Traffic access method and device, electronic equipment and storage medium
By pre-establishing multiple secure connection channels and selecting available channels during subsequent access, the problem of secure connection establishment delay in traditional server access methods is solved, and traffic access efficiency is improved.
Patent Information
- Application Number
- CN202411716059.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-27
- Publication Date
- 2025-04-11
AI Technical Summary
Traditional server-side access methods have high latency when establishing secure connections, which affects traffic access efficiency.
By pre-establishing multiple secure connection channels, select available target secure connection channels directly from these channels during subsequent access, avoiding re-establishing of secure connections every time you access.
It effectively reduces the delay when each client in the target device performs traffic access, and improves traffic access efficiency.
Smart Images
Figure CN119814352A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer technology, and in particular to a flow access method, device, electronic device and storage medium. Background Art
[0002] Currently, a software client in an electronic device can obtain data provided by a server by accessing the server.
[0003] The traditional server access method is that after the client establishes a connection with the electronic device, the electronic device needs to select the corresponding proxy server according to the server accessed by the client, and establish a handshake connection with the proxy server and perform a handshake check. After the proxy server completes the handshake check, it establishes a secure connection with the server, thereby realizing communication between the client and the server. There will be a high delay in the entire access process. Summary of the invention
[0004] In view of the above problems, the present application provides a traffic access method, device, electronic device and storage medium. By pre-establishing multiple secure connection channels, the available target secure connection channel is directly selected from the pre-established secure connection channels during subsequent use, thereby avoiding the delay caused by the need to establish a secure channel when each client in the target device performs traffic access, thereby effectively improving the traffic access efficiency.
[0005] The embodiment of the present application is implemented by adopting the following technical solutions:
[0006] In a first aspect, an embodiment of the present application provides a traffic access method, which is applied to a target device, and the method includes: if application traffic sent by a target client that establishes a communication connection with the target device is received, selecting an available target secure connection channel from multiple pre-established secure connection channels; generating a traffic request based on the application traffic and information of a target proxy server connected to the target secure connection channel, wherein the traffic request carries the application traffic; sending the traffic request to the target proxy server through the target secure connection channel, so that the target proxy server forwards the application traffic to the server based on the traffic request; receiving a traffic response fed back by the target proxy server through the target secure connection channel, the traffic response including an application response generated by the server in response to the application traffic; and sending the application response to the target client.
[0007] In a second aspect, an embodiment of the present application provides a traffic access device, which is applied to a target device, and the device includes: a channel selection module, which is used to select an available target secure connection channel from multiple pre-established secure connection channels when receiving application traffic sent by a target client that establishes a communication connection with the target device; a request generation module, which is used to generate a traffic request based on the application traffic and information of a target proxy server connected to the target secure connection channel, wherein the traffic request carries the application traffic; a request sending module, which is used to send the traffic request to the target proxy server through the target secure connection channel, so that the target proxy server forwards the application traffic to the server based on the traffic request; a response receiving module, which is used to receive a traffic response fed back by the target proxy server through the target secure connection channel, and the traffic response includes an application response generated by the server in response to the application traffic; and a response sending module, which is used to send the application response to the target client.
[0008] In one possible implementation, the device also includes: a connection closing module, which is used to disconnect the communication connection with the target client in response to the connection closing request when receiving the connection closing request sent by the target client, and generate an indication message; an indication message sending module, which is used to send the indication message to the target proxy server, so that the target proxy server disconnects the communication connection with the server in response to the indication message, wherein the target secure connection channel is available after the target proxy server disconnects the communication connection with the server.
[0009] In one possible implementation, a secure connection pool is provided in the target device, and the secure connection pool stores channel information of multiple pre-established and available secure connection channels. The device also includes an information storage module, and the channel selection module is further used to select an available target secure connection channel from multiple secure connection channels based on the channel information of the multiple secure connection channels stored in the secure connection pool; delete the channel information of the target secure connection channel from the secure connection pool; the information storage module is used to store the channel information of the target secure connection channel in the secure connection pool when it is confirmed that the target proxy server has disconnected the communication connection with the server.
[0010] In one possible implementation, a secure connection pool is provided in the target device, there is at least one proxy server, and there is at least one secure transmission channel established between the target device and each of the proxy servers. The apparatus further comprises: a message sending module, configured to send a first message to the proxy server, so that the proxy server establishes a connection with the target client in response to the first message, and generates a connection establishment feedback message; a message receiving module, configured to send a second message to the proxy server based on a secure transmission protocol if the connection establishment feedback message sent by the proxy server is received, so that the proxy server establishes a secure transmission channel between the target device and the server based on the secure transmission protocol in response to the second message; and storing the channel information of the secure transmission channel in the secure connection pool.
[0011] In one possible implementation, a secure connection pool is provided in the target device, and the secure connection pool stores channel information of multiple pre-established and available secure connection channels. The device also includes an information deletion module for deleting the channel information in the secure connection pool when it is determined that the public network address of the target device has changed.
[0012] In one possible implementation, the secure transmission protocol includes the SSL protocol or the TSL protocol.
[0013] In one possible implementation, the target device stores a correspondence between the client and the proxy server; the channel selection module is also used to determine the target proxy server corresponding to the target client based on the correspondence; and select an available target secure connection channel from a pre-established secure connection channel connected to the target proxy server.
[0014] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a communication interface; one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the above-mentioned traffic access method.
[0015] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a program code, and the program code can be called by a processor to execute the above-mentioned traffic access method.
