Fast User Datagram Protocol Internet Connection QUIC connection with the server and is an identifier that uniquely identifies the client; a connection identifier verification module, used to verify whether the first connection identifier is valid according to a predetermined verification rule; a connection identifier returning module, used to, if so, generate a second connection identifier based on the first connection identifier, and return the second connection identifier to the client, wherein the second connection identifier is used by the client to establish a QUIC connection with the server and is an identifier that uniquely identifies the server.

[0016] According to another aspect of the present disclosure, an electronic device is also provided, which includes: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the above-mentioned methods for establishing a communication connection by executing the executable instructions.

[0017] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the method for establishing a communication connection described in any one of the above is implemented.

[0018] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the computer program implements any one of the above methods for establishing a communication connection.

[0019] In the communication connection establishment method, apparatus, device and medium provided in the embodiments of the present disclosure, after the client sends an identity authentication request to the server, the server verifies whether the first connection identifier carried therein is valid. If so, a second connection identifier is generated based on the first connection identifier and returned to the client, so that the client establishes a communication connection between the client and the server based on the second connection identifier and the QUIC protocol. The embodiments of the present disclosure can maintain the continuity of access between the client and the server in the event of a change in the IP address, thereby improving the security during the access process.

[0020] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0022] Figure 1 A flow chart of a method for establishing a communication connection in an embodiment of the present disclosure is shown;

[0023] Figure 2 Another flow chart of a method for establishing a communication connection in an embodiment of the present disclosure is shown;

[0024] Figure 3 A flow chart of signaling interaction for establishing a communication connection in an embodiment of the present disclosure is shown;

[0025] Figure 4 A schematic diagram of a data packet structure of a QUIC protocol in an embodiment of the present disclosure is shown;

[0026] Figure 5 Another flow chart of a method for establishing a communication connection in an embodiment of the present disclosure is shown;

[0027] Figure 6 A schematic diagram showing the structure of a communication system in an embodiment of the present disclosure is shown;

[0028] Figure 7 A schematic diagram showing the structure of a terminal device in an embodiment of the present disclosure is shown;

[0029] Figure 8 A schematic diagram showing the structure of a server in an embodiment of the present disclosure is shown;

[0030] Fig. 9 A schematic structural diagram of an electronic device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0031] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0032] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and thus their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0033] For ease of understanding, before introducing the embodiments of the present disclosure, several terms involved in the embodiments of the present disclosure are first explained as follows:

[0034] SDP: Software Defined Perimeter. A new generation of network security technology architecture based on the Zero Trust concept. Its main functions include infrastructure hiding, reducing Denial of Service attacks DoS, detecting error packets, preventing unauthorized access to the network, and controlling access to applications and services.

[0035] SPA: Single Packet Authorization. A lightweight network security protocol, it is one of the core functions of SDP. The main purpose of SPA is to check the identity of the device or user before allowing access to the network where the controller, gateway and other related system components are located, to achieve a zero-trust "authentication before connection" security model.

[0036] QUIC: Quick User Datagram Protocol Internet Connections, a transport layer protocol based on the User Datagram Protocol (UDP), designed to address some limitations of the Transmission Control Protocol (TCP) in modern network applications, and provide a faster, safer and more reliable solution for Web communications.

[0037] The specific implementation of the embodiment of the present disclosure is described in detail below with reference to the accompanying drawings.

[0038] Figure 1 A flow chart of a method for establishing a communication connection in an embodiment of the present disclosure is shown, which is applied to a client. Figure 1 As shown, the method comprises the following steps:

[0039] S102, sending an identity authentication request to the server, wherein the identity authentication request carries the client's identity information and a first connection identifier, and the first connection identifier is used for the client to establish a Fast User Datagram Protocol Internet Connection QUIC connection with the server and is an identifier that uniquely identifies the client.

