WO2022068269A1 - Server communication method and apparatus, computer device, and storage medium - Google Patents

Abstract

The present disclosure relates to a server communication method and device, a computer device, and a storage medium, and relates to the technical field of cloud computing. The method comprises: receiving a first handshake request, the first handshake request comprising a first certificate, first session information, and a target domain name; when domain name information in the first certificate matches a first domain name of a first server and verification of a session identifier in the first session information is successful, responding to the first handshake request, the domain names of all of the servers in a content delivery network being the same.

Description

Communication method, apparatus, computer equipment and storage medium of server

This disclosure claims all rights and interests of the invention patent application with the application number 202011051216.2 and the invention title "Communication method, device, computer equipment and storage medium for server" submitted to the State Intellectual Property Office of the People's Republic of China on September 29, 2020, and It is incorporated by reference into this disclosure in its entirety.

technical field

The present disclosure relates to the technical field of cloud computing, and more particularly, to a communication method, apparatus, computer device and storage medium of a server.

Background technique

CDN (Content Delivery Network, Content Delivery Network) is an intelligent virtual network built on the basis of the existing network, relying on edge servers deployed in various places, through the load balancing, content distribution, scheduling and other functional modules of the central platform, so that users can be nearby Get the content you need, reduce network congestion, and improve user access response speed and hit rate. The key technologies of CDN mainly include content storage and distribution technology.

For the distributed architecture of CDN, there are different levels. The number of servers closer to the source site is less, and the number of servers closer to the client is greater. Therefore, there must be the possibility of cross-operator and cross-regional transmission within the CDN and the source site. , so there is also a need for HTTPS (Hyper Text Transfer Protocol over SecureSocket Layer) transmission between these public networks, which is called full-link HTTPS. The CDN itself is also based on the HTTPS protocol, and the HTTPS protocol is very easy Excessive server CPU consumption.

SUMMARY OF THE INVENTION

In a first aspect, the present disclosure provides a communication method for a server, which is applied to a first server, where the first server is a server in a content distribution network, comprising: receiving a first handshake request, where the first handshake request includes a first certificate , the first session information and the target domain name; and in the case that the domain name information in the first certificate matches the first domain name of the first server, and the verification of the session identifier in the first session information is successful, Respond to the first handshake request, wherein all servers in the content distribution network have the same domain name.

In a second aspect, the present disclosure provides a communication method for a server, which is applied to a second server, where the second server is a server in a content distribution network, comprising: receiving a third handshake request, where the third handshake request includes a third certificate , the third session information and the target domain name; the domain name information in the third certificate matches the third domain name of the second server, the verification of the session identifier in the third session information is successful, and the If no content matching the target domain name is found in the memory of the second server, generate a first handshake request, and send the first handshake request to the first server, where the first handshake request includes the first certificate, first session information and the target domain name; and receiving a response content from the first server.

In a third aspect, the present disclosure provides a communication method for a server, applied to a client, comprising: sending a fourth handshake request to a second server, where the fourth handshake request includes a target domain name, communication address information and second session information; and In the case that the domain name information in the communication address information matches the second domain name of the second server, and the verification of the session identifier in the second session information is successful, receive the response content from the second server , and the response content is content matching the target domain name.

In a fourth aspect, the present disclosure provides a communication device for a server, comprising: a first handshake request receiving module configured to receive a first handshake request, wherein the first handshake request includes a first certificate, first session information and a target domain name; and a handshake response module, configured to: in the case that the domain name information in the first certificate matches the first domain name of the first server and the session identifier in the first session information is successfully verified, A handshake request is responded to, wherein the domain names of all servers in the content distribution network are the same.

In a fifth aspect, the present disclosure provides a communication device for a server, comprising: a third handshake request receiving module configured to receive a third handshake request, wherein the third handshake request includes a third certificate, third session information and a target domain name; a handshake request sending module, configured so that the domain name information in the third certificate matches the third domain name of the second server, the session identifier in the third session information is successfully verified, and the second If no content matching the target domain name is found in the memory of the server, a first handshake request is generated, and the first handshake request is sent to the first server, where the first handshake request includes the first certificate, the first handshake request, and the first handshake request. a session information and the target domain name; and a first response content receiving module configured to receive the response content from the first server.