[0016] The traffic access method, device, electronic device and storage medium provided by the embodiment of the present application include: if application traffic sent by a target client that establishes a communication connection with the target device is received, an available target secure connection channel is selected from multiple pre-established secure connection channels; a traffic request is generated based on the application traffic and information of a target proxy server connected to the target secure connection channel, wherein the traffic request carries the application traffic; the traffic request is sent to the target proxy server through the target secure connection channel, so that the target proxy server forwards the application traffic to the server based on the traffic request; the traffic response fed back by the target proxy server through the target secure connection channel is received, and the traffic response includes an application response generated by the server in response to the application traffic; and the application response is sent to the target client. The above method is adopted to pre-establish multiple secure connection channels, and in the subsequent use process, an available target secure connection channel is directly selected from the pre-established secure connection channel, thereby avoiding the delay caused by the need to establish a secure channel when each client in the target device performs traffic access, thereby effectively improving the traffic access efficiency.
[0017] These and other aspects of the present application will become more clearly understood in the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS
[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.
[0019] Figure 1 It is a timing diagram of a traffic access method proposed in the related art.
[0020] Figure 2 It is a timing diagram of a traffic access method provided in an embodiment of the present application.
[0021] Figure 3 This is another timing diagram of a traffic access method provided in an embodiment of the present application.
[0022] Figure 4 It is a schematic diagram of a hierarchical architecture of a target device and a target proxy server provided in an embodiment of the present application.
[0023] Figure 5 It is a framework diagram of a traffic access method provided in an embodiment of the present application.
[0024] Figure 6It is a flowchart of a traffic access method provided in an embodiment of the present application.
[0025] Figure 7 It is a connection block diagram of a traffic access device provided in an embodiment of the present application.
[0026] Figure 8 It is a schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0027] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be understood as limiting the present application.
[0028] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present application.
[0029] like Figure 1 As shown, in the related technology, when a software client in an electronic device can obtain data provided by the server by accessing the server, the electronic device usually acts as a proxy gateway device for the software client installed thereon, the electronic device and the client are in a local environment, and the proxy server and the server are in an intranet environment; the specific access process is a communication connection between the client and the electronic device (e.g., a TCP handshake connection), then the electronic device establishes a communication connection with the proxy server (e.g., a TCP handshake connection), and a secure connection (e.g., a TLS connection) is established on the basis of the communication connection between the electronic device and the proxy server, after the proxy server establishes a secure connection with the electronic device, it establishes a communication connection with the server (e.g., a TCP handshake connection), so that data can be exchanged between the client and the server through the electronic device and the proxy server, such as the client sends application traffic to the server through the electronic device and the proxy server, so that the server responds to the application traffic and feeds back a corresponding application response to the client, and subsequently, when the data interaction between the client and the server is completed, the communication connections between the client and the electronic device, the electronic device and the proxy server, and the proxy server and the server are closed in turn.
[0030] In the above process, when transmitting data between the electronic device and the proxy server using the public network, an RTT (Round-Trip Time) is usually 40-100ms, which is much longer than the delay generated by the data transmission process in the intranet environment and the local environment. When creating a connection between the client and the server and transmitting data, an RTT is generated when establishing a communication connection between the electronic device and the proxy server, two RTTs are generated when establishing a secure connection, and another RTT is generated when transmitting data. Therefore, the entire connection establishment and data transmission process usually generates a delay of at least 160-400ms, which greatly affects the access efficiency.
[0031] Based on this, the present application provides a traffic access method, which selects an available target secure connection channel from multiple pre-established secure connection channels when receiving application traffic sent by a target client that establishes a communication connection with the target device; sends a traffic request to a target proxy server through the target secure connection channel, so that the target proxy server determines the server according to the application traffic in the traffic request, establishes a communication connection between the servers, and sends application traffic to the server; receives a traffic response fed back by the target proxy server through the target secure connection channel, the traffic response includes an application response generated by the server in response to the application traffic; and sends the application response to the target client. By adopting the method provided by the present application, there is no need to establish a secure connection between the target device and the proxy server every time traffic access is performed, thereby effectively improving access efficiency.
[0032] The embodiments of the present application will be described in detail below with reference to the accompanying drawings.
[0033] like Figure 2 , Figure 2 A flow chart of a traffic access method provided in an embodiment of the present application, which can be applied to Figure 2 The traffic access system shown includes a target device, a target client installed on the target device, a target proxy server and a server.
[0034] The client refers to the application client installed on the target device, such as an instant messaging client, a content interaction client, an audio and video client, etc.
[0035] The target device may be a mobile terminal such as a mobile phone, a tablet computer, an e-book reader, etc.; or, the target device may also be a laptop computer, a vehicle-mounted device, or a fixed computer, etc.
[0036] A server is a computer system that provides services, resources, or data on a network. It is usually a hardware device or software program that responds to requests from clients, such as files, web pages, database queries, or other types of services. Server components can be specially designed server hardware running specific server software, such as web servers (such as Apache, Nginx), database servers (such as MySQL, Oracle), mail servers, etc. The server is mainly used to perform the following tasks: Receive and process requests: listen to network ports, wait for and receive requests from clients. Process business logic: perform corresponding functions according to the request, such as querying the database, calculations, file operations, etc. Respond to processing results: encapsulate the processing results into a response message and send it back to the client through the network.
[0037] A proxy server is a network entity that acts as an intermediary between a client and a server (e.g., a website server, an application server). Its main responsibility is to receive requests from clients, forward those requests to the server, and transmit the server's responses back to the client. Proxy servers can operate at different network architecture levels (e.g., application layer, transport layer, etc.) and provide a variety of functions, including but not limited to: Access control: helps implement network access policies, restricts or allows specific network traffic. Cache service: stores frequently accessed content to speed up responses to subsequent identical requests. Anonymity: hides the client's real IP address and provides a certain degree of privacy protection. Data filtering: checks incoming and outgoing data to filter malicious content or information that does not comply with policies. Load balancing: distributes requests to multiple servers to balance the load of multiple servers.