[0040] In one embodiment of the present disclosure, the client first sends an identity authentication request to the server, and the identity authentication request may carry the identity information of the client side and the first connection identifier CID. The first connection identifier is randomly generated by the client according to the preset field length, and a single authentication can be performed to replace the terminal IP-oriented authentication used in the relevant technology to avoid the knock-on amplification vulnerability caused by the shared IP exit. The first connection identifier is used to uniquely identify the client.

[0041] S104, monitor whether a second connection identifier returned by the server is received, wherein the second connection identifier is a connection identifier generated by the server based on the first connection identifier, and the second connection identifier is used by the client to establish a QUIC connection with the server and uniquely identifies the server.

[0042] In one embodiment of the present disclosure, the client can monitor whether a second connection identifier CID returned by the server is received within a preset time period. The second connection identifier is randomly generated according to a preset field length after the server verifies the first connection identifier and confirms that the verification is passed. The field length of the second connection identifier can be the same as the field length of the first connection identifier. The second connection identifier is used to uniquely identify the server.

[0043] S106: If the second connection identifier returned by the server is received, a communication connection is established between the client and the server according to the second connection identifier and the QUIC protocol.

[0044] In one embodiment of the present disclosure, after receiving the second connection identifier returned by the server, the client can establish a communication connection with the server according to the second connection identifier and the QUIC protocol.

[0045] As can be seen from the above, in the disclosed embodiment, the client sends an identity authentication request to the server, and monitors whether the second connection identifier returned by the server is received. If so, a communication connection between the client and the server is established according to the second connection identifier and the QUIC protocol. The disclosed embodiment can maintain the continuity of access between the client and the server when the IP address changes, thereby improving the security during the access process.

[0046] In one embodiment of the present disclosure, after the above S104, the method further includes: if the second connection identifier returned by the server is not received, resending the identity authentication request to the server within a preset time period until the second connection identifier returned by the server is received.

[0047] In one embodiment of the present disclosure, there is a possibility that the first connection identifier fails to be verified on the server side. The client can repeatedly send identity authentication requests to the server within a preset time period, at a preset time interval or a preset number of times, until the client receives a second connection identifier returned by the server or exceeds the preset time period, and then stops sending identity authentication requests to the server. It should be noted that the number of times or time intervals at which the client resends the identity authentication request to the server can be determined according to actual conditions, and the present embodiment does not specifically limit this.

[0048] In one embodiment of the present disclosure, after the above S106, the method also includes: detecting whether the IP address of the client has changed; in the case where the IP address of the client has changed, verifying whether the first connection identifier is valid; if so, maintaining the communication connection between the client and the server; if not, re-sending an identity authentication request to the server to re-establish the communication connection between the client and the server.

[0049] In one embodiment of the present disclosure, the IP address of the client may change due to the influence of the network environment change. Therefore, the IP address of the client can be continuously detected, and when the IP address of the client is detected to change, it is verified whether the first connection identifier is valid.

[0050] In one embodiment of the present disclosure, the first connection identifier usually has a validity period, and whether the first connection identifier is valid can be determined by whether the validity period has expired. If the first connection identifier is still valid, the communication connection between the client and the server is maintained unchanged; if the first connection identifier is invalid, it is necessary to redefine the validity period for the first connection identifier, and then re-send the identity authentication request to the server based on the first connection identifier, and re-establish the communication connection between the two.

[0051] In one embodiment of the present disclosure, if the first connection identifier is invalid, a connection identifier can be regenerated on the client side according to a preset field length, and a validity period can be defined for it, and the newly generated connection identifier can be carried in the identity authentication request to be sent to the server.

[0052] Figure 2 A flow chart of another communication connection establishment method in an embodiment of the present disclosure is shown, which is applied to a server. Figure 2 As shown, the method comprises the following steps:

[0053] S202, receiving an identity authentication request sent by a client, wherein the identity authentication request carries identity information of the client and a first connection identifier, and the first connection identifier is used by the client to establish a Fast User Datagram Protocol Internet Connection QUIC connection with a server and is an identifier that uniquely identifies the client.

