Mdsplus authentication and fine-grained access control method, device and medium

Abstract

This invention relates to the field of nuclear fusion experimental data security and database access control technology, and discloses an MDSplus authentication and fine-grained access control method, device, and medium. The method includes: extracting the operation type of client requests through protocol monitoring and hijacking; extracting credentials contained in the request using a tree-structured data interface expression hijacking, and verifying identity through an in-memory database; dynamically intercepting and verifying requests that pass authentication; and forwarding the request to the MDSplus data server through a gateway, and transparently transmitting the returned result back to the client with zero loss. This invention, through a non-intrusive proxy gateway, achieves strong identity authentication, artillery number and node-level fine-grained access control for the native MDSplus system, while utilizing an in-memory database to support high concurrency, significantly improving data security and system stability without modifying the original code.

Description

Technical Field

[0001] This invention relates to the field of nuclear fusion experimental data security and database access control technology, specifically to an MDSplus authentication and fine-grained access control method, device and medium. Background Technology

[0002] The MDSplus system is a widely used experimental data management system in the international nuclear fusion field, employing a hierarchical tree structure to store massive amounts of experimental data. The experimental data from nuclear fusion devices has extremely high scientific research value and is highly confidential; therefore, strict security control over its read and write operations is crucial.

[0003] However, the existing MDSplus native architecture has serious inherent deficiencies in security protection and access control, specifically facing the following three major technical bottlenecks: (1) Lack of strong identity authentication: The existing MDSplus system uses a very weak trust mechanism by default, and the native architecture lacks a strong identity authentication and authorization link consisting of a standard username and password. Under normal circumstances, the system only relies on broad host IP restrictions or even allows anonymous access, which means that any terminal node connected to the research LAN can easily initiate a connection request to the server. Since the real identity of the user cannot be accurately identified at the beginning of the session, the system loses the first line of defense to block unauthorized users from the source.

[0004] (2) Coarse-grained global data sharing: The existing MDSplus system lacks fine-grained user and data mapping management strategies. Once the client and server successfully establish a connection, the system by default grants access to all experimental trees and nodes for that connection. The native mechanism cannot achieve the permission isolation requirement of "restricting specific users to access only specific data". This indiscriminate authorization mode is extremely prone to serious data leakage and unauthorized operation risks.

[0005] (3) Authentication performance bottleneck under high concurrency: Nuclear fusion experimental data reading has the characteristic of instantaneous high concurrency. Traditional single-point authentication mechanisms based on relational databases are prone to exhausting the database connection pool when faced with massive concurrent waveform data retrieval requests, thereby dragging down the entire data service.

[0006] (4) Invasive risks of underlying modification: Experimental data from superconducting tokamak devices such as EAST (Experimental Advanced Superconducting Tokamak) have high scientific value that cannot be reproduced. Directly modifying the underlying C / C++ core code of the MDSplus system to implant authentication logic not only has extremely high development and maintenance costs, but also easily damages the stability and data consistency of the original system, leading to an incalculable risk of loss of scientific research data. Summary of the Invention

[0007] To address the aforementioned technical problems, this invention provides an MDSplus authentication and fine-grained access control method, device, and medium.

[0008] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: In a first aspect, the present invention provides an MDSplus authentication and fine-grained access control method, comprising: Build a non-intrusive independent proxy gateway to serve as the sole communication bridge between the client and the MDSplus data server. Extract the operation type of the client's request through protocol listening and hijacking, and achieve network isolation of the core server. In-memory database-based authentication: The credentials contained in the request sent by the client are extracted by hijacking the tree-structured data interface expression, and then the identity is verified through the in-memory database. Access control based on relational database: Based on the access control matrix consisting of username, tree name, cannon number and signal, requests that have passed authentication are dynamically intercepted and verified, and only requests that meet the access control rules are allowed to pass. When a request passes authentication and authorization verification consecutively, the gateway establishes an internal TCP tunnel with the MDSplus data server, forwards the request to the MDSplus data server, and transparently transmits the returned result back to the client with zero loss.

