Method and system for establishing connection between intranet and extranet and access terminal

Abstract

The embodiment of the present application relates to the technical field of communication connection, and discloses a connection establishment method and system between an internal network and an external network and an access end. In the present application, the access end sends a connection request for a client located in an internal network to a server, receives a returned relay address and a point-to-point candidate address registered by the client, independently and in parallel initiates a point-to-point direct connection attempt and a relay connection attempt by using the relay address and the point-to-point candidate address, makes a decision according to the establishment result of the point-to-point direct connection attempt and the establishment result of the relay connection attempt, and determines a data transmission channel in a successfully established connection. Through the core mechanism of simultaneous issuance, parallel triggering and intelligent decision, the connection reliability of the relay scheme and the high performance and high security of the point-to-point scheme are organically combined, the connection is ensured to be successful in any network environment, and a fast, stable and safe remote access experience is provided for users.

Description

Technical Field

[0001] This application relates to the field of communication connection technology, and in particular to a method, system and access terminal for establishing a connection between internal and external networks. Background Technology

[0002] With the acceleration of digitalization, Network Attached Storage (NAS) devices have been widely used in homes and personal settings, becoming users' private data centers. Users expect to be able to access their NAS devices located on their home or office intranets anytime, anywhere, securely, and efficiently from the Internet. However, due to the depletion of Internet Protocol version 4 (IPv4) addresses, most home broadband connections are after Carrier-Grade Network Address Translation (CGNAT) and lack public IP addresses. This prevents external network devices from directly initiating connection requests to internal NAS devices, a problem known as "internal network penetration."

[0003] To solve this problem, existing technologies can be mainly divided into three categories: The first type is a router-based port forwarding solution. This solution relies on the user having a public IP address and manually configuring port forwarding rules on the router. Its drawbacks are: public IP addresses are increasingly scarce, and most home broadband connections cannot obtain them; the configuration is complex and not user-friendly for ordinary users; and it directly exposes internal network services to the public network, resulting in poor security.

[0004] The second type is the pure relay forwarding solution, such as the standard reverse proxy protocol (Fast Reverse Proxy, FRP) and Ngrok. This solution uses a third-party server located on the public internet as a relay. Internal NAS clients actively establish persistent connections with the relay server, and external access clients forward data through the relay server. Its drawbacks are: all data traffic must pass through the relay server, making the relay server's uplink bandwidth a bottleneck, resulting in slow access speeds and high latency; user data flowing through a third-party server poses a privacy risk; service availability depends on the stability of the relay server, and relay services require high bandwidth and server costs.

[0005] The third type is a serial combination of P2P and relay schemes, such as the "P2P first, relay later" serial fallback mechanism: the access end first attempts to establish a direct P2P connection with the internal network client, and only after the P2P attempt fails or times out does it initiate a relay connection as a backup channel. This serial scheme balances the high performance of P2P and the reliability of relay to some extent, but its shortcomings are also obvious: because the P2P attempt and the establishment of the relay connection are executed serially, the access end can only trigger the relay connection after the P2P attempt has completely failed or the timeout has ended, resulting in a significant increase in the overall latency of connection establishment; moreover, the continuous process of P2P attempts will block the pre-establishment of the relay channel. When P2P finally fails, the relay channel needs to go through the entire connection establishment process again from the beginning, including signaling negotiation and channel allocation, which cannot achieve independent pre-establishment and rapid switching of the two channels, and the overall connection experience still has considerable room for improvement.

[0006] In addition, the connection success rate of pure P2P traversal schemes is highly dependent on the network address translation type of both parties, and the traversal failure rate is relatively high in complex network environments; although pure relay forwarding schemes can guarantee connection success, they have transmission performance bottlenecks and privacy and security risks.

[0007] In summary, existing technologies, whether pure P2P solutions, pure relay solutions, or solutions combining both serially, cannot achieve high-performance, low-latency, secure direct connections while ensuring successful connection establishment. How to provide a connection establishment solution that organically integrates the high performance of P2P direct connections with the high reliability of relay connections, while avoiding the increased latency and channel congestion problems associated with serial solutions, is a pressing technical problem to be solved in this field. Summary of the Invention

[0008] The purpose of this application is to provide a method, system, and access terminal for establishing a connection between internal and external networks, so as to ensure successful connection in any network environment and provide users with a fast, stable, and secure remote NAS access experience.