In a sixth aspect, the present disclosure provides a communication device for a server, comprising: a third handshake request sending module configured to send a fourth handshake request to a second server, where the fourth handshake request includes a target domain name, communication address information and a second handshake request. session information; and a second response content receiving module, configured to match the domain name information in the communication address information with the second domain name of the second server and successfully verify the session identifier in the second session information In this case, a response content from the second server is received, where the response content is content matching the target domain name.

In certain embodiments, the present disclosure provides a computer apparatus including a memory, a processor, and a computer program stored on the memory and executable on the processor, the processor executing the computer program to perform the steps of: receiving a first handshake request, where the first handshake request includes a first certificate, first session information, and a target domain name; and the domain name information in the first certificate matches the first domain name of the first server, and is valid for all In the case of successful verification of the session identifier in the first session information, the first handshake request is responded to, wherein the domain names of all servers in the content distribution network are the same.

In certain embodiments, the present disclosure provides a computer-readable storage medium having stored thereon a computer program that, when executed by a processor, implements the steps of: receiving a first handshake request, the first handshake request comprising: The first certificate, the first session information and the target domain name; and the domain name information in the first certificate matches the first domain name of the first server, and the session identifier in the first session information is successfully verified In the case of responding to the first handshake request, the domain names of all servers in the content distribution network are the same.

In some embodiments, the present disclosure provides a communication method, apparatus, computer device and storage medium for a server, the method includes: receiving a first handshake request, the first handshake request including a first certificate, first session information and the target domain name; in the case that the domain name information in the first certificate matches the first domain name of the first server and the session identifier in the first session information is successfully verified, the first handshake The request is responded to, wherein the domain names of all servers in the content distribution network are the same. Handshake with other servers or clients through the domain name information and session information in the certificate. Since different clients use different domain names in the TLS/SSL handshake process, it is easy to cause excessive CPU consumption in the CDN during the handshake process. The domain names of all servers in the CDN are configured with the same domain name, which shortens the handshake between each server in the content distribution network, thereby reducing the internal CPU consumption of the CDN.

Brief Description of Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the disclosure and together with the description serve to explain the principles of the disclosure.

In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in some situations, the following briefly introduces the embodiments or the accompanying drawings that need to be used in some situations. It is obvious to those skilled in the art that , on the premise of no creative labor, other drawings can also be obtained from these drawings.

Fig. 1 is the application environment diagram of the communication method of the server in one embodiment;

2 is a schematic flowchart of a communication method of a server in one embodiment;

3 is a schematic flowchart of a communication method of a server in one embodiment;

4 is a schematic flowchart of a communication method of a server in one embodiment;

5 is a structural block diagram of a communication device of a server in one embodiment;

6 is a structural block diagram of a communication device of a server in one embodiment;

7 is a structural block diagram of a communication device of a server in one embodiment;

FIG. 8 is a diagram of the internal structure of a computer device in one embodiment.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the present disclosure. Obviously, the described embodiments These are some, but not all, embodiments of the present disclosure. Based on the embodiments in the present disclosure, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present disclosure.

FIG. 1 is an application environment diagram of a communication method of a server in one embodiment. Referring to FIG. 1 , the communication method of the server is applied to the communication system of the server. The server's communication system includes a client 110 and a content distribution network (CDN) 120 . The client 110 and the content distribution network 120 communicate via the HTTPS protocol. The client 110 may be a desktop terminal or a mobile terminal, and the mobile terminal may be at least one of a mobile phone, a tablet computer, a notebook computer, and the like. The content distribution network 120 includes an origin server and servers at various levels. The servers at each level can be implemented by an independent server or a server cluster composed of multiple servers. Each server in the content distribution network 120 completes communication through the HTTPS protocol. Communication through the HTTPS protocol includes, but is not limited to, the TCP handshake phase, the TLS handshake phase, and the HTTP response phase.

In one embodiment, FIG. 2 is a schematic flowchart of a communication method of a server in an embodiment. Referring to FIG. 2 , a communication method of a server is provided. In this embodiment, the method is mainly applied to the server in the content distribution network 120 in FIG. 1 as an example, and the server is used as the first server, and the communication method of the server includes the following steps:

Step S210, receiving a first handshake request, where the first handshake request includes a first certificate and first session information; and

Step S220, in the case that the domain name information in the first certificate matches the first domain name of the first server and the session identifier in the first session information is successfully verified, respond to the first handshake request, wherein the content distribution network All servers have the same domain name.