[0038] When using the above-mentioned traffic access system to perform traffic access, the following steps are specifically performed:
[0039] After establishing a communication connection with the target device, the target client executes step S101: sending application traffic to the target device.
[0040] The target client may be any client installed on the target device that needs to communicate with the server. The target client may establish a communication connection with the target device and execute the above step S101 when data interaction with the corresponding server is required. Exemplarily, the target client may establish a communication connection with the target device and execute the above step S101 when performing initial data interaction, continuous data transmission, long polling, regular update, error retry, or application program interface call with the corresponding server.
[0041] The target client and the target device may establish a communication connection by establishing a TCP connection (Transmission Control Protocol), a UDP connection (User Datagram Protocol), or an HTTP(S) connection (Hypertext Transfer Protocol(Secure)). Figure 3 As shown, in one possible implementation mode of the present application, the communication connection established between the target client and the target device is a TCP connection, that is, specifically a process of establishing TCP through a three-way handshake protocol.
[0042] The application traffic sent by the target client to the target device can be a request data packet sent by the client to the server, which may include but is not limited to the following parameters: source address, destination address, port number, protocol type (such as HTTP, HTTPS, etc.), request method (GET, POST, etc.), request path, request header and request body, etc., for requesting data from the server.
[0043] When the target device receives the application traffic, step S102 is performed: selecting an available target secure connection channel from a plurality of pre-established secure connection channels.
[0044] The multiple pre-established secure connection channels are established between the target device and at least one proxy server, and there is at least one secure connection channel established between the target device and each proxy server.
[0045] A preconfigured proxy server list can be maintained on the target device, including the addresses, ports, supported security protocols (such as TLS, SSL, SSH tunnel, etc.) and necessary authentication information (user name, password) of multiple proxy servers. This list can be hard-coded in the application or dynamically updated by the administrator through configuration files, cloud service push, etc. The target device can pre-establish multiple secure connection channels based on the proxy server list it maintains.
[0046] In one possible implementation, a secure transmission channel between a target device and each proxy server is established in the following manner: the target device sends a first message to the proxy server, so that the proxy server establishes a connection with the target client in response to the first message and generates a connection establishment feedback message; after receiving the connection establishment feedback message sent by the proxy server, the target device sends a second message to the proxy server based on a secure transmission protocol, so that the proxy server establishes a secure transmission channel between the target device and the server based on the secure transmission protocol in response to the second message.
[0047] The above-mentioned secure connection may refer to a TLS connection or an SSL connection.
[0048] In this implementation, the first message that the target device can send to the proxy server is the first handshake message. The target device and the proxy server establish a TCP connection through a three-way handshake. After the TCP connection is established, a TLS handshake (Transport Layer Security) or SSL handshake (Secure Sockets Layer) is performed to establish a secure encrypted channel. The SSL / TLS connection establishment process is as follows: the target device sends a "Client Hello" message to the proxy server, which includes the highest TLS version supported by the target device, a list of encryption suites, a list of compression methods, and a randomly generated target device random number. The proxy server responds with a "Server Hello" message to confirm the connection parameters, including the selected protocol version, encryption suite, session ID, a randomly generated proxy server random number, and the proxy server's certificate. After the target device completes integer verification of the proxy server, it performs key exchange verification with the proxy server to complete the establishment of a secure transmission channel.
[0049] In another possible implementation, a secure transmission channel between the target device and each proxy server is established in the following manner: the target device uses its public network address to initiate a TCP connection request to the proxy server, and the request will include the client's intention to establish a secure connection (such as a TLS connection or an SSL connection). The proxy server responds to the connection request and sends its digital certificate. This certificate contains the server's public key and authentication information signed by a certificate authority (CA). The target device verifies the validity of the certificate, confirms that it is communicating with the expected proxy server and that the certificate has not been tampered with, and then negotiates an encryption algorithm and key between the target device and the proxy server. The negotiated encryption algorithm and key are subsequently used to encrypt and transmit data. All subsequent data transmission will be carried out within this secure channel, and even if the data is transmitted on the public network, it is not easily eavesdropped or tampered with by a third party.
[0050] There are many ways to select an available secure connection channel from a plurality of previously experienced secure connection channels.
[0051] In one possible implementation, an available target secure connection channel is randomly selected from multiple secure connection channels.
[0052] In another possible implementation, the application traffic carries the type of request data, a target proxy server is determined based on the type of request data and the data processing function corresponding to each proxy server, and an available target secure connection channel is selected from pre-established secure connection channels connected to the target proxy server.
[0053] In this implementation, when determining the target proxy server, the request data in the application traffic may be parsed to determine which service category (such as video streaming, web browsing, database query, etc.) the application traffic needs to request, so as to select a proxy server of the corresponding service category as the target proxy server. For example, if a video stream is requested to be transmitted, a proxy server whose data processing function is specially optimized for large-volume transmission and video encoding and decoding may be selected as the target proxy server.
[0054] In another possible implementation, the target device stores a correspondence between the client and the proxy server, and determines the target proxy server corresponding to the target client based on the correspondence; and selects an available target secure connection channel from pre-established secure connection channels connected to the target proxy server.
[0055] Among them, the availability of the secure connection channel can mean that the secure connection channel can be used for data transmission between the target device and the proxy server, or it can mean that the historical transmission quality (such as packet loss rate, delay) of the secure transmission channel meets the preset quality conditions, the security requirements meet the preset security conditions, etc. It can be set according to actual needs.