[0009] To address the aforementioned technical problems, embodiments of this application provide a method for establishing a connection between an internal and external network, applied to an access terminal located on the external network. The method includes: sending a connection request to a server for a client located on the internal network; receiving a relay address returned by the server and a peer-to-peer candidate address registered by the client; independently and in parallel initiating peer-to-peer direct connection attempts and relay connection attempts using the relay address and the peer-to-peer candidate address; and executing an adjudication based on the establishment results of the peer-to-peer direct connection attempts and the relay connection attempts, thereby determining a data transmission channel in a successfully established connection.

[0010] Embodiments of this application also provide a connection establishment system between internal and external networks, comprising: a server, configured to receive and record peer-to-peer candidate addresses registered by clients located on the internal network; when receiving a connection request from an access terminal located on the external network, sending the peer-to-peer candidate addresses and a relay address to the access terminal; the client located on the internal network, configured to register the peer-to-peer candidate addresses with the server; and the access terminal located on the external network, configured to execute the connection establishment method between internal and external networks as described above.

[0011] Embodiments of this application also provide an access terminal, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the above-described method for establishing a connection between internal and external networks.

[0012] In this embodiment, the server receives and records the peer-to-peer candidate addresses registered by clients located on the intranet. In response to a connection request from an access client located on the extranet, the server sends the peer-to-peer candidate addresses and a relay address to the access client, triggering the access client to initiate both peer-to-peer direct connection attempts and relay connection attempts in parallel. The access client executes a decision based on the establishment results of the peer-to-peer direct connection attempts and relay connection attempts to determine the data transmission channel from the successfully established connections. Through the core mechanism of simultaneous sending, parallel triggering, and intelligent decision-making, the connection reliability of the relay scheme is organically integrated with the high performance and high security of the peer-to-peer scheme. This ensures successful connection in any network environment and automatically prioritizes peer-to-peer direct connection channels when conditions permit, providing users with a fast, stable, and secure remote access experience. Attached Figure Description

[0013] One or more embodiments are illustrated by way of example with reference numerals in the accompanying drawings. These illustrations do not constitute a limitation on the embodiments. Elements with the same reference numerals in the drawings are denoted as similar elements. Unless otherwise stated, the figures in the drawings are not to be limited by scale.

[0014] Figure 1 This is a flowchart of a method for establishing a connection between an internal and external network according to an embodiment of this application; Figure 2 This is a schematic diagram illustrating the specific process of establishing a link between devices according to an embodiment of this application; Figure 3 This is a schematic diagram of the structure of a connection establishment system between internal and external networks according to another embodiment of this application; Figure 4 This is a schematic diagram of the access terminal structure according to another embodiment of this application. Detailed Implementation

[0015] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the various embodiments of this application will be described in detail below with reference to the accompanying drawings. However, those skilled in the art will understand that many technical details have been presented in the various embodiments of this application to enable readers to better understand this application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical solutions claimed in this application can be implemented. The division of the various embodiments below is for the convenience of description and should not constitute any limitation on the specific implementation of this application. The various embodiments can be combined with and referenced by each other without contradiction.

[0016] One embodiment of this application relates to a method for establishing a connection between an internal and external network, which can be applied to an access terminal located on the external network. The access terminal can be various computing devices (such as personal computers, servers, mobile terminals, etc.). In this embodiment, the method receives and records the peer-to-peer candidate addresses registered by a client located on the internal network; in response to a connection request from an access terminal located on the external network, the peer-to-peer candidate addresses and a relay address are sent to the access terminal together to trigger the access terminal to initiate peer-to-peer direct connection attempts and relay connection attempts in parallel; an adjudication is performed based on the establishment results of the peer-to-peer direct connection attempts and the relay connection attempts to determine the data transmission channel from the successfully established connections. Through the core mechanism of simultaneous sending, parallel triggering, and intelligent adjudication, the connection reliability of the relay scheme and the high performance and high security of the peer-to-peer scheme are organically integrated, ensuring successful connection in any network environment, and automatically prioritizing the peer-to-peer direct connection channel when conditions permit, providing users with a fast, stable, and secure remote access experience. The following is a detailed description of the implementation details of the connection establishment method between the internal and external networks in this embodiment. The following content is only for the convenience of understanding and is not necessary for implementing this solution.