In this embodiment, when the TCP handshake phase is completed with the first server, the TLS handshake phase is performed. The first handshake request is a handshake request (ClientHello) in the TLS handshake phase, and the first handshake request may come from other lower-level servers. The server or client, when the first handshake request comes from other lower-level servers, the first handshake request includes the first certificate, the first session information and the target domain name, the first certificate includes the signature information and the domain name information, the first The certificate is used for signature authentication and domain name verification during the TLS handshake process. The domain name information is the identification information used to indicate the server to be accessed in the TLS phase. The first session information is used to restore the last session record with the first server. It is omitted. In the process of negotiating the encryption key in the TLS handshake phase, there is no need to spend time re-performing a complete TLS handshake operation. The target domain name is the domain name of the site to be accessed in the HTTP response phase if the handshake is successful in the TLS handshake phase.

In this embodiment, the first domain name is the domain name identifier of the first server, the domain name information in the first certificate matches the first domain name of the first server, it is determined that the first server is the server to be accessed, and the session identifier is the one in the last session. The session record identifier includes the session ticket and the session code. If the session identifier in the first session information is successfully verified, it means that the first server has successfully resumed the session. Both the domain name information and the session identifier are verified successfully, which proves that the handshake is successful. Respond to the first handshake request according to the target domain name, and enter the HTTP response stage. Since the TLS handshake phase and the HTTP response phase correspond to different configurations, the TLS handshake phase does not affect the response of the HTTP response phase.

Since the server inside the CDN usually serves many domain names, the domain name information in different handshake requests specifies different domain names, so it is necessary to communicate with the domain name certificate corresponding to the domain name information, and the server cannot find the domain name certificate that matches the domain name information. In this case, there will be an error that the SSL/TLS handshake is unsuccessful, and the matching domain name certificate will be searched for different domain name information. The matching process is cumbersome and time-consuming. Configure the domain names of all servers in the CDN to be the same domain name, and all the servers in the CDN correspond to the same domain name certificate. When the domain name information matches the corresponding domain name certificate during the TLS handshake process between the servers in the CDN, due to the pending access The server only includes a domain name certificate that matches the domain name information, which shortens the domain name matching time, shortens the handshake time, and shortens the handshake between each server in the content distribution network, thereby reducing the internal CPU consumption of the CDN.

In one embodiment, the domain name information includes a second domain name, the second domain name is parsed from the first certificate, and the first domain name configured for the first server is obtained; if the second domain name is the same as the first domain name, determine The domain name information matches the first domain name.

In one embodiment, the second domain name is obtained by parsing the first domain name information in the first certificate, the second domain name is the SNI (Server Name Indication, server name indication) in the first handshake request, and the second domain name and the first If the first domain name of a server is the same, it is determined that the first server is the server to be accessed, and the first server is allowed to respond to the first handshake request; if the second domain name is different from the first domain name of the first server, It is determined that the first server is not the server to be accessed corresponding to the first handshake request, and the first server cannot respond to the first handshake request.

In one embodiment, a configuration instruction is received, wherein the configuration instruction is an instruction sent to all servers in the content distribution network; the domain name of the first server is configured as the first domain name according to the instruction of the configuration instruction.

In one embodiment, before receiving the first handshake request, all servers inside the CDN receive a configuration instruction for configuring domain name information, and execute the configuration instruction, where the configuration instruction is an instruction for configuring the domain name of the server as a specified domain name, and configure The command carries the specified domain name to be configured, and the specified domain name can be customized, that is, the first domain name above is the specified domain name. According to the configuration instructions, configure the domain names of all servers in the CDN to the same specified domain name, that is, the Nginx (engine x) of all servers in the CDN. , Web server) is configured with the same specified domain name, when the TLS handshake is performed between CDN internal servers, due to the same domain name information, the time for determining the server to be accessed is shortened, and the TLS handshake is shortened, thereby reducing the internal CPU consumption of the CDN.

In one embodiment, if the first content matching the target domain name is found in the storage of the first server, the first content is returned; the first content matching the target domain name is not found in the storage of the first server In the case of , return the second content, where the second content is the content matching the target domain name found by the content distribution network from the storage of the origin server.

In one embodiment, when the first content matching the target domain name is found on the memory of the first server, that is, when the TLS handshake phase is completed with the first server, the first server allows the first handshake request to be made. Respond, enter the HTTP response stage, look up the site to be visited that matches the target domain name in the memory of the first server, and find the site to be visited that matches the target domain name in the memory of the first server, the to-be-visited site is found. The content of the site is used as the first content, and the first content is returned.