[0054] S204: Verify whether the first connection identifier is valid according to a predetermined verification rule.

[0055] In one embodiment of the present disclosure, the identity authentication request may be a single-packet authorization SPA verification package sent by the client to the server. The server and the client may predetermine the verification rules, for example, verifying a pre-set shared key, verifying whether the timestamp included in the SPA package is within a preset time range, verifying the validity and / or legality of a preset CID, or verifying the user credentials included in the SPA package (for example, a user name, a password hash value, etc.).

[0056] It should be noted that any verification rule that can verify the identity of the client can be adopted according to actual conditions, and the embodiments of the present disclosure do not make specific limitations on this.

[0057] S206: If yes, generate a second connection identifier based on the first connection identifier, and return the second connection identifier to the client, wherein the second connection identifier is used by the client to establish a QUIC connection with the server and uniquely identifies the server.

[0058] In one embodiment of the present disclosure, after the first connection identifier (i.e., the CID that uniquely identifies the client) passes verification, the server may randomly generate a second connection identifier according to a preset field length (which may be the same as the client CID field length), i.e., the CID that uniquely identifies the server. For example, a random number generator may be used to create the CID to ensure that each CID is random and difficult to predict, thereby increasing security.

[0059] In one embodiment of the present disclosure, the first connection identifier and other information (for example, a timestamp, a server private key or a random number, etc.) can also be combined to generate a server CID using a preset hash algorithm, which can introduce more entropy while maintaining association with the client CID.

[0060] It should be noted that the above is only an example of a method for generating a second connection identifier through a first connection identifier. Any other method for generating a second connection identifier under the premise of ensuring the correlation between the client CID and the server CID may also be used. The embodiments of the present disclosure do not make specific limitations on this.

[0061] As can be seen from the above, in the disclosed embodiment, after receiving the identity authentication request sent by the client, the server verifies whether the first connection identifier carried in the request is valid according to a predetermined verification rule, and if so, generates a second connection identifier based on the first connection identifier and returns it to the client. The disclosed embodiment can maintain the continuity of access between the client and the server in the event of a change in the IP address, thereby improving the security during the access process.

[0062] Figure 3A flow chart of signaling interaction for establishing a communication connection in an embodiment of the present disclosure is shown as follows: Figure 3 As shown, the interaction process includes the following steps:

[0063] S301, the client sends a single-packet authorization UDP+CID SPA packet based on the User Datagram Protocol and the connection identifier to the server.

[0064] In one embodiment of the present disclosure, the UDP+CID SPA packet may carry authentication information and a CID generated by the client side for uniquely identifying the client, namely, a source CID. The source CID is randomly generated based on a preset field length and is independent of the IP address. The present disclosure embodiment implements connection-oriented identification negotiation through the knocking method of UDP+CID SPA.

[0065] In one embodiment of the present disclosure, the information carried in the SPA packet may be as shown in the following table:

[0066] Table 1

[0067] Name of the information carried in the SPA package Example Timestamp 2021-05-26 17:30:00 Version Number 1.0.1 username Alice Message Type UDP Request Port 62201 Random Characters pT5CZgPChkbZf40m Client IP 192.168.0.10 Server IP 172.16.10.10 Source CID 0x123456789abcdef0 CID validity period 30min / 1h / … Firewall rules ACCEPT / DROPREJECT Three-party authentication information KEY / HMAC

[0068] It should be noted that the SPA package can carry any identity authentication information according to actual conditions. The information in the above table is only for illustrative purposes. The embodiments of the present disclosure do not specifically limit the information carried in the SPA package and the content of the information.

[0069] S302: After receiving the SPA package, the server extracts the identity authentication information and source CID therein for verification.

[0070] In one embodiment of the present disclosure, the server verifies the identity authentication information and source CID extracted from the SPA packet according to a preset verification rule. Specifically, it may include but is not limited to decrypting the identity authentication information according to a preset shared key or other security mechanism, verifying whether the timestamp information carried in the SPA packet is within a preset time range, or confirming the validity and legality of the CID, etc.

