Secure communication method under network architecture of edge server and cloud server

Abstract

The invention relates to a secure communication method under an edge server and cloud server network architecture, which comprises the following steps that: terminal equipment transmits generated data to a nearest edge server, and when data needs to be processed by other edge servers, the corresponding edge server is matched; the communication channel establishment module detects the NAT type of a target edge server, generates an interaction channel establishment strategy, a pairing key and a detection packet, and transmits the interaction channel establishment strategy, the pairing key and the detection packet to the target edge server; a VPN program penetrates through the NAT to establish an interactive channel, a communication channel establishment module establishes a VPN tunnel on the interactive channel established by penetrating through the NAT, and meanwhile, a data forwarding strategy is set; the nearest edge server initiates a communication request to the target edge server, the target edge server returns a response, and the nearest edge server sends to-be-processed terminal data to the target edge server; and the target server receives the to-be-processed terminal data and carries out corresponding data processing. A communication channel is directly established between the edge servers for data interaction.

Description

Technical Field

[0001] The present invention belongs to the field of communication security technology, and in particular to a secure communication method under a network architecture of an edge server and a cloud server. Background Art

[0002] In the era of rapid development of digitalization, the explosive growth of IoT devices and the increasing demand for low latency, high bandwidth and real-time processing have led to the rapid development of cloud-edge fusion technology. Cloud-edge fusion technology sinks the data that has high latency requirements and needs real-time processing to the edge server for data processing, uploads the key data or data that can only be processed by the cloud server to the cloud for processing, and transmits the processing results of the edge server to the cloud server. On the one hand, it can greatly reduce the amount of data transmission between the edge server and the cloud server, effectively saving bandwidth resources. On the other hand, by directly processing the data that has high latency requirements and needs real-time processing on the edge server, it can effectively reduce the risk of exposure of this part of data due to data transmission, and better protect the security of data. On the other hand, when the communication connection between the cloud server and the edge server fails, the edge server can process the data on the other end to maintain the continuity and stability of local services.

[0003] Due to the organic cooperation between the edge server and the cloud server, the integrated processing of various data is realized. In order to realize the secure communication connection between the edge server and the cloud server, a secure communication channel is established between the edge server and the cloud server through the VPN network to realize the secure connection and data transmission between the edge server and the cloud server. Generally, there is no direct connection between edge servers in actual network deployment. However, due to the different functions of each edge server and the different data types processed by each edge server, it may be necessary for some edge servers to communicate in some cases. However, due to the NAT restrictions between the LAN of the edge server and the Internet, the communication channel cannot be directly established between the edge servers.

[0004] Therefore, how to solve the technical problem that a communication channel cannot be directly established between edge servers due to NAT restrictions between the edge server's local area network and the Internet on the basis of network deployment of edge servers and ensuring the security of communication between edge servers and cloud servers is a technical problem that needs to be solved urgently. Summary of the invention

[0005] The purpose of the present invention is to provide a secure communication method under the network architecture of edge servers and cloud servers, so as to solve the technical problem that a communication channel cannot be directly established between edge servers due to NAT restrictions between the local area network of the edge server and the Internet, on the basis of network deployment of the edge server and the cloud server and ensuring the security of communication between the edge server and the cloud server.

[0006] In order to solve the above technical problems, the technical solution adopted by the present invention is as follows: The secure communication method under the network architecture of edge server and cloud server includes the following steps: S1: The terminal device transmits the generated data to the nearest edge server. The edge server identifies the received data, transmits the data that needs to be processed by the cloud server to the cloud server, and determines whether the remaining data needs to be processed by other edge servers. If not, the nearest edge server directly processes the data and transmits the processed results to the cloud server. If so, execute step S2; S2: The nearest edge server matches the data that needs to be processed by other edge servers with the corresponding edge server based on the identification result, and informs the communication channel establishment module of the communication requirements between it and the target edge server; S3: The communication channel establishment module detects the NAT parameters of the target edge server, obtains the NAT type of the target edge server, establishes an interactive channel establishment strategy, generates a pairing key and a detection packet, and transmits the interactive channel establishment strategy, pairing key and detection packet to the target edge server; S4: the communication channel establishment module establishes an interactive channel between the nearest edge server and the target edge server by penetrating NAT through a VPN program, and the communication channel establishment module establishes a VPN tunnel on the interactive channel established by penetrating NAT, and sets a data forwarding strategy at the same time; S5: The nearest edge server initiates a communication request to the target edge server, the target edge server returns a response, and the nearest edge server sends the terminal data to be processed to the target edge server through the established VPN tunnel and the data forwarding strategy; S6: The target server receives the terminal data to be processed and performs corresponding data processing, and transmits the processed data results to the cloud server based on the network architecture of the original edge server and the cloud server.