[0056] Considering that there may be multiple clients running at the same time in the target device and that they need to communicate through multiple secure transmission channels, in order to improve the efficiency of selecting available target secure channels, the selected secure channel can be marked after each selection of the secure transmission channel, such as marking the selected or currently used secure connection channel as unavailable or currently in use. Accordingly, each time a secure transmission channel is selected, an available secure transmission channel is selected from the unmarked secure transmission channels. When establishing a secure transmission channel, the established secure transmission channel can also be stored in a secure connection pool. Each subsequent selection requires selecting a target channel information from the channel information in the secure connection pool, and using the secure transmission channel corresponding to the target channel information as the target secure transmission channel. After the selection is completed, the target channel information is deleted from the secure connection pool to ensure that an available secure transmission channel can be selected later.
[0057] Step S103: The target device generates a traffic request based on the application traffic and information of the target proxy server connected to the target secure connection channel.
[0058] The traffic request carries the application traffic.
[0059] The information of the target proxy server may include the address and port number of the target proxy server.
[0060] It should be understood that in addition to application traffic, traffic requests may also include additional information such as client identification, session identification, protocol information of application traffic, and quality of service requirements, to help the proxy server make more fine-grained management and routing decisions.
[0061] Step S104: The target device sends the traffic request to the target proxy server through the target secure connection channel.
[0062] When the target device sends a traffic request to the proxy server through the target secure connection channel, the target device will encapsulate the traffic request. This usually means adding necessary protocol header information to encapsulate the original application traffic. The purpose of encapsulation is to protect the confidentiality, integrity and authenticity of the data, and also to enable it to be correctly decapsulated on the target proxy server and routed to the correct server. The encapsulated traffic request is sent to the target proxy server through the pre-selected available target secure connection channel.
[0063] like Figure 4 As shown, the process of the target device sending data to the target proxy server using the OSI model (Open System Interconnection Reference Model) is mainly concentrated in the session layer, transport layer and network layer. Specifically, the target client in the application layer of the OSI model first initiates application traffic, which may be an HTTP request, database query or any other form of data packet, containing the specific application data that the client wants to send to the server. The session layer refers to the selection of a suitable secure connection channel by the target device. The transport layer refers to the generation of traffic requests based on application traffic and target proxy server information on the selected target secure connection channel by the target device. If TCP is used as the transport protocol, this will involve functions such as sequence numbers, confirmation responses, flow control and error checking to ensure reliable data transmission. The TLS / SSL protocol is applied at the transport layer to encrypt traffic and provide additional security. Figure 4The OSI model of a specific target device is shown separately in the TLS layer, which is used to encrypt traffic. The network layer refers to the target secure connection channel, where data packets are packaged and carry the IP address and port number of the target proxy server, and are transmitted in the network through routing to select the appropriate path. Physical layer & data link layer: The actual data transmission occurs here, including signal encoding, decoding, selection of transmission media (such as Ethernet, Wi-Fi), and error detection and correction.
[0064] When the target proxy server receives the traffic request, step S105 is performed: determining the server according to the application traffic in the traffic request.
[0065] After receiving the encapsulated data packet, the target proxy server will first perform decapsulation to remove the outer layer of security and tunnel encapsulation to obtain the application traffic. The proxy server determines the server to which the application traffic is directed based on the information in the application traffic (such as the target address, port, etc.).
[0066] When the target proxy server receives the traffic request, the target proxy server OSI model transport layer: traffic request according to the TCP or UDP header information, sort, deduplicate, error check the data packets, and reassemble the data segments into the original traffic request. This stage will involve the use of TLS / LLS for decryption, etc. ( Figure 4 Specific diagram of the OSI model of the proxy server including the TLS layer for decryption is shown in FIG. 1 ). Session layer: Ensures that the traffic request is associated with an established session, which may involve session management and control. Application layer: The target proxy server parses the application data in the traffic request, determines the server, establishes or uses an existing connection with the server, and forwards the application traffic to the server.
[0067] Step S106: The target proxy server establishes a communication connection with the server.
[0068] When the target proxy server establishes a connection with the server, the specific connection establishment process is similar to the way the target client establishes a connection with the target device, and will not be described in detail here.
[0069] Step S107: The target proxy server sends the application traffic to the server.
[0070] Step S108: The server generates an application response in response to the application traffic and feeds back the application response to the target proxy server.
[0071] Exemplarily, the server can parse the request and identify the request type, URL path (Uniform Resource Locator), query parameters, request header, request body and other contents. According to the URL path, the request is routed to the corresponding back-end processing program (such as controller, function, etc.), and the back-end program executes the necessary business logic to obtain the result of the business logic processing, which may include querying the database, calling the external application program interface, computing processing, etc. Subsequently, the response content can be constructed according to the result of the business logic processing. Among them, the response content can be an HTML page, JSON data or data in other formats. Afterwards, the response header of the response content is set, and the response header includes the content type, encoding method, caching strategy, etc., so that the client can parse it correctly. The application response is obtained based on the response content and the response header.
[0072] Step S109: The target proxy server generates a traffic response based on the application response, and feeds back the traffic response to the target device through the target secure transmission channel.
[0073] Specifically, when the proxy server generates a traffic response based on application traffic, the traffic response may include, in addition to the application response obtained directly from the target server (such as HTML pages, pictures, videos and other data), a status code, a response header, and security-related headers (such as SSL / TLS information), etc., to ensure the integrity of the response and smooth communication.
[0074] Step S110: The target device parses the traffic response to obtain an application response, and sends the application response to the client.