[0009] In one embodiment, the operation type of extracting client requests through protocol listening and hijacking specifically includes: The gateway silently listens for client requests on a designated port at the front end. Internally, it implements a binary parsing module that is compatible with the native MDSplus system communication protocol. This module disassembles the message header and message body of the TCP data packets in the request and identifies the operation type of the request to provide an authentication context.

[0010] In one embodiment, the implementation of network isolation for the core server specifically includes: The MDSplus data server is hidden within the gateway's internal network, listening on the local loopback address or internal private LAN port, and rejecting any direct connection requests from sources other than the gateway.

[0011] In one embodiment, the step of extracting credentials contained in a request sent by the client using a tree-structured data interface expression hijacking specifically includes: After establishing a connection, the client sends a tree-structured data interface string containing a specific prefix and credentials via a GET request. When the gateway intercepts the GET request, if it recognizes the specific prefix in the tree-structured data interface string, it determines that the GET request is an authentication handshake, blocks the transmission of the GET request to the backend, and parses the credentials based on the tree-structured data interface string internally. The credentials include the username and password.

[0012] In one embodiment, the identity verification via an in-memory database specifically includes: After the gateway extracts the credentials, it verifies them against the local in-memory database. If the verification fails, the gateway returns a forged MDSplus system exception packet to the client, including an exception packet that forces a disconnection or an exception packet containing a specific error code. If the verification succeeds, the gateway tags the TCP connection corresponding to the request with a legitimate identity label in memory and allows subsequent requests of the TCP connection to proceed.

[0013] In one embodiment, the permission matrix is ​​constructed based on username, tree name, cannon number, and signal; The username is used to identify the entity that initiated the request; The tree name is used to represent a database in the MDSplus data server; The cannon number is used to define the discharge cannon number of the nuclear fusion experiment that is accessible to this user; The signal represents the physical parameters measured by sensors in a nuclear fusion experiment.

[0014] In one embodiment, the dynamic interception and verification of authenticated requests, allowing them to proceed only if they meet the permission granting rules, specifically includes: When a client initiates a business request through a TCP connection with a valid identity tag, the gateway captures the username, tree name, cannon number, and signal in the business request. Before sending the business request to the MDSplus data server, it suspends the thread corresponding to the business request and determines: Permission granting rule A: Does the cannon number in the current business request fall within the range of cannon numbers granted to this user? Permission grant rule B: Does the signal in the current business request fall within the range of signals granted to this user? If both permission rule A and permission rule B are satisfied simultaneously, the business request is allowed; if neither permission rule A nor permission rule B is satisfied simultaneously, the gateway constructs an abnormal response packet to deceive the client and achieves application-layer blocking.

[0015] In one embodiment, when a request continuously passes authentication and authorization verification, the gateway establishes an internal TCP tunnel with the MDSplus data server, forwards the request to the MDSplus data server, and transparently transmits the returned result back to the client with zero loss. Specifically, this includes: Only when the client's request passes identity authentication and authorization verification consecutively, the gateway, acting as a legitimate agent, establishes an internal TCP tunnel with the actual backend MDSplus data server, forwards the cleaned request to the MDSplus data server, and when the MDSplus data server completes data retrieval and returns the result, the gateway starts full-duplex streaming forwarding mode and transmits the result back to the client.

[0016] In a second aspect, the present invention provides a computer device including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method of any embodiment of the first aspect.

[0017] Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method of any embodiment of the first aspect.

[0018] Compared with the prior art, the beneficial technical effects of the present invention are: 1. This invention innovatively reconstructs the implicit login authentication channel, fundamentally blocking unauthorized malicious probes and connections. Addressing the issue of the native MDSplus system lacking a standard login handshake protocol and being highly vulnerable to anonymous malicious connections, this invention creatively designs an implicit identity authentication engine based on the TDI (Tree Data Interface) expression mechanism. The gateway cleverly intercepts TDI strings in a specific format (such as credentials with the AUTH: prefix) as authentication credentials, forcibly adding a login verification access barrier to the system without modifying the native client communication protocol standard. This mechanism establishes a robust identity isolation wall at the forefront of the network, completely eliminating the long-standing vulnerability of unsecured connections in the native system, effectively identifying and rejecting illegal requests from the initial connection establishment stage.