[0007] Preferably, the specific process of the edge server identifying the received data in step S1 is as follows: S11: extracting preset key features from the received data, and extracting a mapping relationship table between preset data types and key features; S12: Matching the extracted key features through the mapping relationship table, and acquiring corresponding data types based on the matching relationship between the key features and the data types.

[0008] Preferably, the specific process of detecting the NAT parameters of the target edge server in step S3 to obtain the NAT type of the target edge server is as follows: S311: The communication channel establishment module sends an ECHO request to the target server. If the target server returns information, it is determined whether the public network IP address is consistent with the NAT internal address of the nearest edge server. If they are consistent, it is confirmed that the nearest edge server is not behind NAT but is a public network address. S312: Determine whether the public network address of the nearest edge server is a complete public network address, send preset information to the first IP address and port, the target server receives the preset information, and uses the second IP address and port to reply the message; S313: If a reply message is received, it is determined to be a complete public network address; if no reply message is received, it is behind a symmetrical firewall; S314: If the received public network IP address is inconsistent with the IP address of the nearest edge server, confirm that the nearest edge server is behind NAT; S315: Send a request to the first address and port of the target server again. The target server replies with the second IP address and port. A mapping table between the intranet address and the external network address is established on the nearest edge server. If a public network reply message can be received, it is determined to be a full cone NAT. S316: If the public network reply message cannot be received, information is sent to the second IP address and port of the target server. The target server uses the second IP address and port to reply information and brings back the public network IP address. If the public network IP address is inconsistent with the public network IP address received in step S34, it is determined to be symmetric NAT. If they are consistent, it is determined to be restrictive NAT. S317: Send information to the first IP address and port of the target server again. If the target server replies with the same IP address but different port number in step S36, it is determined to be IP-restricted NAT. If the port number is the same, it is determined to be port-restricted NAT.

[0009] Preferably, the pairing key generated in step S3 is a temporary key for encrypting data packets during the process of establishing an interactive channel between the nearest edge server and the target edge server, and for encrypting heartbeat packets when the channel is persistent. When both the establishment of the interactive channel and persistence are completed, the pairing key automatically becomes invalid.

[0010] Preferably, the interactive channel establishment strategy includes an interactive channel establishment type, a master-slave relationship and strategy parameters.

[0011] Preferably, the specific process of step S3 is as follows: S321: The communication channel establishment module detects NAT parameters of the nearest edge server and NAT parameters of the target edge server; S322: The communication channel establishment module generates an interactive channel establishment strategy based on the NAT parameters of the nearest edge server and the NAT parameters of the target edge server, establishes a temporary pairing key and a detection packet in the interactive channel establishment phase, and sends them to the target edge server; S323: The target edge server returns a response for establishing an interactive channel to the communication channel establishment module, and the communication channel establishment module sends the interactive channel establishment strategy, pairing key, and detection packet to the nearest edge server, and the nearest edge server returns a response for establishing an interactive channel to the communication channel establishment module.

[0012] Preferably, the specific process of the communication channel establishment module in step S4 establishing a VPN tunnel on the interactive channel established by penetrating NAT is as follows: S41: the communication channel establishing module initiates a request to configure as a VPN server to the target edge server, and the target edge server responds to the request to configure as a VPN server; S42: the communication channel establishing module initiates a request to the nearest edge server to be configured as a VPN server, and the nearest edge server responds to the request to be configured as a VPN server; S43: The communication channel establishing module creates a VPN tunnel on the established interactive channel.

[0013] Preferably, it also includes an account management process between the nearest edge server and the target edge server, through which the account management process provides identity authentication support for the establishment of an interaction channel between the nearest edge server and the target edge server and data interaction after the VPN tunnel is established, and prevents unauthorized devices from accessing the VPN network.

[0014] Preferably, in the account management process, all data interactions between the nearest edge server and the target edge server are performed through the established VPN tunnel for data transmission.