[0075] Among them, when the target device receives the traffic response forwarded by the proxy server, the process of parsing and sending the application response to the client can be roughly divided into the following steps: 1. Receiving data packets: Physical layer and data link layer of the target device: The traffic response is first transmitted to the network interface card of the target device through the physical medium (such as Ethernet cable), where the conversion between electrical signals and bit streams is completed, and it is encapsulated into frames through the data link layer (such as Ethernet protocol) to ensure that the data reaches the network layer correctly. The network layer (such as IP protocol) of the target device is responsible for receiving these frames and checking the IP header information to determine whether the destination address of the data packet matches the local machine. If it matches, it continues to process; if it does not match, it may need to be routed or discarded. 2. Decomposing TCP / IP data packets, transport layer: For TCP protocol (HTTP usually uses TCP as the transport layer protocol), the TCP module of the target device will check the sequence number and confirmation response number, confirm the order and integrity of the data packet, and then reassemble the data stream. The UDP protocol is relatively simple and directly passes data to the application layer. The application layer begins to parse the response data. This includes reading the response line (such as HTTP version, status code and status message), response header (various metadata) and response body (actual data content). Based on the results of parsing and processing, the target device prepares a complete HTTP response message to be sent to the client, including the response line, response header, and response body. Through the network layer and data link layer: The TCP data segment is further encapsulated into an IP packet, and the corresponding physical layer and data link layer headers are added, and sent out through the network interface, and finally reaches the client.
[0076] By adopting the traffic access method of the present application, multiple secure connection channels are established in advance, and in the subsequent use process, the available target secure connection channel is directly selected from the pre-established secure connection channels, thereby avoiding the delay caused by the need to establish a secure channel when each client in the target device performs traffic access, thereby effectively improving the traffic access efficiency. In addition, by adopting the traffic access method of the present application, the target device and the target proxy server only use the traditional OSI model during the traffic forwarding process without setting up an additional intermediate layer, which will not introduce additional complexity, and the implementation changes are relatively small compared to the original proxy connection.
[0077] Specifically, Figure 5As shown, there may be multiple clients on the target device that need to have a conversation with the corresponding server at the same time. At this time, when each client initiates access to the corresponding server (such as client A to server A, client B to server B, and client C to server C), the generated application traffic will be forwarded to the target device, and each client establishes a TCP connection with the local target device. The consumption of the local TCP handshake can be regarded as 0RTT. After the handshake is completed, the application traffic is sent to the target device. After receiving the application traffic, the target device generates a traffic request. For the target client (the target client is client A, client B or client C), an available target secure transmission channel is selected from the channel information corresponding to the n secure transmission channels in the secure connection pool. At this time, there is no need to establish a secure transmission channel, and a traffic request is sent to the target proxy server connected to the target secure transmission channel, so that the target proxy server establishes a communication connection between the servers after receiving the traffic request, and sends the application traffic to the server; receive the traffic response fed back by the target proxy server through the target secure connection channel, and the traffic response includes the application response generated by the server in response to the application traffic; send the application response to the target client. During the entire process, there is only one RTT data transmission time between the target device and the target proxy server. Therefore, compared with the existing technology, the present application avoids the delay caused by the need to establish a secure channel when each client in the target device performs traffic access, thereby effectively improving the traffic access efficiency.
[0078] Please refer again Figure 3 In one possible implementation, after completing data transmission between the target client and the server, the target client can send a connection closing request to the target device. If the target device receives the connection closing request sent by the target client, it disconnects the communication connection with the target client in response to the connection closing request and generates an indication message. The indication message is sent to the target proxy server so that the target proxy server disconnects the communication connection with the server in response to the indication message, wherein the target secure connection channel is available after the target proxy server disconnects the communication connection with the server.
[0079] Among them, the indication message can be any message such as an Alert message or a CSS message that can enable the target proxy server to know that the data transmission has been completed and the previous communication connection with the server needs to be disconnected. Among them, the Alert message is used to transmit warnings and command errors in the TLS connection, and the CSS message is used in TLS to notify the other party that the pre-master key has changed. In this embodiment, when the target proxy server receives the Alert message or the CSS message, it can confirm that the target client needs to disconnect from the server at this time. At this time, by disconnecting the communication connection between the target proxy server and the server and maintaining the connection between the target proxy server and the target device, other clients on the subsequent target device can directly use the target secure connection channel again when they need to access the corresponding client through the target proxy server without re-establishing it, thereby further improving the access efficiency.
[0080] In addition, by using the target secure transmission channel to transmit an indication message (Alert message or CSS message) to the target proxy server, the disconnection signal of the session is transmitted using the TLS / SSL control frame, which decouples the TLS / SSL layer and the session layer in the OSI model. When the session layer needs to be disconnected, the other party is notified through the TLS / SSL control frame to only disconnect the session layer and retain the connection. In order to reuse the existing TLS / SSL connection when the session needs to be reestablished later, the consumption of the transport layer handshake and the TLS / SSL layer handshake is avoided, and the delay in the new establishment process is greatly reduced.
[0081] It should be understood that the server can also send a connection closing request to the target proxy server after sending an application response to the target proxy server and confirming that it is not necessary to maintain the connection with the target client. If the target proxy server receives the connection closing request sent by the server, it disconnects the communication connection with the target proxy server in response to the connection closing request and generates an indication message. The indication message is sent to the target device so that the target device disconnects the communication connection with the target client in response to the indication message, wherein the target secure connection channel is available after the target proxy server disconnects the communication connection with the server and the target device disconnects the connection with the target client.