[0071] It should be noted that any one or more identity authentication methods may be adopted according to actual conditions, and the embodiments of the present disclosure do not specifically limit this.

[0072] S303: If the client identity authentication is successful, the server generates a destination CID based on the source CID.

[0073] In one embodiment of the present disclosure, the target CID is a CID used to uniquely identify the server.

[0074] In one embodiment of the present disclosure, the server may randomly generate a destination CID according to a preset field length (which may be the same as the source CID field length). Specifically, a random number generator may be used to create the CID, for example, to ensure that each CID is random and difficult to predict, thereby increasing security.

[0075] In one embodiment of the present disclosure, the source CID and other information (for example, a timestamp, a server private key or a random number, etc.) may be combined to generate a destination CID using a preset hash algorithm, which may introduce more entropy while maintaining association with the source CID.

[0076] S304: The server returns the destination CID to the client.

[0077] S305, the server can dynamically adjust the firewall rule IP ACL according to the verification result to allow specific traffic to pass through to access the target service.

[0078] S306: The client establishes a communication connection with the server based on the received destination CID and QUIC protocol.

[0079] It should be noted that the above S305 can be executed at any position between S302 and S304, and the embodiment of the present disclosure does not specifically limit this.

[0080] From the above, it can be seen that in the knocking authentication and subsequent communication connection scenarios of the software-defined boundary SDP, based on the UDP+CID SPA packet, CID is used to determine whether the verification packet and the communication establishment packet belong to the same sender. The verification is based on a single connection, which is more secure. At the same time, for the connection established based on QUIC, as long as the CID, transport layer security protocol TLS key and other information are still retained, the original connection can be seamlessly reused even when the network environment changes, eliminating the reconnection cost and realizing connection migration.

[0081] In one embodiment of the present disclosure, the above signaling interaction process can also be modularized. Specifically, it includes a UDP+CID knocking authentication module and a QUIC protocol transmission module, wherein the UDP+CID knocking authentication module, as a part of the SDP pre-knock authentication, can include a UDP+CID knocking authentication module on the client and a UDP+CID knocking authentication module on the server.

[0082] In one embodiment of the present disclosure, the UDP+CID knocking authentication module on the client is used to carry the user identity information and the source CID of the connection established this time in the identity verification information to facilitate identity verification, wherein the source CID can be a CID randomly generated according to a preset field length, independent of the IP address; the UDP+CID knocking authentication module on the server is used to complete the verification of the SPA packet, and generate the corresponding server-side destination CID based on the source CID after the verification passes.

[0083] In one embodiment of the present disclosure, the QUIC protocol transmission module is used to provide network connection and data transmission after SPA authentication based on the QUIC protocol. Specifically, Figure 4 A schematic diagram of a data packet structure of a QUIC protocol in an embodiment of the present disclosure is shown. Figure 4 As shown in the figure, UDP Header represents the UDP header, which is used to transmit data packets in the network, including fields such as source port, destination port, length and checksum; Packet Header represents the packet header unique to the QUIC protocol, which is used to identify the basic information of the QUIC packet, and may include information such as version number and packet type; the header information of the QUIC protocol contains the following fields: Source CID represents the connection ID of the client, which is used to uniquely identify the client; Destination CID represents the connection ID of the server, which is used to uniquely identify the server; Payload contains actual data or control information. Among them, Packet Header, Source CID, Destination CID and Payload are encrypted and transmitted through TLS to ensure data security.

[0084] In one embodiment of the present disclosure, as the payload part of the UDP message, the QUIC protocol identifies each connection in the packet header based on the destination CID instead of the traditional source address IP and destination address IP. After the negotiation of the source CID and the destination CID is completed through the first knock authentication, subsequent communications can identify each connection based on the single identifier of the destination CID, and establish reliable transmission over a TLS tunnel based on UDP. During the validity period of the connection (i.e., the validity period of the source CID), a continuous connection that is not affected by changes in the network IP can be achieved. After the validity period, the UDP+CID SPA authentication can be initiated again on the client side based on the existing source CID to maintain the connection, or authentication for starting a new connection can be performed after a disconnection.