[0015] The beneficial effects of the present invention include: The invention provides a secure communication method under the network architecture of edge servers and cloud servers. The terminal device transmits the generated data to the nearest edge server. When there is data that needs to be processed by other edge servers, the corresponding edge server is matched. The communication channel establishment module detects the NAT type of the target edge server, generates an interactive channel establishment strategy, a pairing key and a detection package and transmits them to the target edge server. The VPN program penetrates the NAT to establish an interactive channel. The communication channel establishment module establishes a VPN tunnel on the interactive channel established by penetrating the NAT, and sets a data forwarding strategy at the same time. The nearest edge server initiates a communication request to the target edge server, the target edge server returns a response, and the nearest edge server sends the terminal data to be processed to the target edge server. The target server receives the terminal data to be processed and performs corresponding data processing. The invention realizes the direct establishment of a communication channel between edge servers for data interaction. On the basis of the network deployment of the edge server and the cloud server and ensuring the communication security between the edge server and the cloud server, the technical problem that the communication channel cannot be directly established between edge servers due to the NAT restriction between the local area network of the edge server and the Internet is solved.

[0016] First, preset key features are extracted from the received data, and a mapping relationship table between preset data types and key features is extracted. The extracted key features are matched through the mapping relationship table, and the corresponding data types are obtained based on the matching relationship between the key features and the data types, thereby realizing analysis of the data types. Since a certain edge server cannot process all types of data, it is necessary to send the data that cannot be processed to other edge servers for processing, so that specific data can be processed by a specific server, ensuring that the data processing results meet the corresponding requirements.

[0017] Secondly, through the detailed determination process of the NAT type of the target server in steps S311 to S317, it is possible to accurately determine whether the NAT type of the target server is a full cone NAT, a symmetric NAT, a port restricted NAT, or an IP restricted NAT. For different NAT types, the corresponding interactive channel establishment process is completely different. Therefore, accurate determination of the NAT type can effectively improve the success rate of establishing a point-to-point interactive channel between the edge server and the target server.

[0018] Again, by detecting the NAT parameters of the nearest edge server and the target edge server and generating an interactive channel establishment strategy, a temporary pairing key and a detection package for the interactive channel establishment phase are established and sent to the target edge server; the target edge server returns a response to establish an interactive channel to the communication channel establishment module, and the communication channel establishment module sends the interactive channel establishment strategy, pairing key and detection package to the nearest edge server. The nearest edge server returns a response to establish an interactive channel to the communication channel establishment module, and then penetrates the NAT to establish an interactive channel, and establishes a VPN tunnel on the interactive channel established by penetrating the NAT, so as to realize efficient and secure data interaction between the nearest edge server and the target edge server.

[0019] Finally, a request is initiated to configure as a VPN server to the target edge server through the communication channel establishment module, and the target edge server responds to the request to configure as a VPN server; the communication channel establishment module initiates a request to configure as a VPN server to the nearest edge server, and the nearest edge server responds to the request to configure as a VPN server; the communication channel establishment module creates a VPN tunnel on the established interactive channel, and establishes a secure data transmission channel between the target edge server and the nearest edge server, solving the technical problem that a communication channel cannot be directly established between edge servers due to NAT restrictions between the local area network of the edge server and the Internet, and ensuring the security of data transmission between the two. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a flow chart of the secure communication method under the network architecture of the edge server and the cloud server of the present invention.

[0021] Figure 2 Schematic diagram of the network architecture of edge servers and cloud servers of the present invention.

[0022] Figure 3 The present invention is a flow chart of establishing a VPN tunnel on an interactive channel established by penetrating NAT. DETAILED DESCRIPTION

[0023] The following is combined with Figure 1~Figure 3 The present invention is further described in detail: Example 1 See attached Figure 1 and Figure 2 As shown, the secure communication method under the network architecture of the edge server and the cloud server includes the following steps: S1: The terminal device transmits the generated data to the nearest edge server. The edge server identifies the received data, transmits the data that needs to be processed by the cloud server to the cloud server, and determines whether the remaining data needs to be processed by other edge servers. If not, the nearest edge server directly processes the data and transmits the processed results to the cloud server. If so, execute step S2; S2: The nearest edge server matches the data that needs to be processed by other edge servers with the corresponding edge server based on the identification result, and informs the communication channel establishment module of the communication requirements between it and the target edge server; S3: The communication channel establishment module detects the NAT parameters of the target edge server, obtains the NAT type of the target edge server, establishes an interactive channel establishment strategy, generates a pairing key and a detection packet, and transmits the interactive channel establishment strategy, pairing key and detection packet to the target edge server; S4: the communication channel establishment module establishes an interactive channel between the nearest edge server and the target edge server by penetrating NAT through a VPN program, and the communication channel establishment module establishes a VPN tunnel on the interactive channel established by penetrating NAT, and sets a data forwarding strategy at the same time; S5: The nearest edge server initiates a communication request to the target edge server, the target edge server returns a response, and the nearest edge server sends the terminal data to be processed to the target edge server through the established VPN tunnel and the data forwarding strategy; S6: The target server receives the terminal data to be processed and performs corresponding data processing, and transmits the processed data results to the cloud server based on the network architecture of the original edge server and the cloud server.