[0019] 2. This invention breaks away from the coarse-grained authorization of the native protocol, achieving extremely fine-grained control at the gun number and signal level. The native MDSplus system, focusing on extremely high data throughput, has extremely weak security mechanisms, commonly exhibiting a serious unauthorized access vulnerability: "once a connection is successful, the entire database can be pulled without restriction." This invention establishes a permission verification engine based on a relational database, performing deep analysis of request data packets at the protocol level. This precisely refines data access permissions to a multi-dimensional combination of user entities, specific experimental trees, gun numbers, and signals. This mechanism allows system administrators to precisely restrict specific users to reading only non-classified physical waveforms within a specified gun number range, completely eliminating unauthorized data retrieval and internal theft, perfectly meeting the high security requirements for preventing the leakage of scientific research data.

[0020] 3. This invention breaks through the high-concurrency throughput bottleneck and achieves lossless physical data transmission, ensuring seamless compatibility with the existing scientific research business ecosystem. Addressing the massive concurrent waveform reading surges generated during nuclear fusion experiments or large-scale data analysis, this invention uses a front-end Redis pure in-memory database to handle extremely high-frequency identity verification. A single node can easily handle concurrency spikes, completely avoiding the risk of connection pool collapse that traditional relational databases face when dealing with massive concurrency. More importantly, after dual-engine authentication and access control, the gateway system automatically switches to full-duplex streaming transparent tunnel mode, performing zero-loss, high-speed transparent transmission of millions of binary floating-point physical data streams returned by core data nodes. Through the fusion mechanism of memory-level concurrency peak reduction and seamless underlying transmission, this invention allows researchers to smoothly integrate their existing massive data processing scripts and automated analysis programs without modifying any code, achieving a perfect unity of ultra-fast response and zero business awareness in extremely high-concurrency scenarios.

[0021] 4. This invention achieves a zero-intrusive security upgrade of the underlying physical data system, completely eliminating the risk of data corruption. Existing technologies for enhancing the security of the MDSplus system typically rely on modifying the underlying C / C++ core source code or implanting hook functions within the system. This highly intrusive approach is not only extremely costly to develop and maintain, but also highly susceptible to disrupting the native system's memory management. A crash could directly lead to the irreproducible corruption or loss of valuable scientific experimental data (such as EAST discharge data). This invention employs a forward proxy gateway architecture, placing all complex authentication and interception logic entirely at the gateway layer. The actual MDSplus system core server requires no modification to any line of native code; it simply needs to be hidden behind the gateway via a firewall or physical router to achieve comprehensive security protection. This mechanism maximizes the absolute security and physical isolation of core data nodes. Attached Figure Description

[0022] Figure 1 This is a flowchart of the method of the present invention.

[0023] Figure 2 This is the overall architecture and data flow diagram of the non-intrusive proxy gateway system proposed in this invention.

[0024] Figure 3 It is the workflow of fine-grained identity authentication in the gateway system.

[0025] Figure 4 This is the workflow for fine-grained permission verification in the gateway system. Detailed Implementation

[0026] A preferred embodiment of the present invention will now be described in detail with reference to the accompanying drawings.

[0027] like Figure 1 As shown, this invention provides an MDSplus authentication and fine-grained access control method, comprising the following steps: S1 constructs a non-intrusive independent proxy gateway, serving as the sole communication bridge between the client and the MDSplus data server. It extracts the operation type of the client's request through protocol listening and hijacking, and achieves network isolation of the core server. S2, In-memory database-based authentication: It uses tree-structured data interface expressions to hijack and extract the credentials contained in the request sent by the client, and performs identity verification through the in-memory database; S3, permission verification based on relational database: Based on the permission matrix composed of username, tree name, cannon number and signal, requests that have passed authentication are dynamically intercepted and verified, and only requests that meet the permission permission rules are allowed to pass. S4. When a request passes identity authentication and authorization verification consecutively, the gateway establishes an internal TCP tunnel with the MDSplus data server, forwards the request to the MDSplus data server, and transparently transmits the returned result back to the client with zero loss.

