P2P-VPN networking method and system based on MQTT

Abstract

The invention discloses a P2P-VPN (peer-to-peer virtual private network) networking method based on MQTT (Message Quantitative Trait Transport). The method comprises the following steps of S100, establishing unique supernode center node information of N2N; s200, if available supernode center nodes exist currently, proxy service is achieved through MQTT, the center nodes in the S100 are mapped and proxy into different supernode child nodes, and the different supernode child nodes are distinguished by specifying different topic information; if the available supernode center node does not exist at present, returning to the step S100; and S300, establishing an edge node of N2N, and enabling the edge node to be connected to the supernode child node corresponding to the edge node in the step S200. The invention discloses a P2P-VPN networking system based on MQTT, and is applied to a P2P-VPN networking method based on MQTT. According to the method, unique supernode center node information of N2N is dispersedly agented into different supernode child nodes through MQTT to be exclusively matched with each edge node, so that when any node breaks down, residual nodes in a VPN are not affected, deployment is simple, specific topic information of each node can be visually seen, and the survival state of the nodes can be conveniently judged.

Description

Technical Field

[0001] This invention relates to the field of MQTT protocol technology, and in particular to a P2P-VPN networking method and system based on MQTT. Background Technology

[0002] With the rapid development of global internet technology, more and more people are enjoying the convenience of resource sharing, which greatly facilitates their work and study, effectively improving work efficiency and living standards. However, in today's open internet environment, information transmission is vulnerable to various attacks and threats, making data security difficult to guarantee. Traditional dedicated networks can ensure the security and reliability of data transmission, but their implementation and maintenance costs are too high, hence the emergence of Virtual Private Network (VPN) technology. Using VPN technology can establish a secure tunnel over the public internet, thereby protecting data transmission security, but a series of problems still exist.

[0003] First, in current mainstream VPN technologies, whether IPSec VPN or SSL VPN, a corresponding gateway device needs to be added to the internal network. Therefore, all data in the VPN network must be forwarded through this gateway. However, with the diversification of smart devices and the increasing popularity of mobile work, the looseness of VPN networks will continue to increase. If all data must be forwarded through the VPN gateway to achieve information exchange, this will place a huge load on the gateway. Furthermore, the latency and other overhead caused by this forwarding will also hinder certain services that require real-time and high throughput. Second, these technologies are relatively cumbersome to deploy and complex to manage later, and users cannot intuitively understand the relevant information of each device in the virtual network. Summary of the Invention

[0004] Purpose of the invention: The purpose of this invention is to provide a flexible, secure and easy-to-manage MQTT-based P2P-VPN networking method and system.

[0005] Technical Solution: To achieve the above-mentioned objectives, the present invention provides a P2P-VPN networking method based on MQTT, comprising the following steps:

[0006] S100: Establish unique supernode central node information for N2N;

[0007] S200: If a usable supernode center node already exists, implement a proxy service via MQTT to map the center node in S100 to different supernode child nodes, and distinguish them by specifying different topic information; if no usable supernode center node exists, return S100.

[0008] S300: Establish an N2N edge node and connect the edge node to the corresponding supernode child node in step S200.

[0009] Furthermore, in S100, the N2N includes two different types of nodes: supernode and edge. The supernode provides a place for two edge nodes located behind NAT / firewall to connect. If the two parties complete the initial handshake, the data stream will be transmitted directly between the two edge nodes.

[0010] If one of the NATs is symmetric, then the supernode node will need to continue to help forward packets between the two nodes.

[0011] Furthermore, the N2N supports multiple network topologies, including star, tree, and fully interconnected topologies.

[0012] Furthermore, in S200, MQTT includes three roles: publisher, broker, and subscriber. The corresponding MQTT program for the supernode central node is constructed to realize the unified brokerage of supernode central node information through the MQTT broker.

[0013] Furthermore, the steps to achieve unified proxying of supernode central node information through an MQTT broker include:

[0014] Deploy UDP client and UDP server;

[0015] In the UDP client, use the appropriate MQTT client library to connect to the MQTT broker and subscribe to topics published by the UDP server;

[0016] Start the UDP client. In the UDP client, create a UDP socket and bind it to a specific UDP port.

[0017] After receiving a message from the MQTT broker, the MQTT subscriber forwards the message to the UDP server and sends the message to the specified supernode child node port using a UDP socket.

[0018] In the UDP server, listen on the specified supernode child node port and receive messages from UDP clients;

[0019] Messages are processed and distributed as needed, simulating the behavior of a supernode.

[0020] Furthermore, in S300, edge nodes encrypt connections using the national cryptographic algorithm SM4 during the connection establishment process.

[0021] Furthermore, the connection steps of the edge node as a network terminal node include:

[0022] Each edge node first connects to a supernode child node, and obtains information about other nodes in the network by establishing a connection with the supernode child node;

[0023] With the help of the supernode's child nodes, edge nodes can establish direct point-to-point connections.