[0017] like Figure 1 As shown, in step 101, a connection request to the client located on the intranet is sent to the server, and the relay address returned by the server and the peer-to-peer candidate address registered by the client are received. In step 102, point-to-point direct connection attempts and relay connection attempts are initiated independently and in parallel using the relay address and the point-to-point candidate address. In one example, the accessing end in step 102 above initiates peer-to-peer direct connection attempts and relay connection attempts independently and in parallel. This can be achieved by the accessing end simultaneously initiating the handshake establishment operation for the peer-to-peer direct connection path and the channel establishment operation for the relay connection path in a multi-threaded concurrent environment. The establishment processes of the peer-to-peer direct connection path and the relay connection path are executed independently and concurrently. By changing the serial attempts to parallel execution, the total connection establishment time is significantly shortened, avoiding the long wait caused by the traditional approach of "trying P2P first and then starting the relay after failure." This makes the connection establishment process almost imperceptible to the user, further optimizing the user's remote access experience.

[0018] In step 103, an adjudication is performed based on the establishment results of the point-to-point direct connection attempt and the relay connection attempt, thereby determining the data transmission channel in a successfully established connection.

[0019] In one example, the decision made in step 103 above, based on the establishment results of the point-to-point direct connection attempt and the relay connection attempt, can be as follows: if both the point-to-point direct connection attempt and the relay connection attempt are successful within a preset timeout window, the point-to-point direct connection is selected as the data transmission channel; if the point-to-point direct connection attempt fails or receives no response within the timeout window, but the relay connection attempt is successful, the relay connection is selected as the data transmission channel; and if the relay connection attempt fails or receives no response within the timeout window, but the point-to-point direct connection attempt is successful, the point-to-point direct connection is selected as the data transmission channel. In other words, if P2P is successful within the timeout window, the P2P channel is selected first; otherwise, the relay channel is switched to. This logic is simple, efficient, and makes rapid decisions, ensuring that users receive optimal transmission performance when the P2P direct connection is successful, and ensuring that the connection is not interrupted when the P2P fails, thus implementing an intelligent selection strategy of optimal priority and fallback.

[0020] In one example, the decision in step 103 is executed based on a preset timeout window, the duration of which is dynamically configured according to the network latency between the access end and the server. This intelligent selection of the timeout duration based on actual conditions ensures both sufficient handshake response time for P2P direct connections and the immediacy of connection establishment.

[0021] In one example, the timeout window is configured to be between 200 and 500 milliseconds. This range is the optimal range determined through practical experience—too short a window can cause P2P direct connections to be falsely judged as failing due to network jitter, while too long a window increases the perceived waiting time for the user; thus, it ensures both sufficient handshake response time for P2P direct connections and the immediacy of connection establishment.

[0022] In one example, step 103, which involves making a decision based on the establishment results of the point-to-point direct connection attempt and the relay connection attempt, can be as follows: upon receiving a point-to-point direct connection instruction from the server, select the point-to-point direct connection as the data transmission channel; upon receiving a relay connection instruction from the server, select the relay connection as the data transmission channel. The point-to-point direct connection instruction and the relay connection instruction are generated by the server through real-time monitoring of the connection establishment status of the point-to-point direct connection path and the relay connection path. This approach eliminates the need for a preset timeout window for decision-making. The enhanced reverse proxy protocol server (hereinafter referred to as the enhanced FRP server) monitors the dual-path connection status of the point-to-point direct connection path and the relay connection path in real time, and issues connection decisions and resource scheduling instructions uniformly based on the global link status, ensuring that the connection establishment process of both paths is controlled by the same scheduling strategy. Furthermore, this scheduling does not conflict with the access end waiting for a preset window for decision-making; the two work together to actively terminate and select different connection establishment processes.

[0023] In one example, the above method may further include: after selecting a point-to-point direct connection as the data transmission channel, the access end sends a relay resource release notification to the server, so that the server can release the channel resources occupied by the relay connection. This avoids the long-term occupation of server resources by established backup channels, effectively reducing server resource consumption and operating costs, and has significant economic benefits, especially in large-scale concurrent scenarios.