[0082] Among them, when the server completes the transaction processing, it can be confirmed that there is no need to maintain the communication connection with the target client. For example, for one-time data retrieval, simple query request or upload operation, the transaction can be considered completed after the data transmission is completed and the confirmation of the proxy server is received; when the communication connection between the server and the proxy server meets the timeout mechanism, it can also be confirmed that there is no need to maintain the communication connection with the target client, that is, if the connection between the server and the proxy server has no data transmission for a period of time, and both parties have implemented the timeout mechanism; when it is detected that the session validity period identifier in the application traffic indicates that the session has expired, it can also be confirmed that there is no need to maintain the communication connection with the target client. For example, in some application scenarios, the session has clear life cycle management. When the server detects that the session has reached the preset expiration time, it can actively disconnect the connection even if no direct instruction from the proxy server is received.
[0083] In order to facilitate the target server to quickly select an available target secure connection channel, a secure connection pool is set in the target device, and the secure connection pool stores channel information of multiple pre-established and available secure connection channels. The above-mentioned step of selecting an available target secure connection channel from multiple pre-established secure connection channels includes: based on the channel information of multiple secure connection channels stored in the secure connection pool, selecting an available target secure connection channel from multiple secure connection channels; deleting the channel information of the target secure connection channel from the secure connection pool.
[0084] In addition, after sending the indication message to the target proxy server so that the target proxy server disconnects the communication connection with the server in response to the indication message, the method further includes: if it is confirmed that the target proxy server disconnects the communication connection with the server, storing the channel information of the target secure connection channel in the secure connection pool.
[0085] By adopting the above method, each time the target device establishes a connection, since the secure connection channels to which the channel information stored in the secure connection pool belongs are all available secure connection channels, the efficiency of selecting the secure connection channel is improved.
[0086] To ensure that the secure transmission channel selected based on the channel information in the secure connection pool is available, in one feasible implementation, if the public network address of the target device changes, the channel information in the secure connection pool is deleted, and the process returns to executing the step of sending a first message to the proxy server so that the proxy server establishes a connection with the target client in response to the first message, and generates a connection establishment feedback message, so as to re-establish the secure connection channel between the target device and at least one proxy server, and store the channel information of the secure transmission channel in the secure connection pool.
[0087] See also Figure 6 , the embodiment of the present application provides a traffic access method applicable to a target device, the method comprising:
[0088] Step S210: If application traffic is received from a target client that establishes a communication connection with the target device, an available target secure connection channel is selected from multiple pre-established secure connection channels. Step S220: A traffic request is generated based on the application traffic and information about a target proxy server connected to the target secure connection channel, wherein the traffic request carries the application traffic. Step S230: The traffic request is sent to the target proxy server through the target secure connection channel, so that the target proxy server forwards the application traffic to the server based on the traffic request. Step S240: A traffic response is received that is fed back by the target proxy server through the target secure connection channel, wherein the traffic response includes an application response generated by the server in response to the application traffic. Step S250: The application response is sent to the target client.
[0089] The specific implementation principles of the above steps S210-S250 can be found in the specific description of the above embodiments, which will not be repeated here.
[0090] By adopting the above steps S210-S250, when there are multiple pre-established secure connection channels, when the target device receives the application traffic sent by the target client, by directly selecting the available target secure connection channel from the pre-established secure connection channel, the delay caused by the need to establish a secure channel for each client in the target device when performing traffic access is avoided, thereby effectively improving the traffic access efficiency. In addition, by adopting the traffic access method of the present application, the target device and the target proxy server only use the traditional OSI model during the traffic forwarding process without setting up an additional intermediate layer, which does not introduce additional complexity, and the implementation changes little compared to the original proxy connection.
[0091] In one possible implementation, after executing step S250, the method further includes: if a connection closing request sent by the target client is received, disconnecting the communication connection with the target client in response to the connection closing request, and generating an indication message; sending the indication message to the target proxy server, so that the target proxy server disconnects the communication connection with the server in response to the indication message, wherein the target secure connection channel is available after the target proxy server disconnects the communication connection with the server.
[0092] When receiving the connection closing request sent by the target client, the target device not only disconnects the communication connection with the target client, but also generates an indication message to notify the target proxy server to disconnect the communication connection with the server. This helps to release the connection resources that are no longer used in time and avoid resource waste. Furthermore, after confirming that the target proxy server disconnects the communication connection with the server, the channel information of the target secure connection channel is stored back in the secure connection pool, so that the channel can be reused by other requests. This mechanism effectively improves resource utilization and reduces the delay in connection establishment.
[0093] In one possible implementation, the above-mentioned step S210 includes: based on the channel information of multiple secure connection channels stored in the secure connection pool, selecting an available target secure connection channel from multiple secure connection channels; deleting the channel information of the target secure connection channel from the secure connection pool; after executing the sending of the indication message to the target proxy server so that the target proxy server disconnects the communication connection with the server in response to the indication message, the method also includes: if it is confirmed that the target proxy server disconnects the communication connection with the server, storing the channel information of the target secure connection channel in the secure connection pool.
[0094] Based on the channel information of multiple secure connection channels stored in the secure connection pool, the target device can select an available target secure connection channel from multiple channels. This dynamic selection mechanism helps to achieve load balancing, avoid overloading of some channels while other channels are idle, and ensures that the latest channel status information can be obtained each time a channel is selected, thereby improving the system's response speed and processing efficiency.