[0028] This invention aims to solve the problems of coarse-grained native access control and high risk of underlying modification in the existing MDSplus system, and proposes a fine-grained access control mechanism based on a forward proxy gateway architecture and an identity authentication engine and a permission verification engine.

[0029] The present invention will be described in detail below in several parts.

[0030] 1. Build a non-intrusive, independent proxy gateway system.

[0031] Deploy an independent C++ smart gateway system as the sole communication bridge between the client and the actual MDSplus server.

[0032] Protocol Listening and Hijacking: The gateway silently listens for connection requests initiated by clients on a designated port (such as port 8000 in the native MDSplus system). Internally, it implements a binary parsing module that is fully compatible with the native MDSplus client / server communication protocol. When a client initiates a request, the gateway does not forward it immediately. Instead, it disassembles the TCP data packet, extracts the message header and message body, and accurately identifies the operation type of the current client request (such as Connect, OpenTree, Get, etc.) to provide context for subsequent interception and authentication. For example, when the client's request type is Connect, authentication is performed through the identity authentication engine; when the client's request type is OpenTree or Get, fine-grained permission verification is performed through the permission verification engine. Since the gateway completely disguises the client as a standard MDSplus server at the protocol level, existing research clients (such as Python and C++ clients) can directly connect without modifying any underlying code.

[0033] Network isolation protection: In the network architecture design, the core MDSplus data server, which actually stores high-value scientific experimental data, is hidden within the gateway's internal network (e.g., listening on a local loopback address or an internal private LAN port). The core server is completely invisible to the external public network, rejecting any direct connection requests from sources other than the gateway. This forward intelligent proxy architecture not only achieves absolute physical isolation between computing nodes and core data nodes, but also effectively resists direct malicious network attacks targeting the core database or system crashes caused by malformed data packets.

[0034] 2. Establish an identity authentication engine based on the Redis in-memory database.

[0035] To address the massive concurrent connection requests generated during nuclear fusion experiments, such as the instantaneous discharge or large-scale data analysis, traditional relational databases are prone to connection pool congestion when handling high-frequency authentication. Therefore, this invention introduces an authentication-login (Auth-L) engine based on a Redis in-memory database at the first layer of the gateway.

[0036] Tree Data Interface (TDI) Hijacking and Credential Extraction: Since the native MDSplus protocol lacks a standard login authentication handshake phase, this invention innovatively utilizes the Tree Data Interface (TDI) expression of the MDSplus system to hijack authentication credentials. After establishing a connection, the client actively sends a TDI string containing a specific prefix (e.g., AUTH:username:password). When the gateway intercepts a GET request, if it recognizes this specific prefix, it determines it as an authentication handshake, immediately blocks the request from being transmitted to the backend, and internally parses it into an authentication tuple containing the username and password.

[0037] Memory-level high-concurrency verification: After extracting the authentication tuple, the gateway performs a rapid comparison directly using its local Redis in-memory database. Leveraging its pure in-memory operation capabilities, the Redis in-memory database can complete high-frequency identity verification in microseconds, effectively handling concurrency spikes. If verification fails, the gateway directly returns a forged MDSplus system exception packet to the client (such as a forced disconnection or a specific error code). If verification succeeds, the gateway tags the TCP connection with a "legitimate identity" session state in memory and allows subsequent operation requests, completing the first line of security control.

[0038] 3. Establish a fine-grained permission verification engine for Auth-A based on a relational database.

[0039] After successful identity authentication, in order to address the coarse-grained limitation of the native system that allows access to the entire database upon connection, this invention introduces an authorization-access (Auth-A) engine based on a relational database (such as MySQL) at the second layer of the gateway.