[0024] After establishing a peer-to-peer connection, edge nodes achieve peer-to-peer communication by transmitting data packets from one node to another.

[0025] A P2P-VPN networking system based on MQTT, applied to an MQTT-based P2P-VPN networking method, includes public network devices, an MQTT server, and internal network devices, wherein the MQTT server is connected to both the public network devices and the internal network devices.

[0026] The intranet device is equipped with a UDP client, a UDP server, and edge nodes. The node information of the edge nodes is transmitted to the MQTT agent of the MQTT server through the UDP client and the UDP server. The MQTT agent of the MQTT server receives the node information of the edge nodes and transmits the node information of the edge nodes to the supernode central node of the public network device.

[0027] Furthermore, NAT (Network Address Translation);

[0028] A VPN (Virtual Private Network) establishes a temporary, secure connection over a public network, acting as a secure and stable tunnel through the chaotic public network. Typically, a VPN extends a company's intranet, enabling remote users, branch offices, business partners, and suppliers to establish trusted and secure connections to the company's intranet and ensuring secure data transmission.

[0029] MQTT (Message Queuing Telemetry Transport) is an instant messaging protocol developed by IBM.

[0030] N2N is a type of virtual local area network.

[0031] UDP stands for User Datagram Protocol, a connectionless transport layer protocol that provides a simple, unreliable, transaction-oriented message delivery service.

[0032] P2P: Peer to Peer refers to peer-to-peer networks, which are distributed application architectures that distribute tasks and workloads among peers. It is a networking or network form of peer-to-peer computing models at the application layer.

[0033] Beneficial effects: This invention realizes the national cryptographic standardization of encryption algorithms, enhancing data security; one edge node corresponds to one supernode child node, ensuring that the remaining nodes in the VPN are not affected when any node fails; each edge node communicates with the supernode central node through an MQTT proxy, making deployment simple and allowing for a direct view of each node's specific topic information, facilitating the assessment of node liveness and providing a reference for subsequent network connection status diagnosis. Attached Figure Description

[0034] Figure 1 This is a flowchart of the method in Example 1;

[0035] Figure 2 This is a diagram illustrating the MQTT protocol implementation in Example 1;

[0036] Figure 3 This is the N2N related schematic diagram of Example 1;

[0037] Figure 4 This is a system structure diagram of Example 2. Detailed Implementation

[0038] Example 1

[0039] like Figure 1 As shown, a P2P-VPN networking method based on MQTT includes the following steps:

[0040] S100: Establish the unique supernode central node information for N2N; you can try to reconfigure and establish a new supernode master node, check if there are other available supernode master nodes in the network, and try to connect the edge node to one of the available supernode master nodes to ensure that there is an available master node for the edge node to connect to.

[0041] N2N includes two different types of nodes: supernode and edge. The supernode provides a place for two edge nodes behind NAT / firewall to connect. If the two sides complete the initial handshake, the data stream will be transmitted directly between the two edge nodes.

[0042] If one of the NATs is symmetric, then the supernode node will need to continue to help forward packets between the two nodes.

[0043] N2N supports various network topologies, including star, tree, and fully interconnected topologies, to meet diverse communication needs.

[0044] S200: If a usable supernode center node already exists, implement a proxy service via MQTT to map the center node in S100 to different supernode child nodes, and distinguish them by specifying different topic information; if no usable supernode center node exists, return S100; ensure that each edge node can connect to one of the usable supernode child nodes.

[0045] like Figure 2 As shown, MQTT includes three roles: publisher, broker, and subscriber. Publishers publish messages to brokers, brokers subscribe to messages from subscribers and push messages to subscribers. The corresponding MQTT program for the supernode central node is built to realize the unified brokerage of supernode central node information through the MQTT broker.

[0046] The steps to achieve unified proxying of supernode central node information through an MQTT broker include:

[0047] Deploy UDP client and UDP server;

[0048] In the UDP client, use the appropriate MQTT client library to connect to the MQTT broker and subscribe to topics published by the UDP server; ensure that the correct MQTT broker address, port, and authentication information are provided.

[0049] Start the UDP client. In the UDP client, create a UDP socket and bind it to a specific UDP port; this will enable the client to receive messages from the MQTT broker.

[0050] After receiving a message from the MQTT broker, the MQTT subscriber forwards the message to the UDP server and sends the message to the specified supernode child node port using a UDP socket. In this way, when new supernode information is published, the UDP client will receive the corresponding message and send it to the specified supernode child node port.

[0051] In the UDP server, listen on the specified supernode child node port and receive messages from UDP clients;

[0052] Messages are processed and distributed as needed, simulating the behavior of a supernode.

[0053] S300: Create an N2N edge node and connect the edge node to the corresponding supernode child node in step S200.

[0054] During the connection establishment process, edge nodes use the SM4 national cryptographic algorithm for encryption to increase network link security and enhance data confidentiality. The specific encryption algorithm may vary depending on the implementation, but a combination of symmetric key encryption and asymmetric key encryption is usually used for data protection.