[0024] In one example, the server is an Enhanced Reverse Proxy Protocol (ERP) server (hereinafter referred to as the Enhanced FRP server). The Enhanced FRP server maintains both the signaling control channel with the client and the relay data channel with the accessing client. Point-to-point direct connection attempts are executed concurrently by the accessing client, independently of both the signaling control channel and the relay data channel. The signaling control channel is responsible for control plane operations such as status monitoring and command issuance, while the relay data channel only carries business data when needed; the two do not interfere with each other. Even if the relay data channel is interrupted due to network problems, the signaling control channel remains independently viable, and the server can still perceive the client's online status through the signaling channel. Traditional FRP servers establish a complete relay channel during client registration and occupy resources for a long time; however, in this example, the relay data channel is only actually used when P2P fails. But while P2P is still in the trial phase, the signaling control channel is already ready, allowing the relay data channel to be quickly established when needed, shortening the delay of switching to relay after P2P failure. The signaling control channel can also be used for heartbeat keep-alive, obtaining P2P connection status, etc., so that the server, as the signaling interaction hub, is in the most advantageous architectural position to gather dual-path status information.

[0025] In one example, the aforementioned server acts only as a signaling exchange center when a point-to-point direct connection is successful, without participating in data transmission. When a point-to-point direct connection fails, the server acts as a data relay node, supporting the functional separation of the signaling plane and data plane. This functional separation of the signaling plane and data plane is the core architectural innovation that distinguishes this invention from the standard FRP service—the standard FRP server can only act as a relay node, while the server in this application can dynamically switch roles according to network conditions, realizing on-demand use of resources.

[0026] In one example, before registering a peer-to-peer candidate address with the server, the client first obtains its public reflected address after passing through a Session Traversal Utilities for NAT (STUN) server on the public network. This public reflected address is then used as the peer-to-peer candidate address. This ensures that the client obtains the correct public mapped address, providing a fundamental guarantee for the success rate of subsequent P2P direct connection attempts.

[0027] In one example, the server and client maintain a persistent connection via periodic heartbeats. These heartbeats are used to keep the control channel alive and monitor the client's online status. This ensures the long-term stable availability of the control channel, allowing the server to perceive the client's online / offline status in real time, avoiding invalid connection attempts to offline clients, and improving system reliability and resource utilization efficiency.

[0028] For ease of understanding, the following example illustrates a complete and concrete system for establishing connections between internal and external networks to execute the method described in this application. The specific process is as follows: Figure 2 As shown, since this example is one specific implementation of the above method, the relevant technical details mentioned in the above method are still valid in this example and presented in a more specific way, but this does not mean that this is the only way of presentation. To reduce repetition, they will not be repeated here. Specifically: In one example, the system for establishing connections between the internal and external networks includes: a NAS client, an enhanced FRP server, an access client, and a STUN server.

[0029] 1. The NAS client first obtains its public network reflection address (IP_C:Port_C) behind the NAT gateway through the public STUN server. Specifically: after the NAS client completes the initialization / registration phase, it queries the STUN server for the public network reflection address, and the STUN server returns the candidate address (IP_C:Port_C). 2. The NAS client registers its P2P candidate address and authentication information with the enhanced FRP server. The server saves this information and completes the service publication. Specifically: the NAS client sends a registration request + P2P candidate address (IP_C:Port_C) to the enhanced FRP server; the enhanced FRP server records the NAS information (relay address, P2P address), and registration is complete; 3. The NAS client and FRP server maintain a persistent connection through periodic heartbeats to ensure uninterrupted control. The heartbeat maintenance loop between the NAS client and the enhanced FRP server mainly includes: the NAS client sending a heartbeat packet, and the enhanced FRP server responding with a heartbeat.

[0030] 4. Connection Establishment and Intelligent Switching: Users initiate connection requests through the access client. Specifically, after the access client initiates the user access phase, it requests a connection to the specified NAS from the enhanced FRP server.

[0031] 5. Information delivery: The FRP server returns the NAS relay address and P2P candidate address to the accessing client. Specifically: The enhanced FRP server returns the NAS relay address + P2P candidate address; 6. Parallel Attempt (Key Step): The parallel connection and intelligent switching phase includes two parallel threads (par), thread A and thread B, as detailed below: Thread A: P2P direct connection attempt, i.e., the access client attempts to establish a direct connection with the NAS client's P2P candidate address. Thread A includes: the access client attempting a P2P direct connection (sending a handshake packet to IP_C:Port_C) to the NAS client.

[0032] Thread B is a relay connection attempt (between the access client and the enhanced FRP server), whereby the access client simultaneously establishes a relay proxy connection through the FRP server. This connection is forwarded and acknowledged via a pre-established control channel between the FRP server and the NAS client. Thread B includes: the access client requesting a relay connection from the enhanced FRP server; the enhanced FRP server forwarding the relay connection request to the NAS client through the control channel; the NAS client accepting the relay connection and informing the enhanced FRP server; and the enhanced FRP server informing the access client that the relay connection has been successfully established.