[0024] In this embodiment, since there is no direct communication channel for data interaction between edge servers in the existing network architecture of edge servers and cloud servers, when the terminal generates data to be processed, it is transmitted to the nearest edge server for data processing, but the nearest edge server cannot process all data types generated by the terminal. The solution in the prior art is to directly transmit the data that cannot be processed to the cloud server for processing. On the one hand, this processing method will cause the existing cloud-edge fusion processing technology to fall into a technical bottleneck, and it is impossible to truly realize the sinking processing of data with high latency requirements.

[0025] Therefore, in the present invention, the generated data is transmitted to the nearest edge server through the terminal device, and when there is data that needs to be processed by other edge servers, the corresponding edge server is matched; the communication channel establishment module detects the NAT type of the target edge server, generates an interactive channel establishment strategy, a pairing key and a detection package and transmits them to the target edge server; the VPN program penetrates the NAT to establish an interactive channel, and the communication channel establishment module establishes a VPN tunnel on the interactive channel established by penetrating the NAT, and sets a data forwarding strategy at the same time; the nearest edge server initiates a communication request to the target edge server, the target edge server returns a response, and the nearest edge server sends the terminal data to be processed to the target edge server; the target server receives the terminal data to be processed and performs corresponding data processing. The communication channel is directly established between edge servers for data interaction, and on the basis of the network deployment of the edge server and the cloud server and ensuring the communication security between the edge server and the cloud server, the technical problem that the communication channel cannot be directly established between edge servers due to the NAT restriction between the local area network of the edge server and the Internet is solved. Furthermore, when there is a need for data interaction between an edge server and another edge server, a VPN secure tunnel is created to enable data interaction between the two, realize true Yunnan-edge collaborative data processing, reduce the latency of terminal data processing, and improve the security of data interaction.

[0026] Example 2 Based on Example 1, the specific process of the edge server identifying the received data in step S1 is as follows: S11: extracting preset key features from the received data, and extracting a mapping relationship table between preset data types and key features; S12: Matching the extracted key features through the mapping relationship table, and acquiring corresponding data types based on the matching relationship between the key features and the data types.

[0027] In this embodiment, since a certain edge server cannot process all types of data, it is necessary to send the data that cannot be processed to other edge servers for processing. The present invention extracts preset key features of the received data, extracts a mapping relationship table between preset data types and key features, matches the extracted key features through the mapping relationship table, obtains the corresponding data type based on the matching relationship between the key features and the data type, and realizes accurate identification and analysis of the data type. Subsequently, on the basis of establishing a secure VPN tunnel, the specific data is transmitted to the specific server through a secure VPN tunnel for processing, thereby improving the accuracy and efficiency of the data processing results and ensuring that the data processing results meet the corresponding requirements.

[0028] Example 3 Based on the technology of Example 1 or Example 2, the specific process of detecting the NAT parameters of the target edge server to obtain the NAT type of the target edge server in step S3 is as follows: S311: The communication channel establishment module sends an ECHO request to the target server. If the target server returns information, it is determined whether the public network IP address is consistent with the NAT internal address of the nearest edge server. If they are consistent, it is confirmed that the nearest edge server is not behind NAT but is a public network address. S312: Determine whether the public network address of the nearest edge server is a complete public network address, send preset information to the first IP address and port, the target server receives the preset information, and uses the second IP address and port to reply the message; S313: If a reply message is received, it is determined to be a complete public network address; if no reply message is received, it is behind a symmetrical firewall; S314: If the received public network IP address is inconsistent with the IP address of the nearest edge server, confirm that the nearest edge server is behind NAT; S315: Send a request to the first address and port of the target server again. The target server replies with the second IP address and port. A mapping table between the intranet address and the external network address is established on the nearest edge server. If a public network reply message can be received, it is determined to be a full cone NAT. S316: If the public network reply message cannot be received, information is sent to the second IP address and port of the target server. The target server uses the second IP address and port to reply information and brings back the public network IP address. If the public network IP address is inconsistent with the public network IP address received in step S34, it is determined to be symmetric NAT. If they are consistent, it is determined to be restrictive NAT. S317: Send information to the first IP address and port of the target server again. If the target server replies with the same IP address but different port number in step S36, it is determined to be IP-restricted NAT. If the port number is the same, it is determined to be port-restricted NAT.