In the case where the to-be-visited site matching the target domain name is not found in the memory of the first server, it is proved that there is no content matching the target domain name in the first server, and the first server, as a client, requests other servers for The to-be-visited site matching the target domain name, in the case that the to-be-visited site matching the target domain name is found in the memory of other servers, the content of the to-be-visited site is returned as the second content.

If the site to be accessed that matches the target domain name cannot be found on other servers except the origin server, the site to be accessed that matches the target domain name is searched from the storage of the origin server, and the storage of the origin server is matched with that of the destination domain name. The to-be-visited site matching the target domain name is used as the second content and returned.

In one embodiment, before returning the second content, a second handshake request is generated, wherein the second handshake request includes the second certificate, the second session information and the target domain name; the second handshake request is sent to the origin server; The second content returned by the origin server, where the second content is in the case that the parsed logical address of the domain name information in the second certificate matches the logical address in the origin server, and the origin server successfully verifies the second session information , the content found in the storage of the origin server that matches the target domain name.

In one embodiment, the first server is the server closest to the origin server, the site to be accessed that matches the target domain name is not found in the memory of the first server, and the first server and the origin server complete the TCP handshake. In the case of the TLS handshake stage, the first server generates a second handshake request as a client, and sends the second handshake request to the origin server. The second handshake request is a handshake request in the TLS handshake stage, and the second handshake request includes the second certificate, the first Second session information and target domain name, the second certificate includes signature information and domain name information, the second certificate is used for signature authentication and domain name verification in the TLS handshake process, the domain name information is the identification information used to indicate the server to be accessed in the TLS phase, and the second certificate is used for signature authentication and domain name verification during the TLS handshake process. The second session information is used to resume the session, and the process of negotiating the encryption key in the TLS handshake phase is omitted, and there is no need to spend time re-performing a complete TLS handshake operation.

In the case where the parsed logical address of the domain name information in the second certificate matches the logical address in the origin server, and the origin server successfully verifies the second session information, that is, the origin server and the first server are in the TLS handshake stage. If the handshake is successful, the origin server allows to respond to the second handshake request of the first server, and enters the HTTP response stage, and uses the content of the site to be accessed that matches the target domain name in the memory of the origin server as the second content, and the first server The second content sent from the origin server is received.

In one embodiment, in the case that the first server successfully verifies the session ticket of the session identifier, or the session code of the session identifier matches the encoded session identifier in the first server, the verification of the session identifier in the first session information succeeds .

In one embodiment, the session identifier includes a session ticket (Session Ticket) and a session code (Session ID), and the session ticket and session code are session handshake records in the TLS handshake phase, and the first server successfully decrypts the session ticket to obtain the last In the case of the session key, it is determined that the first server successfully authenticates the session identifier in the first session information, restores the session according to the last session key, and completes the TLS handshake.

In one embodiment, in the case where the same session code as the session code in the first session information is found in the first server, it can also be determined that the first server successfully authenticates the session identifier in the first session information, according to the session code. Resume the session and complete the TLS handshake.

In one embodiment, the session identifier includes a session ticket and a session code, and if the first server successfully verifies the session ticket of the session identifier, the session identifier in the first session information is verified successfully; in the first server In the case where the server fails to verify the session ticket of the session ID, verify whether the session ID of the session ID matches the session ID in the first server, and if the session ID of the session ID matches the session ID in the first server, verify whether the session ID matches the session ID in the first server. The session identifier in the first session information is verified successfully.

In one embodiment, when the first session information includes both the session ticket and the session code, the first server preferentially decrypts and verifies the session ticket, and decrypts the session ticket at the first server to obtain the last session key. In this case, there is no need to search the first server for the same session code as the session code of the first session information.

In the case that the first server fails to decrypt the session ticket, search the first server for the same session code as the session code of the first session information.

In one embodiment, FIG. 3 is a schematic flowchart of a communication method for a server in an embodiment. Referring to FIG. 3 , this embodiment provides a communication method for a server, which is applied to a second server, and the second server is a server in a content distribution network. server, and the second server is a lower-level server of the first server, that is, the first server is closer to the origin server than the second server, and the second server is closer to the client than the first server. The method includes:

Step S310, receiving a third handshake request, where the third handshake request includes a third certificate, third session information and a target domain name;

Step S320, the domain name information in the third certificate matches the third domain name of the second server, the session ID verification in the third session information is successful, and no content matching the target domain name is found in the memory of the second server In the case of , generate a first handshake request, and send the first handshake request to the first server, where the first handshake request includes the first certificate, the first session information and the target domain name; and

Step S330, receiving the response content from the first server.