[0085] In one embodiment of the present disclosure, the knock authentication performs a single authentication for the connection identifier, replacing the traditional authentication for the client IP, avoiding the knock amplification vulnerability caused by the shared IP exit. At the same time, after the knock authentication, the communication connection is established and maintained based on the QUIC protocol based on the IP-independent CID. Subsequent business access between the client and the server is based on this connection, and the continuity of end-to-end access can still be maintained in an environment where the network IP changes.

[0086] Figure 5 A flow chart of another method for establishing a communication connection in an embodiment of the present disclosure is shown as follows: Figure 5 As shown, the method comprises the following steps:

[0087] S501, the client sends a SPA packet to the server.

[0088] In one embodiment of the present disclosure, the SPA knock packet carries the client's identity authentication information and source CID.

[0089] S502, the server extracts the identity authentication information in the SPA package to confirm whether the client has passed the verification. If passed, execute S503; if not, execute S501.

[0090] S503: The server generates a destination CID based on the acquired source CID, and returns the destination CID to the client.

[0091] In one embodiment of the present disclosure, the destination CID is an identifier used to establish a subsequent communication connection.

[0092] S504: The client establishes a TLS connection between the client and the server based on the QUIC protocol on the basis of UDP packet transmission.

[0093] In one embodiment of the present disclosure, at this time, the data packet identification between the client and the server depends on the CID rather than the IP address.

[0094] S505, monitor whether the client IP address has changed. If not, execute 506; if so, execute S507.

[0095] S506: Keep the connection between the client and the server unchanged.

[0096] S507, the client confirms whether to continue the connection. If yes, execute S508; if no, execute S509.

[0097] In one embodiment of the present disclosure, the connection duration of the client may be preset, that is, within the preset duration, the client is required to continue to be connected by default, and beyond the preset duration, the client is not required to remain connected by default.

[0098] S508, the client verifies whether the source CID is still valid. If yes, execute S506; if no, execute S501.

[0099] S509, the client sends a termination SPA packet with a very short validity period to the server.

[0100] In one embodiment of the present disclosure, the SPA termination packet is used for the client to actively disconnect the communication connection with the server.

[0101] As can be seen from the above, in the disclosed embodiment, after the client sends an identity authentication request to the server, the server verifies whether the first connection identifier carried therein is valid. If so, a second connection identifier is generated based on the first connection identifier and returned to the client, so that the client establishes a communication connection between the client and the server based on the second connection identifier and the QUIC protocol. The disclosed embodiment can maintain the continuity of access between the client and the server in the event of a change in the IP address, thereby improving the security during the access process.

[0102] Figure 6 A schematic diagram of the structure of a communication system in an embodiment of the present disclosure is shown. Figure 6 As shown, the system includes: a client 601 and a server 602.

[0103] The client 601 is used to send an identity authentication request to the server 602, wherein the identity authentication request carries the identity information of the client 601 and a first connection identifier, and the first connection identifier is used by the client 601 to establish a fast user datagram protocol Internet connection QUIC connection with the server 602 and uniquely identifies the client 601;

[0104] The server 602 is used to receive the identity authentication request sent by the client 601;

[0105] The server 602 is also used to verify whether the first connection identifier is valid according to a predetermined verification rule. If so, a second connection identifier is generated based on the first connection identifier, and the second connection identifier is returned to the client 601, wherein the second connection identifier is used by the client 601 to establish a QUIC connection with the server 602 and uniquely identifies the server 602;

[0106] Among them, if the client 601 receives the second connection identifier returned by the server 602, it is used to establish a communication connection between the client 601 and the server 602 according to the second connection identifier and the QUIC protocol.