[0029] Due to the different NAT types of the target server, different interaction establishment methods are required. If the NAT type of the target server cannot be accurately detected, the subsequent establishment of the interaction channel and the VPN tunnel establishment process are almost impossible to achieve. Therefore, in this embodiment, through the above-mentioned detailed determination process of the NAT type of the target server, it is possible to accurately determine whether the NAT type of the target server is a full cone NAT, a symmetric NAT, a port-restricted NAT, or an IP-restricted NAT. For different NAT types, the corresponding interaction channel establishment process is completely different. Therefore, accurate determination of the NAT type can effectively improve the success rate of establishing a point-to-point interaction channel between the edge server and the target server.

[0030] In this embodiment, the pairing key generated in step S3 is a temporary key for encrypting data packets during the process of establishing an interactive channel between the nearest edge server and the target edge server, and for encrypting heartbeat packets when the channel is persistent. When both the establishment of the interactive channel and persistence are completed, the pairing key automatically becomes invalid. The interactive channel establishment strategy includes the interactive channel establishment type, the master-slave relationship, and the strategy parameters.

[0031] The pairing key types are different in different security levels. The pairing key of the preset key is the key index, the pairing key of the negotiated key is the symmetric key, and the pairing key of the plaintext communication is empty. Set different security levels to match different data interactions, because different data interactions require different security requirements. When the NAT types of two edge servers are the same and the master-slave relationship cannot be determined, the initiator is the master server. The specific process of step S3 is as follows: S321: The communication channel establishment module detects NAT parameters of the nearest edge server and NAT parameters of the target edge server; S322: The communication channel establishment module generates an interactive channel establishment strategy based on the NAT parameters of the nearest edge server and the NAT parameters of the target edge server, establishes a temporary pairing key and a detection packet in the interactive channel establishment phase, and sends them to the target edge server; S323: The target edge server returns a response for establishing an interactive channel to the communication channel establishment module, and the communication channel establishment module sends the interactive channel establishment strategy, pairing key, and detection packet to the nearest edge server, and the nearest edge server returns a response for establishing an interactive channel to the communication channel establishment module.

[0032] In this embodiment, by detecting the NAT parameters of the nearest edge server and the target edge server and generating an interactive channel establishment strategy, a temporary pairing key and a detection packet in the interactive channel establishment phase are established and sent to the target edge server; the target edge server returns a response to establish the interactive channel to the communication channel establishment module, the communication channel establishment module sends the interactive channel establishment strategy, the pairing key and the detection packet to the nearest edge server, the nearest edge server returns a response to establish the interactive channel to the communication channel establishment module, and then penetrates the NAT to establish an interactive channel, and establishes a VPN tunnel on the interactive channel established by penetrating the NAT, so as to realize efficient and secure data interaction between the nearest edge server and the target edge server.

[0033] Example 4 Based on the technical foundation of Example 1 or Example 2 or Example 3, see Figure 3 The specific process of the communication channel establishment module in step S4 establishing a VPN tunnel on the interactive channel established by penetrating NAT is as follows: S41: the communication channel establishing module initiates a request to configure as a VPN server to the target edge server, and the target edge server responds to the request to configure as a VPN server; S42: the communication channel establishing module initiates a request to the nearest edge server to be configured as a VPN server, and the nearest edge server responds to the request to be configured as a VPN server; S43: The communication channel establishing module creates a VPN tunnel on the established interactive channel.

[0034] The above process initiates a request to configure as a VPN server to the target edge server through the communication channel establishment module, and the target edge server responds to the request to configure as a VPN server; the communication channel establishment module initiates a request to configure as a VPN server to the nearest edge server, and the nearest edge server responds to the request to configure as a VPN server; the communication channel establishment module creates a VPN tunnel on the established interactive channel, establishes a secure data transmission channel between the target edge server and the nearest edge server, solves the technical problem that a communication channel cannot be directly established between edge servers due to NAT restrictions between the local area network of the edge server and the Internet, and ensures the security of data transmission between the two.