[0033] In some complex ICE (Interactive Connection Establishment) implementations, there is indeed a mechanism for "trying multiple candidate address pairs simultaneously" (i.e., "parallel connectivity checks"), but the "parallelism" here refers to the parallelism of different transmission modes (P2P mode and relay mode), rather than the parallelism of different candidate address pairs within the same mode under the ICE framework.

[0034] 7. Intelligent adjudication and switching, which is to use intelligent adjudication (critical area, represented by Critical) (timeout window T), including two paths: [P2P success (preferred path)] and [P2P timeout / failure (backup path)].

[0035] Ideally (P2P Success), i.e., [P2P Success (Preferred Path)]: If network traversal is allowed, the NAS client will receive a P2P handshake packet and reply. If the accessing client receives the reply within the timeout window, it immediately selects the P2P channel for all subsequent data transmissions and may optionally notify the server to release relay resources. In other words: [P2P Success (Preferred Path)] is considered a successful P2P connection detected when the NAS client sends a P2P handshake reply to the accessing client; the accessing client notifies the enhanced FRP server to release relay resources (this step is optional); the accessing client informs the NAS client that all subsequent data will be transmitted through the P2P channel.

[0036] In the backup scenario (P2P failure), i.e., [P2P timeout / failure (backup path)]: If no P2P response is received within the timeout window, the accessing client will automatically switch to the already successfully established relay channel for data transmission. In other words: [P2P timeout / failure (backup path)] means that if no P2P response is received after a timeout T, the accessing client informs the NAS client that all subsequent data will be transmitted through the relay channel.

[0037] In this implementation, the core mechanism of simultaneous distribution, parallel triggering, and intelligent adjudication upgrades the server from a simple data node to a connection scheduling hub. Without increasing the complexity on the end side, it achieves an organic integration of the reliability of the relay scheme and the high performance and high security of the P2P scheme, ensuring that a connection can be successfully established in any network environment.

[0038] The steps described above are for clarity only. In practice, they can be combined into one step or some steps can be split into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this application. Adding insignificant modifications or introducing insignificant designs to the algorithm or process, but without changing the core design of the algorithm and process, are also within the scope of protection of this application.

[0039] Another embodiment of this application relates to a connection establishment system between internal and external networks, such as... Figure 3As shown, it includes: a client 401 located on the intranet, used to register the peer-to-peer candidate address with the server; a server 402, used to receive and record the peer-to-peer candidate address registered by the client located on the intranet; when receiving a connection request from an access terminal located on the extranet, the server sends the peer-to-peer candidate address and a relay address to the access terminal; and an access terminal 403 located on the extranet, used to execute the connection establishment method between the intranet and extranet as described above.

[0040] In this implementation, through the collaborative cooperation among various components, the core mechanism of simultaneous distribution, parallel triggering, and intelligent adjudication is realized, which upgrades the server from a simple data forwarding node to a connection scheduling hub. Without increasing the complexity on the end side, the reliability of the relay scheme and the high performance and high security of the P2P scheme are organically integrated, ensuring that a connection can be successfully established in any network environment.

[0041] It is not difficult to see that this embodiment is a system embodiment corresponding to the above-described method embodiment, and this embodiment can be implemented in conjunction with the above-described method embodiment. The relevant technical details mentioned in the above-described method embodiment are still valid in this embodiment, and will not be repeated here to reduce repetition. Correspondingly, the relevant technical details mentioned in this embodiment can also be applied to the above-described method embodiment.

[0042] It is worth mentioning that all modules involved in this embodiment are logical modules. In practical applications, a logical unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. Furthermore, to highlight the innovative aspects of this application, this embodiment does not introduce units that are not closely related to solving the technical problem proposed in this application; however, this does not mean that other units are absent from this embodiment.

[0043] Another embodiment of this application relates to an access terminal, such as... Figure 4 As shown, it includes at least one processor 501; and a memory 502 communicatively connected to the at least one processor; wherein the memory 502 stores instructions executable by the at least one processor 501, the instructions being executed by the at least one processor 501 to enable the at least one processor 501 to perform the connection establishment method between the internal and external networks as described above.