[0107] As can be seen from the above, in the disclosed embodiment, after the client sends an identity authentication request to the server, the server verifies whether the first connection identifier carried therein is valid. If so, a second connection identifier is generated based on the first connection identifier and returned to the client, so that the client establishes a communication connection between the client and the server based on the second connection identifier and the QUIC protocol. The disclosed embodiment can maintain the continuity of access between the client and the server in the event of a change in the IP address, thereby improving the security during the access process.

[0108] Based on the same inventive concept, the present disclosure also provides a terminal device in the following embodiments. Since the principle of solving the problem in the device embodiment is similar to that in the above method embodiment, the implementation of the device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0109] Figure 7 A schematic diagram of the structure of a terminal device in an embodiment of the present disclosure is shown. Figure 7 As shown, the device includes: a verification request sending module 701, a connection identification detection module 702 and a communication connection establishment module 703.

[0110] Among them, the verification request sending module 701 is used to send an identity authentication request to the server, wherein the identity authentication request carries the client's identity information and a first connection identifier, the first connection identifier is used by the client to establish a Fast User Datagram Protocol Internet Connection QUIC connection with the server and is an identifier that uniquely identifies the client; the connection identifier detection module 702 is used to monitor whether a second connection identifier returned by the server is received, wherein the second connection identifier is a connection identifier generated by the server based on the first connection identifier, and the second connection identifier is used by the client to establish a QUIC connection with the server and is an identifier that uniquely identifies the server; the communication connection establishment module 703 is used to establish a communication connection between the client and the server according to the second connection identifier and the QUIC protocol if the second connection identifier returned by the server is received.

[0111] As can be seen from the above, in the disclosed embodiment, the client sends an identity authentication request to the server, and monitors whether the second connection identifier returned by the server is received. If so, a communication connection between the client and the server is established according to the second connection identifier and the QUIC protocol. The disclosed embodiment can maintain the continuity of access between the client and the server when the IP address changes, thereby improving the security during the access process.

[0112] In one embodiment of the present disclosure, the device also includes: a secondary verification request sending module 704, which is used to re-send an identity authentication request to the server within a preset time period if the second connection identifier returned by the server is not received, until the second connection identifier returned by the server is received.

[0113] In one embodiment of the present disclosure, the device also includes: an IP address detection module 705, which is used to detect whether the IP address of the client has changed; in the case where the IP address of the client has changed, verify whether the first connection identifier is valid; if so, maintain the communication connection between the client and the server; if not, re-send an identity authentication request to the server to re-establish the communication connection between the client and the server.

[0114] Based on the same inventive concept, the embodiment of the present disclosure also provides a server, as described in the following embodiment. Since the principle of solving the problem in the device embodiment is similar to that in the above method embodiment, the implementation of the device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0115] Figure 8 A schematic diagram of the structure of a server in an embodiment of the present disclosure is shown. Figure 8 As shown, the device includes: a verification request receiving module 801, a connection identifier verification module 802 and a connection identifier returning module 803.

[0116] Among them, the verification request receiving module 801 is used to receive the identity authentication request sent by the client, wherein the identity authentication request carries the client's identity information and a first connection identifier, the first connection identifier is used for the client to establish a Fast User Datagram Protocol Internet Connection QUIC connection with the server and uniquely identifies the client; the connection identifier verification module 802 is used to verify whether the first connection identifier is valid according to a predetermined verification rule; the connection identifier returning module 803 is used to, if so, generate a second connection identifier based on the first connection identifier, and return the second connection identifier to the client, wherein the second connection identifier is used for the client to establish a QUIC connection with the server and uniquely identifies the server.

[0117] As can be seen from the above, in the disclosed embodiment, after receiving the identity authentication request sent by the client, the server verifies whether the first connection identifier carried in the request is valid according to a predetermined verification rule, and if so, generates a second connection identifier based on the first connection identifier and returns it to the client. The disclosed embodiment can maintain the continuity of access between the client and the server in the event of a change in the IP address, thereby improving the security during the access process.