[0040] The permission verification engine is designed and maintained with a multi-dimensional, fine-grained permission matrix. This permission matrix breaks down access permissions into the following core dimensions: User dimension (Username): Identifies the entity that initiated the request; Tree Name dimension: such as the east_1 tree, which limits the major categories of experiments that can be accessed; Shot Number: Precisely defines the discharge shot number that the user can access (e.g., 147001). Signal Node: A node with specific physical parameters that can be accessed for precise control.

[0041] Dynamic interception and fine-grained verification at the request ID level: When a client with legitimate credentials initiates a business request (such as openTree('east_1', 147001)), the gateway's protocol parsing module accurately captures the target tree name and the specific request ID. Before sending the request to the real server, the gateway suspends the current thread and sends an SQL query to the permission verification engine, carrying the parsed username, tree name, and request ID.

[0042] The permission verification engine strictly compares whether the current request falls within the range of weapon numbers granted to the user. Only when the action perfectly matches the permission rules in the permission matrix will the permission verification engine issue a permission instruction; if unauthorized access is made to sensitive weapon numbers or confidential signals, the gateway will directly construct underlying response packets such as %TREE-W-NNF, Node Not Found, or access denied to deceive the client, thus achieving physical blocking at the application layer logic.

[0043] 4. Lossless, high-speed, transparent transmission of massive amounts of physical waveform data.

[0044] Only after a client request has passed the stringent verification of both the authentication and authorization engines will the gateway, acting as a legitimate agent, initiate transparent network transmission to the actual MDSplus system core server at the backend. The gateway establishes an internal TCP tunnel with the core server, forwarding the cleaned, secure request intact. Once the core server completes its massive data retrieval and returns the results, the gateway switches to full-duplex streaming forwarding mode, transmitting the binary data stream back to the frontend client with zero loss and seamless transmission. This completes the data access loop under high concurrency while ensuring absolute security.

[0045] Example: The following example, using a nuclear fusion experiment data reading scenario, illustrates the execution flow of this invention: (1) Scenario setting: The experimenters used a Python client to try to pull the absolute radiometer data (node ​​\AXUV_DIV1) of the 147001st shot under the east_1 tree in the core database through the gateway.

[0046] (2) Identity verification: The gateway intercepts the AUTH:user085:rightPassWord085 credentials sent by the client, and marks the connection as "legitimate" after successfully querying the Redis in-memory database.

[0047] (4) Permission verification: The client initiates an openTree('east_1', 147001) request. The gateway extracts the features and queries the MySQL database. If the user is granted permission to access cannon 147001, the gateway issues a permission through the permission verification engine.

[0048] (5) Data acquisition: The gateway requests data from the core server (the MDSplus data server that stores the real data) on behalf of the client. The core server returns the data and the gateway transmits it back to the Python client at high speed and transparently without loss, thus completing the closed loop.

[0049] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the invention. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0050] It should be understood that although the steps in the flowcharts of the accompanying drawings are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the flowcharts of the accompanying drawings may include multiple steps or stages, which are not necessarily completed at the same time, but may be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but may be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0051] In one embodiment, the present invention provides a computer device, which may be a server. The computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database stores data used in the methods described above. The network interface communicates with external terminals via a network connection. The computer program is executed by the processor to implement the methods described above.

[0052] In one embodiment, the present invention provides a computer-readable storage medium including instructions, such as a memory including instructions that can be executed by a processor to perform the above-described method. The storage medium may be a computer-readable storage medium, for example, a ROM, RAM, CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.

[0053] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0054] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention, and no reference numerals in the claims should be construed as limiting the scope of the claims.