[0095] In one possible implementation, a secure connection pool is provided in the target device, there is at least one proxy server, and there is at least one secure transmission channel established between the target device and each of the proxy servers, and the secure transmission channel is established in the following manner: a first message is sent to the proxy server, so that the proxy server establishes a connection with the target client in response to the first message, and generates a connection establishment feedback message; if the connection establishment feedback message sent by the proxy server is received, a second message is sent to the proxy server based on a secure transmission protocol, so that the proxy server establishes a secure transmission channel between the target device and the server based on the secure transmission protocol in response to the second message; and the channel information of the secure transmission channel is stored in the secure connection pool.
[0096] Wherein, the secure transmission protocol includes the SSL protocol or the TSL protocol.
[0097] By adopting the above implementation, the target device sends a first message to the proxy server, so that the proxy server establishes a connection with the target client and generates a connection establishment feedback message, thereby ensuring that the connection establishment process is controllable and improving the reliability of the connection.
[0098] In one possible implementation, a secure connection pool is provided in the target device, and the secure connection pool stores channel information of multiple pre-established and available secure connection channels. The method also includes: if it is determined that the public network address of the target device has changed, deleting the channel information in the secure connection pool, and returning to execute the step of sending a first message to the proxy server so that the proxy server establishes a connection with the target client in response to the first message, and generates a connection establishment feedback message.
[0099] When the public network address of the target device changes, the channel information in the secure connection pool is deleted and the connection with the proxy server is reestablished. This mechanism enables the system to quickly adapt to changes in the network environment and maintain the effectiveness of the connection.
[0100] In one possible implementation, the target device stores a correspondence between the client and the proxy server; the above step S210 includes: determining the target proxy server corresponding to the target client based on the correspondence; and selecting an available target secure connection channel from a pre-established secure connection channel connected to the target proxy server.
[0101] Since the target device determines the target proxy server corresponding to the target client based on the pre-stored correspondence between the client and the proxy server, and selects an available channel from the secure connection channel connected to the proxy server, this mechanism ensures that traffic can be transmitted through the most appropriate channel, improving transmission efficiency.
[0102] like Figure 7 , Figure 7A traffic access device 300 provided in an embodiment of the present application is applied to a target device, and the device 300 includes: a channel selection module 310, which is used to select an available target secure connection channel from multiple pre-established secure connection channels when receiving application traffic sent by a target client that establishes a communication connection with the target device; a request generation module 320, which is used to generate a traffic request based on the application traffic and information of a target proxy server connected to the target secure connection channel, and the traffic request includes the application traffic; a request sending module 330, which is used to send the traffic request to the target proxy server through the target secure connection channel, so that the target proxy server determines the server according to the application traffic in the traffic request when receiving the traffic request, establishes a communication connection between the servers, and sends the application traffic to the server; a response receiving module 340, which is used to receive a traffic response fed back by the target proxy server through the target secure connection channel, and the traffic response includes an application response generated by the server in response to the application traffic; a response sending module 350, which is used to send the application response to the target client.
[0103] In one possible implementation, the device 300 also includes: a connection closing module, which is used to disconnect the communication connection with the target client in response to the connection closing request when receiving the connection closing request sent by the target client, and generate an indication message; an indication message sending module, which is used to send the indication message to the target proxy server, so that the target proxy server disconnects the communication connection with the server in response to the indication message, wherein the target secure connection channel is available after the target proxy server disconnects the communication connection with the server.
[0104] In one possible implementation, a secure connection pool is provided in the target device, and the secure connection pool stores channel information of multiple pre-established and available secure connection channels. The device 300 also includes an information storage module, and the channel selection module 310 is further used to select an available target secure connection channel from multiple secure connection channels based on the channel information of the multiple secure connection channels stored in the secure connection pool; delete the channel information of the target secure connection channel from the secure connection pool; the information storage module is used to store the channel information of the target secure connection channel in the secure connection pool when it is confirmed that the target proxy server has disconnected the communication connection with the server.
[0105] In one possible implementation, the indication message is an Alert message or a CSS message.
[0106] In one possible implementation, a secure connection pool is provided in the target device, there is at least one proxy server, and there is at least one secure transmission channel established between the target device and each of the proxy servers. The apparatus 300 further includes: a message sending module, configured to send a first message to the proxy server, so that the proxy server establishes a connection with the target client in response to the first message, and generates a connection establishment feedback message; a message receiving module, configured to send a second message to the proxy server based on a secure transmission protocol if the connection establishment feedback message sent by the proxy server is received, so that the proxy server establishes a secure transmission channel between the target device and the server based on the secure transmission protocol in response to the second message; and storing the channel information of the secure transmission channel in the secure connection pool.
[0107] In one possible implementation, a secure connection pool is provided in the target device, and the secure connection pool stores channel information of multiple pre-established and available secure connection channels. The device 300 also includes an information deletion module for deleting the channel information in the secure connection pool when it is determined that the public network address of the target device has changed.
[0108] In one possible implementation, the secure transmission protocol includes the SSL protocol or the TSL protocol.
[0109] In one possible implementation, the target device stores a correspondence between the client and the proxy server; the channel selection module is also used to determine the target proxy server corresponding to the target client based on the correspondence; and select an available target secure connection channel from a pre-established secure connection channel connected to the target proxy server.
[0110] Correspondingly, such as Figure 8 The embodiment of the present application also provides an electronic device 400, which may be an electronic device capable of running applications, such as a smart phone, a tablet computer, or a server. The electronic device 400 may include a communication interface 410, one or more processors 420, a memory 430, and one or more applications, wherein the one or more applications are stored in the memory 430 and configured to be executed by the one or more processors 410, and the one or more applications are configured to execute the above-mentioned traffic access method.
[0111] It can be understood that the processor 420 is connected to the communication interface 410 and the memory 430 via a communication bus to achieve mutual communication.