[0118] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0119] Refer to the following Fig. 9 The electronic device 900 according to this embodiment of the present disclosure is described. Fig. 9 The electronic device 900 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0120] like Fig. 9 As shown, the electronic device 900 is in the form of a general computing device. The components of the electronic device 900 may include but are not limited to: at least one processing unit 910, at least one storage unit 920, and a bus 930 connecting different system components (including the storage unit 920 and the processing unit 910).

[0121] The storage unit stores program codes, which can be executed by the processing unit 910, so that the processing unit 910 executes the steps described in the above “Exemplary Method” section of this specification according to various exemplary embodiments of the present disclosure.

[0122] In one embodiment of the present disclosure, when the electronic device 900 is a terminal device, the processing unit 910 may execute the following steps of the above method embodiment: sending an identity authentication request to the server, wherein the identity authentication request carries the client's identity information and a first connection identifier, the first connection identifier is used by the client to establish a Fast User Datagram Protocol Internet Connection QUIC connection with the server and is an identifier that uniquely identifies the client; monitoring whether a second connection identifier returned by the server is received, wherein the second connection identifier is a connection identifier generated by the server based on the first connection identifier, the second connection identifier is used by the client to establish a QUIC connection with the server and is an identifier that uniquely identifies the server; if the second connection identifier returned by the server is received, establishing a communication connection between the client and the server according to the second connection identifier and the QUIC protocol.

[0123] In one embodiment of the present disclosure, when the electronic device 900 is a server, the processing unit 910 may execute the following steps of the above method embodiment: receiving an identity authentication request sent by a client, wherein the identity authentication request carries the client's identity information and a first connection identifier, the first connection identifier being used by the client to establish a Quick User Datagram Protocol Internet Connection QUIC connection with the server and uniquely identifying the client; verifying whether the first connection identifier is valid according to a predetermined verification rule; if so, generating a second connection identifier based on the first connection identifier, and returning the second connection identifier to the client, wherein the second connection identifier is used by the client to establish a QUIC connection with the server and uniquely identifying the server.

[0124] The storage unit 920 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 9201 and / or a cache storage unit 9202 , and may further include a read-only storage unit (ROM) 9203 .

[0125] The storage unit 920 may also include a program / utility 9204 having a set (at least one) of program modules 9205, such program modules 9205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0126] Bus 930 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0127] The electronic device 900 may also communicate with one or more external devices 940 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 900, and / or may communicate with any device that enables the electronic device 900 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 950. Furthermore, the electronic device 900 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 960. As shown, the network adapter 960 communicates with other modules of the electronic device 900 via a bus 930. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 900, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0128] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0129] Based on the same inventive concept, a computer-readable storage medium is also provided in the embodiment of the present disclosure, on which a computer program is stored, and when the computer program is executed by a processor, any one of the above communication connection establishment methods is implemented. Since the principle of solving the problem in the embodiment of the computer-readable storage medium is similar to that in the above method embodiment, the implementation of the embodiment of the computer-readable storage medium can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0130] More specific examples of computer-readable storage media in the present disclosure may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0131] In the present disclosure, a computer readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0132] Alternatively, the program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0133] In a specific implementation, the program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0134] Based on the same inventive concept, a computer program product is also provided in the embodiments of the present disclosure, including a computer program product, including: a computer program or an instruction, wherein when the computer program or the instruction is executed by a processor, the communication connection establishment method of any one of the above method embodiments is implemented. Since the principle of solving the problem in the computer program product embodiment is similar to that in the above method embodiment, the implementation of the computer program product embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0135] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0136] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0137] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0138] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A method for establishing a communication connection, characterized in that: Applied to the client, including: Sending an identity authentication request to the server, wherein the identity authentication request carries the identity information of the client and a first connection identifier, where the first connection identifier is used by the client to establish a Fast User Datagram Protocol Internet Connection (QUIC) connection with the server and uniquely identifies the client; Monitoring whether a second connection identifier returned by the server is received, wherein the second connection identifier is a connection identifier generated by the server based on the first connection identifier, and the second connection identifier is used by the client to establish a QUIC connection with the server and uniquely identifies the server; If a second connection identifier returned by the server is received, a communication connection is established between the client and the server according to the second connection identifier and the QUIC protocol.