[0055] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

Claims

1. An MDSplus authentication and fine-grained access control method, characterized in that, include: Build a non-intrusive independent proxy gateway to serve as the sole communication bridge between the client and the MDSplus data server. Extract the operation type of the client's request through protocol listening and hijacking, and achieve network isolation of the core server. In-memory database-based authentication: The credentials contained in the request sent by the client are extracted by hijacking the tree-structured data interface expression, and then the identity is verified through the in-memory database. Relational database-based permission verification: Based on the permission matrix composed of username, tree name, cannon number, and signal, requests that have passed authentication are dynamically intercepted and verified. Only requests that meet the permission release rules are allowed. Specifically, when a client initiates a business request through a TCP connection with a valid identity label, the gateway captures the username, tree name, cannon number, and signal in the business request. Before sending the business request to the MDSplus data server, the thread corresponding to the business request is suspended, and it is determined whether permission release rule A, the cannon number in the current business request, falls within the range of cannon numbers granted to the user, is valid. Permission rule B determines whether the signal in the current business request falls within the range of signals granted to the user. If both permission rules A and B are satisfied, the business request is allowed. If neither permission rules A nor permission rule B are satisfied, the gateway constructs an abnormal response packet to deceive the client and achieves application-layer blocking. Once the request passes authentication and authorization verification, the gateway establishes an internal TCP tunnel with the MDSplus data server, forwards the request to the MDSplus data server, and transparently transmits the returned result back to the client.

2. The MDSplus authentication and fine-grained access control method according to claim 1, characterized in that, The operation types of extracting client requests through protocol listening and hijacking specifically include: The gateway silently listens for client requests on a designated port at the front end. Internally, it implements a binary parsing module that is compatible with the native MDSplus system communication protocol. This module disassembles the message header and message body of the TCP data packets in the request and identifies the operation type of the request to provide an authentication context.

3. The MDSplus authentication and fine-grained access control method according to claim 1, characterized in that, The implementation of network isolation for the core server specifically includes: The MDSplus data server is hidden within the gateway's internal network, listening on the local loopback address or internal private LAN port, and rejecting any direct connection requests from sources other than the gateway.

4. The MDSplus authentication and fine-grained access control method according to claim 1, characterized in that, The method of using tree-structured data interface expressions to hijack and extract credentials contained in requests sent by clients specifically includes: After establishing a connection, the client sends a tree-structured data interface string containing a specific prefix and credentials via a GET request. When the gateway intercepts the GET request, if it recognizes the specific prefix in the tree-structured data interface string, it determines that the GET request is an authentication handshake, blocks the transmission of the GET request to the backend, and parses the credentials based on the tree-structured data interface string internally. The credentials include the username and password.

5. The MDSplus authentication and fine-grained access control method according to claim 1, characterized in that, The identity verification via in-memory database specifically includes: After the gateway extracts the credentials, it verifies them against the local in-memory database. If the verification fails, the gateway returns a forged MDSplus system exception packet to the client, including an exception packet that forces a disconnection or an exception packet containing a specific error code. If the verification succeeds, the gateway tags the TCP connection corresponding to the request with a legitimate identity label in memory and allows subsequent requests of the TCP connection to proceed.

6. The MDSplus authentication and fine-grained access control method according to claim 1, characterized in that, The permission matrix is ​​constructed based on username, tree name, cannon number, and signal; The username is used to identify the entity that initiated the request; The tree name is used to represent a database in the MDSplus data server; The cannon number is used to define the discharge cannon number of the nuclear fusion experiment that is accessible to this user; The signal represents the physical parameters measured by sensors in a nuclear fusion experiment.

7. The MDSplus authentication and fine-grained access control method according to claim 1, characterized in that, When a request passes authentication and authorization verification, the gateway establishes an internal TCP tunnel with the MDSplus data server, forwards the request to the MDSplus data server, and transparently transmits the returned result back to the client. This process specifically includes: Only when the client's request passes identity authentication and authorization verification consecutively, the gateway, acting as a legitimate agent, establishes an internal TCP tunnel with the actual backend MDSplus data server, forwards the cleaned request to the MDSplus data server, and when the MDSplus data server completes data retrieval and returns the result, the gateway starts full-duplex streaming forwarding mode and transmits the result back to the client.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images