[0112] The communication interface 410 is used to establish a communication connection with the aforementioned target client and server to send and receive data (eg, send and receive application traffic and application response, etc.).
[0113] The processor 430 can call the logic instructions in the memory 430 to execute the traffic access method in any of the aforementioned embodiments. Exemplarily, the processor 420 can be implemented by a general-purpose CPU, a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit.ASIC), or one or more integrated circuits, etc., for executing related programs to implement the technical solution provided in this application. The memory can include ROM (Read 0nlyMemory, read-only memory), RAM (Random Access Memory, random access memory) static storage devices, dynamic storage devices, etc.
[0114] Correspondingly, an embodiment of the present application further provides a computer-readable storage medium, in which a program code is stored, and the program code can be called by a processor to execute the above-mentioned traffic access method.
[0115] It can be understood that the logic instructions in the above-mentioned memory can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product.
[0116] Part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for enabling a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.
[0117] The above are only preferred embodiments of the present application, and are not intended to limit the present application in any form. Although the present application has been disclosed as above with preferred embodiments, it is not intended to limit the present application. Any technical personnel in the field can make some changes or modify the technical contents disclosed above into equivalent embodiments without departing from the scope of the technical solution of the present application. However, any brief modifications, equivalent changes and modifications made to the above embodiments based on the technical essence of the present application without departing from the content of the technical solution of the present application are still within the scope of the technical solution of the present application.
Claims
1. A traffic access method, characterized in that: Applied to a target device, the method comprises: If application traffic is received from a target client that establishes a communication connection with the target device, an available target secure connection channel is selected from a plurality of pre-established secure connection channels; Generate a traffic request based on the application traffic and information of a target proxy server connected to the target secure connection channel, wherein the traffic request carries the application traffic; Sending the traffic request to the target proxy server through the target secure connection channel, so that the target proxy server forwards the application traffic to the server based on the traffic request; Receiving a traffic response fed back by the target proxy server through the target secure connection channel, the traffic response comprising an application response generated by the server in response to the application traffic; The application response is sent to the target client.
2. The method according to claim 1, characterized in that After sending the application response to the target client, the method further includes: If a connection closing request sent by the target client is received, disconnecting the communication connection with the target client in response to the connection closing request, and generating an indication message; The indication message is sent to the target proxy server, so that the target proxy server disconnects the communication connection with the server in response to the indication message, wherein the target secure connection channel is available after the target proxy server disconnects the communication connection with the server.
3. The method according to claim 2, characterized in that The target device is provided with a secure connection pool, and the secure connection pool stores channel information of multiple pre-established and available secure connection channels. The step of selecting an available target secure connection channel from the pre-established multiple secure connection channels includes: Based on the channel information of the multiple secure connection channels stored in the secure connection pool, selecting an available target secure connection channel from the multiple secure connection channels; Deleting the channel information of the target secure connection channel from the secure connection pool; After sending the instruction message to the target proxy server so that the target proxy server disconnects the communication connection with the server in response to the instruction message, the method further includes: If it is confirmed that the target proxy server is disconnected from the communication connection with the server, the channel information of the target secure connection channel is stored in the secure connection pool.
4. The method according to claim 1, characterized in that: The target device is provided with a secure connection pool, the number of the proxy servers is at least one, and the number of secure transmission channels established between the target device and each of the proxy servers is at least one, wherein the secure transmission channels are established in the following manner: Sending a first message to the proxy server, so that the proxy server establishes a connection with the target client in response to the first message and generates a connection establishment feedback message; If the connection establishment feedback message sent by the proxy server is received, sending a second message to the proxy server based on a secure transmission protocol, so that the proxy server establishes a secure transmission channel between the target device and the server based on the secure transmission protocol in response to the second message; The channel information of the secure transmission channel is stored in the secure connection pool.
5. The method according to claim 4, characterized in that The target device is provided with a secure connection pool, and the secure connection pool stores channel information of a plurality of pre-established and available secure connection channels. The method further comprises: If it is determined that the public network address of the target device has changed, the channel information in the secure connection pool is deleted, and the process returns to the step of sending a first message to the proxy server so that the proxy server establishes a connection with the target client in response to the first message and generates a connection establishment feedback message.
6. The method according to claim 4, characterized in that The secure transmission protocol includes the SSL protocol or the TLS protocol.
7. The method according to claim 1, characterized in that The target device stores a correspondence between the client and the proxy server; The selecting an available target secure connection channel from a plurality of pre-established secure connection channels comprises: Determine a target proxy server corresponding to the target client based on the corresponding relationship; An available target secure connection channel is selected from pre-established secure connection channels connected to the target proxy server.
8. A flow access device, characterized in that: Applied to a target device, the apparatus comprises: A channel selection module is used to select an available target secure connection channel from a plurality of pre-established secure connection channels when receiving application traffic sent by a target client that establishes a communication connection with the target device; A request generation module, configured to generate a traffic request based on the application traffic and information of a target proxy server connected to the target secure connection channel, wherein the traffic request carries the application traffic; A request sending module, used to send the traffic request to the target proxy server through the target secure connection channel, so that the target proxy server forwards the application traffic to the server based on the traffic request; A response receiving module, configured to receive a flow response fed back by the target proxy server through the target secure connection channel, wherein the flow response includes an application response generated by the server in response to the application flow; A response sending module is used to send the application response to the target client.
9. An electronic device, characterized in that: include: Communication interface; one or more processors; Memory; One or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the method according to any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program codes, and the program codes can be called by a processor to execute the method according to any one of claims 1 to 7.
11. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method described in any one of claims 1 to 7 are implemented.