[0035] In this embodiment, an account management process between the nearest edge server and the target edge server is also included, through which the account management process provides identity authentication support for the establishment of an interaction channel between the nearest edge server and the target edge server and data interaction after the VPN tunnel is established, and prevents unauthorized devices from accessing the VPN network. In the account management process, all data interactions between the nearest edge server and the target edge server are transmitted through the established VPN tunnel.

[0036] In summary, the secure communication method under the network architecture of the edge server and the cloud server provided by the present invention extracts the preset key features of the received data, extracts the mapping relationship table between the preset data type and the key features, matches the extracted key features through the mapping relationship table, obtains the corresponding data type based on the matching relationship between the key features and the data type, and realizes the analysis of the data type. Since a certain edge server cannot process all types of data, it is necessary to send the data that cannot be processed to other edge servers for processing, so that specific data is processed by a specific server, ensuring that the data processing result meets the corresponding requirements. Through the detailed judgment process of the NAT type of the target server, it is possible to accurately judge whether the NAT type of the target server is a full cone NAT or a symmetric NAT or a port restricted NAT or an IP restricted NAT. For different NAT types, the corresponding interactive channel establishment process is completely different. Therefore, the accurate judgment of the NAT type can effectively improve the success rate of establishing a point-to-point interactive channel between the edge server and the target server.

[0037] By detecting the NAT parameters of the nearest edge server and the target edge server and generating an interactive channel establishment strategy, a temporary pairing key and a detection package in the interactive channel establishment phase are established and sent to the target edge server; the target edge server returns a response to establish an interactive channel to the communication channel establishment module, the communication channel establishment module sends the interactive channel establishment strategy, pairing key and detection package to the nearest edge server, the nearest edge server returns a response to establish an interactive channel to the communication channel establishment module, and then penetrates the NAT to establish an interactive channel, and establishes a VPN tunnel on the interactive channel established by penetrating the NAT, so as to achieve efficient and secure data interaction between the nearest edge server and the target edge server. A request to configure as a VPN server is initiated to the target edge server through the communication channel establishment module, and the target edge server responds to the request to configure as a VPN server; the communication channel establishment module initiates a request to configure as a VPN server to the nearest edge server, and the nearest edge server responds to the request to configure as a VPN server; the communication channel establishment module creates a VPN tunnel on the established interactive channel, and establishes a secure data transmission channel between the target edge server and the nearest edge server, solving the technical problem that the edge servers cannot directly establish a communication channel due to the NAT restriction between the local area network of the edge server and the Internet, and ensuring the security of data transmission between the two.

Claims

1. A secure communication method under an edge server and cloud server network architecture, characterized in that: The following steps are involved: S1: The terminal device transmits the generated data to the nearest edge server. The edge server identifies the received data, transmits the data that needs to be processed by the cloud server to the cloud server, and determines whether the remaining data needs to be processed by other edge servers. If not, the nearest edge server directly processes the data and transmits the processed results to the cloud server. If so, execute step S2; S2: The nearest edge server matches the data that needs to be processed by other edge servers with the corresponding edge server based on the identification result, and informs the communication channel establishment module of the communication requirements between it and the target edge server; S3: The communication channel establishment module detects the NAT parameters of the target edge server, obtains the NAT type of the target edge server, establishes an interactive channel establishment strategy, generates a pairing key and a detection packet, and transmits the interactive channel establishment strategy, pairing key and detection packet to the target edge server; S4: the communication channel establishment module establishes an interactive channel between the nearest edge server and the target edge server by penetrating NAT through a VPN program, and the communication channel establishment module establishes a VPN tunnel on the interactive channel established by penetrating NAT, and sets a data forwarding strategy at the same time; S5: The nearest edge server initiates a communication request to the target edge server, the target edge server returns a response, and the nearest edge server sends the terminal data to be processed to the target edge server through the established VPN tunnel and the data forwarding strategy; S6: The target server receives the terminal data to be processed and performs corresponding data processing, and transmits the processed data results to the cloud server based on the network architecture of the original edge server and the cloud server.