2. The method for establishing a communication connection according to claim 1, characterized in that: After monitoring whether the second connection identifier returned by the server is received, the method further includes: If the second connection identifier returned by the server is not received, the identity authentication request is resent to the server within a preset time period until the second connection identifier returned by the server is received.

3. The method for establishing a communication connection according to claim 1, characterized in that: After establishing a communication connection between the client and the server according to the second connection identifier and the QUIC protocol, the method further includes: Detect whether the client's IP address has changed; In the case where the IP address of the client changes, verifying whether the first connection identifier is valid; If yes, maintaining the communication connection between the client and the server; If not, then resend the identity authentication request to the server to re-establish the communication connection between the client and the server.

4. A method for establishing a communication connection, characterized in that: Applied to the server, including: Receive an identity authentication request sent by a client, wherein the identity authentication request carries identity information of the client and a first connection identifier, where the first connection identifier is used by the client to establish a Fast User Datagram Protocol Internet Connection (QUIC) connection with the server and uniquely identifies the client; Verifying whether the first connection identifier is valid according to a predetermined verification rule; If so, a second connection identifier is generated based on the first connection identifier, and the second connection identifier is returned to the client, wherein the second connection identifier is used by the client to establish a QUIC connection with the server and uniquely identifies the server.

5. A communication system, characterized in that: include: Client and server; The client is used to send an identity authentication request to the server, wherein the identity authentication request carries the identity information of the client and a first connection identifier, and the first connection identifier is used by the client to establish a Fast User Datagram Protocol Internet Connection QUIC connection with the server and uniquely identifies the client; The server is used to receive the identity authentication request sent by the client; The server is further used to verify whether the first connection identifier is valid according to a predetermined verification rule. If so, a second connection identifier is generated based on the first connection identifier, and the second connection identifier is returned to the client, wherein the second connection identifier is used by the client to establish a QUIC connection with the server and uniquely identifies the server; Among them, the client is also used to establish a communication connection between the client and the server according to the second connection identifier and the QUIC protocol if it receives a second connection identifier returned by the server.

6. A terminal device, characterized in that: include: A verification request sending module, used to send an identity authentication request to a server, wherein the identity authentication request carries the identity information of the client and a first connection identifier, and the first connection identifier is used by the client to establish a Fast User Datagram Protocol Internet Connection QUIC connection with the server and uniquely identifies the client; a connection identifier detection module, used to monitor whether a second connection identifier returned by the server is received, wherein the second connection identifier is a connection identifier generated by the server based on the first connection identifier, and the second connection identifier is used by the client to establish a QUIC connection with the server and uniquely identifies the server; A communication connection establishing module is used to establish a communication connection between the client and the server according to the second connection identifier and the QUIC protocol if a second connection identifier returned by the server is received.

7. A server, characterized in that: include: A verification request receiving module, used to receive an identity authentication request sent by a client, wherein the identity authentication request carries the identity information of the client and a first connection identifier, and the first connection identifier is used by the client to establish a Fast User Datagram Protocol Internet Connection QUIC connection with a server and uniquely identifies the client; A connection identifier verification module, used to verify whether the first connection identifier is valid according to a predetermined verification rule; A connection identifier returning module is used to generate a second connection identifier based on the first connection identifier, and return the second connection identifier to the client, wherein the second connection identifier is used by the client to establish a QUIC connection with the server and uniquely identifies the server.

8. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the communication connection establishment method according to any one of claims 1 to 4 by executing the executable instructions.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the communication connection establishment method according to any one of claims 1 to 4 is implemented.

10. A computer program product comprising: A computer program or instruction, characterized in that when the computer program or instruction is executed by a processor, it implements the communication connection establishment method described in any one of claims 1 to 4.

Images