[0055] like Figure 3 As shown, the connection steps for an edge node as a network endpoint include:

[0056] Each edge node first connects to a supernode child node, implementing a one-to-one correspondence between edge nodes and supernode child nodes. By establishing a connection with the supernode child node, it obtains information about other nodes in the network; once connected to the supernode, the edge node acquires information about other nodes, including their IP addresses, public keys, etc.

[0057] With the help of the supernode's child nodes, edge nodes can establish direct peer-to-peer connections; this can be achieved by directly transmitting data or by relaying it through the supernode.

[0058] After establishing a peer-to-peer connection, edge nodes achieve peer-to-peer communication by transmitting data packets from one node to another, and ensure data security and integrity through N2N's unique encryption and decryption methods. These data packets can contain any information that needs to be transmitted.

[0059] Through the above operations, the originally single supernode central node is divided into multiple specific supernode child nodes, each with its own dedicated matching mechanism for each edge node. Supernode information can be uniformly brokered through an MQTT broker, and a UDP client and server are used to connect the supernode child nodes and the MQTT broker. This provides a clear view of the specific topic information for each node, facilitating the assessment of node liveness and serving as a reference for subsequent network connectivity diagnostics. During configuration, we can set the corresponding edge node information according to the actual situation.

[0060] Example 2

[0061] like Figure 4 As shown, an MQTT-based P2P-VPN networking system, applied to an MQTT-based P2P-VPN networking method, includes a public network device 1, an MQTT server 2, and an internal network device 3. The MQTT server 2 is connected to both the public network device 1 and the internal network device 3.

[0062] Internal network device 3 is equipped with a UDP client, a UDP server, and an edge node. The node information of the edge node is transmitted to the MQTT agent of MQTT server 2 through the UDP client and the UDP server. The MQTT agent of MQTT server 2 receives the node information of the edge node and transmits the node information of the edge node to the supernode central node of public network device 1.

[0063] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A P2P-VPN networking method based on MQTT, characterized in that, Includes the following steps: S100: Establish unique supernode central node information for N2N; S200: If a usable supernode center node already exists, implement a proxy service via MQTT to map the center node in S100 to different supernode child nodes, and distinguish them by specifying different topic information; if no usable supernode center node exists, return S100. S300: Establish an N2N edge node and connect the edge node to the corresponding supernode child node in step S200.

2. The MQTT-based P2P-VPN networking method according to claim 1, characterized in that, In S100, the N2N includes two different types of nodes: supernode and edge. The supernode provides a place for two edge nodes behind NAT / firewall to connect. If the two parties complete the initial handshake, the data stream will be transmitted directly between the two edge nodes. If one of the NATs is symmetric, then the supernode node will need to continue to help forward packets between the two nodes.

3. The method of claim 2, wherein the method further comprises: The N2N supports multiple network topologies, including star, tree, and fully interconnected topologies.

4. The MQTT-based P2P-VPN networking method according to claim 1, characterized in that, In S200, MQTT includes three roles: publisher, broker, and subscriber. The corresponding MQTT program for the supernode central node is built to realize the unified brokerage of supernode central node information through the MQTT broker.

5. The MQTT-based P2P-VPN networking method according to claim 4, characterized in that, The steps to achieve unified proxying of supernode central node information through an MQTT broker include: Deploy UDP client and UDP server; In the UDP client, use the appropriate MQTT client library to connect to the MQTT broker and subscribe to topics published by the UDP server; Start the UDP client. In the UDP client, create a UDP socket and bind it to a specific UDP port. After receiving a message from the MQTT broker, the MQTT subscriber forwards the message to the UDP server and sends the message to the specified supernode child node port using a UDP socket. In the UDP server, listen on the specified supernode child node port and receive messages from UDP clients; Messages are processed and distributed as needed, simulating the behavior of a supernode.

6. The MQTT-based P2P-VPN networking method according to claim 1, characterized in that, In S300, edge nodes use the national cryptographic algorithm SM4 for encryption during the connection establishment process.

7. A P2P-VPN networking method based on MQTT according to claim 6, characterized in that, The connection steps for the edge node as a network terminal node include: Each edge node first connects to a supernode child node, and obtains information about other nodes in the network by establishing a connection with the supernode child node; With the help of the supernode's child nodes, edge nodes can establish direct point-to-point connections. After establishing a peer-to-peer connection, edge nodes achieve peer-to-peer communication by transmitting data packets from one node to another.

8. A P2P-VPN networking system based on MQTT, characterized in that, The P2P-VPN networking method based on MQTT, applicable to any one of claims 1-7, includes a public network device, an MQTT server, and an internal network device, wherein the MQTT server is connected to both the public network device and the internal network device. The intranet device is equipped with a UDP client, a UDP server, and edge nodes. The node information of the edge nodes is transmitted to the MQTT agent of the MQTT server through the UDP client and the UDP server. The MQTT agent of the MQTT server receives the node information of the edge nodes and transmits the node information of the edge nodes to the supernode central node of the public network device.

Images