2. The secure communication method under the edge server and cloud server network architecture according to claim 1, characterized in that: The specific process of the edge server identifying the received data in step S1 is as follows: S11: extracting preset key features from the received data, and extracting a mapping relationship table between preset data types and key features; S12: Matching the extracted key features through the mapping relationship table, and acquiring corresponding data types based on the matching relationship between the key features and the data types.

3. The secure communication method under the edge server and cloud server network architecture according to claim 1, characterized in that: The specific process of detecting the NAT parameters of the target edge server and obtaining the NAT type of the target edge server in step S3 is as follows: S311: The communication channel establishment module sends an ECHO request to the target server. If the target server returns information, it is determined whether the public network IP address is consistent with the NAT internal address of the nearest edge server. If they are consistent, it is confirmed that the nearest edge server is not behind NAT but is a public network address. S312: Determine whether the public network address of the nearest edge server is a complete public network address, send preset information to the first IP address and port, the target server receives the preset information, and uses the second IP address and port to reply the message; S313: If a reply message is received, it is determined to be a complete public network address; if no reply message is received, it is behind a symmetrical firewall; S314: If the received public network IP address is inconsistent with the IP address of the nearest edge server, confirm that the nearest edge server is behind NAT; S315: Send a request to the first address and port of the target server again. The target server replies with the second IP address and port. A mapping table between the intranet address and the external network address is established on the nearest edge server. If a public network reply message can be received, it is determined to be a full cone NAT. S316: If the public network reply message cannot be received, information is sent to the second IP address and port of the target server. The target server uses the second IP address and port to reply information and brings back the public network IP address. If the public network IP address is inconsistent with the public network IP address received in step S34, it is determined to be symmetric NAT. If they are consistent, it is determined to be restrictive NAT. S317: Send information to the first IP address and port of the target server again. If the target server replies with the same IP address but different port number in step S36, it is determined to be IP-restricted NAT. If the port number is the same, it is determined to be port-restricted NAT.

4. The secure communication method under the edge server and cloud server network architecture according to claim 1, characterized in that: The pairing key generated in step S3 is a temporary key used to encrypt data packets during the process of establishing an interactive channel between the nearest edge server and the target edge server, and to encrypt heartbeat packets when the channel is persistent. The pairing key automatically becomes invalid when both the establishment of the interactive channel and persistence are completed.

5. The secure communication method under the edge server and cloud server network architecture according to claim 3 is characterized in that: The interactive channel establishment strategy includes an interactive channel establishment type, a master-slave relationship and strategy parameters.

6. The secure communication method under the edge server and cloud server network architecture according to claim 5, characterized in that: The specific process of step S3 is as follows: S321: The communication channel establishment module detects NAT parameters of the nearest edge server and NAT parameters of the target edge server; S322: The communication channel establishment module generates an interactive channel establishment strategy based on the NAT parameters of the nearest edge server and the NAT parameters of the target edge server, establishes a temporary pairing key and a detection packet in the interactive channel establishment phase, and sends them to the target edge server; S323: The target edge server returns a response for establishing an interactive channel to the communication channel establishment module, and the communication channel establishment module sends the interactive channel establishment strategy, pairing key, and detection packet to the nearest edge server, and the nearest edge server returns a response for establishing an interactive channel to the communication channel establishment module.

7. The secure communication method under the edge server and cloud server network architecture according to claim 1, characterized in that: The specific process of the communication channel establishment module in step S4 establishing a VPN tunnel on the interactive channel established by penetrating NAT is as follows: S41: the communication channel establishing module initiates a request to configure as a VPN server to the target edge server, and the target edge server responds to the request to configure as a VPN server; S42: the communication channel establishing module initiates a request to the nearest edge server to be configured as a VPN server, and the nearest edge server responds to the request to be configured as a VPN server; S43: The communication channel establishing module creates a VPN tunnel on the established interactive channel.

8. The secure communication method under the edge server and cloud server network architecture according to claim 1, characterized in that: It also includes an account management process between the nearest edge server and the target edge server, through which the account management process provides identity authentication support for the establishment of an interaction channel between the nearest edge server and the target edge server and data interaction after the VPN tunnel is established, and prevents unauthorized devices from accessing the VPN network.

9. The secure communication method under the edge server and cloud server network architecture according to claim 8, characterized in that: During the account management process, all data interactions between the nearest edge server and the target edge server are performed through the established VPN tunnel for data transmission.

Images