In this embodiment, when the TCP handshake phase is completed with the second server, the TLS handshake phase is performed, the third handshake request is a handshake request (ClientHello) in the TLS handshake phase, and the third handshake request may come from other lower-level servers. The server or client, if the third handshake request comes from other lower-level servers, the third handshake request includes the third certificate, the third session information and the target domain name, the third certificate includes the signature information and the domain name information, the third The certificate is used for signature authentication and domain name verification in the TLS handshake process. The domain name information is the identification information of the server to be accessed in the TLS phase, and the third session information is used to resume the session. The process of negotiating the encryption key in the TLS handshake phase is omitted. , there is no need to spend time re-performing a complete TLS handshake operation. The target domain name is the domain name of the site to be accessed in the HTTP response phase if the handshake is successful in the TLS handshake phase.

In this embodiment, when the domain name information in the third certificate matches the third domain name of the second server, and the session identifier in the third session information is successfully verified, it is determined that the handshake with the second server in the TLS handshake phase is successful. , enter the HTTP response stage, in the case where the site to be visited that matches the target domain name is not found in the memory of the second server, generate a first handshake request, and the first handshake request is used to complete the TCP between the second server and the first server. In the case of the handshake phase, the first server is requested to perform the TLS handshake phase.

In this embodiment, when the first server and the second server complete HTTPS communication, the second server receives response content from the first server, where the response content is content corresponding to the site to be accessed that matches the target domain name.

In one embodiment, the response content is that in the case that the domain name information in the first certificate matches the first domain name of the first server, and the verification of the session identifier in the first session information is successful, on the storage of the first server The content found that matches the target domain name.

In one embodiment, the response content is that when the first server and the second server complete the TLS handshake phase, the content corresponding to the site to be accessed that matches the target domain name in the memory of the first server is used as the response content, and the first server Return the response content to the second server.

In one embodiment, the response content is that the domain name information in the first certificate matches the first domain name of the first server, the session identifier in the first session information is successfully verified, and the memory of the first server is not found. In the case of the content matching the target domain name, the content matching the target domain name is found from the storage of the origin server through the content distribution network.

In one embodiment, in the case that the domain name information in the first certificate matches the first domain name of the first server, and the verification of the session identifier in the first session information is successful, it is proved that the first server and the second server are in the TLS handshake stage. The handshake is successful, the HTTP response stage is entered, and the site to be visited that matches the target domain name is searched in the memory of the first server. If the site to be visited that matches the target domain name is not found in the memory of the first server, the first server Continue to request the site to be visited that matches the target domain name to the upper-level server, until the storage of the upper-level server finds the site to be visited that matches the target domain name, and the content of the site to be visited is used as the second content, that is, the first server needs to be used as The client and the upper-layer server perform HTTPS communication, and the communication between the first server and the upper-layer server refers to the communication mode between the first server and the second server.

If the site to be accessed that matches the target domain name cannot be found on other servers except the origin server, the site to be accessed that matches the target domain name is searched from the storage of the origin server, and the storage of the origin server is matched with that of the destination domain name. The to-be-visited site matching the target domain name is returned as the response content.

In one embodiment, FIG. 4 is a schematic flowchart of a communication method for a server in an embodiment. Referring to FIG. 4 , this embodiment provides a communication method for a server, which is applied to a client, including:

Step S410, sending a fourth handshake request to the second server, where the fourth handshake request includes the target domain name, communication address information and second session information; and

Step S420, in the case that the domain name information in the communication address information matches the second domain name of the second server, and the verification of the session identifier in the second session information is successful, receive a response content from the second server, and the response content is the same as that of the second server. Content that matches the target domain name.

In this embodiment, the second server is the server closest to the user side in the CDN network. When the client and the second server complete the TCP handshake phase, the client sends a fourth handshake request to the second server to enter the TLS handshake stage, the fourth handshake request is the handshake request (ClientHello) in the TLS handshake stage, the fourth handshake request includes the target domain name, the communication address information and the fourth session information, and the target domain name is the HTTP response when the handshake is successful in the TLS handshake stage. The domain name of the site to be accessed in the phase, the communication address information includes domain name information, the communication address information is used to determine the server to be accessed, and the fourth session information is used to restore the last session record with the second server, omitting the negotiation in the TLS handshake phase In the process of encrypting the key, it does not need to spend time to perform a complete TLS handshake operation again. The fourth session information includes a session identifier, which is the session record identifier in the previous session, and the session identifier includes a session ticket and a session code.