[0044] The memory 502 and processor 501 are connected via a bus, which can include any number of interconnecting buses and bridges. The bus connects various circuits of one or more processors 501 and memory 502 together. The bus can also connect various other circuits, such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. A bus interface provides an interface between the bus and the transceiver. The transceiver can be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by processor 501 is transmitted over a wireless medium via an antenna, which further receives data and transmits it to processor 501.

[0045] Processor 501 is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory 502 can be used to store data used by processor 501 during operation.

[0046] Another embodiment of this application relates to a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the method embodiments described above.

[0047] That is, those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. This program is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0048] Those skilled in the art will understand that the above embodiments are specific implementations of this application, and in practical applications, various changes can be made in form and detail without departing from the spirit and scope of this application.

Claims

1. A method for establishing a connection between an internal and external network, characterized in that, Applied to an access terminal located on the external network, the method includes: Send a connection request to the server for the client located on the intranet, and receive the relay address returned by the server and the peer-to-peer candidate address registered by the client; Using the relay address and the point-to-point candidate address, point-to-point direct connection attempts and relay connection attempts are initiated independently and in parallel. An adjudication is performed based on the results of the point-to-point direct connection attempt and the relay connection attempt, thereby identifying a data transmission channel among the successfully established connections.

2. The method for establishing a connection between internal and external networks according to claim 1, characterized in that, The independent and parallel initiation of point-to-point direct connection attempts and relay connection attempts include: In a multi-threaded concurrent environment, handshake establishment operations for point-to-point direct connection paths and channel establishment operations for relay connection paths are initiated simultaneously. The establishment processes of the point-to-point direct connection path and the relay connection path are executed independently and concurrently.

3. The method for establishing a connection between internal and external networks according to claim 1, characterized in that, The step of making a decision based on the establishment results of the point-to-point direct connection attempt and the relay connection attempt includes: If both the point-to-point direct connection attempt and the relay connection attempt are successful within the preset timeout window, the point-to-point direct connection will be selected as the data transmission channel. If the point-to-point direct connection attempt fails or no response is received within the timeout window, and the relay connection attempt is successful, then the relay connection is selected as the data transmission channel. If the relay connection attempt fails or no response is received within the timeout window, and the point-to-point direct connection attempt is successful, then the point-to-point direct connection is selected as the data transmission channel.

4. The method for establishing a connection between internal and external networks according to claim 3, characterized in that, The duration of the timeout window is dynamically configured based on the network latency between the client and the server.

5. The method for establishing a connection between internal and external networks according to claim 3, characterized in that, The method further includes: When the point-to-point direct connection is selected as the data transmission channel, a relay resource release notification is sent to the server so that the server can release the channel resources occupied by the relay connection.

6. The method for establishing a connection between internal and external networks according to claim 1, characterized in that, When the point-to-point direct connection is successful, the server acts only as a signaling exchange center and does not participate in data transmission. When the point-to-point direct connection fails, the server acts as a data relay forwarding node, supporting the functional separation of the signaling plane and the data plane.

7. The method for establishing a connection between internal and external networks according to claim 1, characterized in that, The step of making a decision based on the establishment results of the point-to-point direct connection attempt and the relay connection attempt includes: Upon receiving the point-to-point direct connection instruction from the server, the point-to-point direct connection is selected as the data transmission channel. Upon receiving the relay connection instruction from the server, the relay connection is selected as the data transmission channel. The point-to-point direct connection command and the relay connection command are generated by the server through real-time monitoring of the connection establishment status of the point-to-point direct connection path and the relay connection path.

8. The method for establishing a connection between internal and external networks according to claim 1, characterized in that, The server is an enhanced reverse proxy protocol server, which simultaneously maintains a signaling control channel with the client and a relay data channel with the access terminal; the point-to-point direct connection attempt is executed concurrently by the access terminal independently of the signaling control channel and the relay data channel.

9. A connection establishment system between internal and external networks, characterized in that, include: The server is used to receive and record the peer-to-peer candidate addresses registered by clients located on the intranet; When a connection request to the client is received from an access terminal located on the external network, the peer-to-peer candidate address and a relay address are sent to the access terminal together. The client located on the intranet is used to register the peer-to-peer candidate address with the server; The access terminal located on the external network is used to execute the connection establishment method between the internal and external networks as described in any one of claims 1 to 8.

10. An access terminal, characterized in that, include: At least one processor; as well as, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the connection establishment method between internal and external networks as described in any one of claims 1 to 8.

Images