In this embodiment, the domain name information in the communication address information matches the second domain name of the second server, that is, it is determined that the second server is the server to be accessed, and the session identifier in the second session information is successfully verified, that is, the second server is verified with the second server. The session between the two is successfully restored, the TLS handshake is completed between the client and the second server, and the HTTP response stage is entered, and the site to be visited that matches the target domain name is searched in the memory of the second server, but cannot be searched in the memory of the second server. In the case of the to-be-visited site that matches the target domain name, the CDN content performs HTTPS communication to the server layer by layer in the order of gradually approaching the origin server to find the content corresponding to the to-be-visited site that matches the target domain name, until it finds the content corresponding to the to-be-visited site that matches the target domain name. The content matching the target domain name, in the case that the servers at each layer in the CDN cannot find the content matching the target domain name, the content matching the target domain name is searched from the origin server as the response content, and the response content is passed through the server layer by layer. Return to the client.

2 to 4 are schematic flowcharts of communication methods for servers in different embodiments, respectively. It should be understood that although the steps in the flowcharts of FIG. 2 to FIG. 4 are shown in sequence according to the arrows, these steps are not necessarily executed in the sequence shown by the arrows. Unless explicitly stated herein, the execution of these steps is not strictly limited to the order, and these steps may be performed in other orders. Moreover, at least a part of the steps in FIG. 2 to FIG. 4 may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed and completed at the same time, but may be executed at different times. These sub-steps or stages may be executed at different times. The order of execution of the stages is also not necessarily sequential, but may be performed alternately or alternately with other steps or sub-steps of other steps or at least a portion of a stage.

In one embodiment, FIG. 5 is a structural block diagram of a communication apparatus of a server in an embodiment. As shown in FIG. 5, a communication apparatus of a server is provided, including:

a first handshake request receiving module 510, configured to receive a first handshake request, where the first handshake request includes the first certificate, the first session information and the target domain name; and

The handshake response module 520 is configured to respond to the first handshake request when the domain name information in the first certificate matches the first domain name of the first server and the session identifier in the first session information is successfully verified, wherein , all servers in the content delivery network have the same domain name.

In one embodiment, the domain name information includes the second domain name, and the handshake response module 520 includes:

a domain name obtaining unit, configured to resolve the second domain name from the first certificate, and obtain the first domain name configured for the first server; and

The domain name matching unit is configured to determine that the domain name information matches the first domain name when the second domain name is the same as the first domain name.

In one embodiment, the apparatus further includes:

a configuration instruction receiving module configured to receive a configuration instruction, wherein the configuration instruction is an instruction sent to all servers in the content distribution network; and

The configuration instruction execution module is configured to configure the domain name of the first server as the first domain name according to the instruction of the configuration instruction.

In one embodiment, the handshake response module 520 further includes:

a first content returning unit, configured to return the first content when the first content matching the target domain name is found on the memory of the first server; and

The second content returning unit is configured to return the second content when the first content matching the target domain name is not found on the storage of the first server, wherein the second content is the storage of the source server from the content distribution network Matches to the target domain name found in .

In one embodiment, the handshake response module 520 further includes:

a handshake request generating unit, configured to generate a second handshake request, wherein the second handshake request includes the second certificate, the second session information and the target domain name;

a handshake request sending unit, configured to send a second handshake request to the origin server; and

The second content receiving unit is configured to receive the second content fed back from the origin server, where the second content is that the parsed logical address of the domain name information in the second certificate matches the logical address in the origin server, and the origin server If the verification of the second session information is successful, the content matching the target domain name is found in the storage of the origin server.

In one embodiment, the session identifier includes a session ticket and a session code, and the handshake response module 520 further includes:

The first verification unit is configured to verify the session identifier in the first session information when the first server successfully verifies the session ticket of the session identifier, or the session code of the session identifier matches the encoded session identifier in the first server. success.

In one embodiment, the handshake response module 520 further includes:

A priority verification unit, configured to successfully verify the session identifier in the first session information when the first server successfully verifies the session ticket of the session identifier;

a second verification unit, configured to verify whether the session code of the session identifier matches the session code in the first server when the first server fails to verify the session ticket of the session identifier; and

The session verification success unit is configured to successfully verify the session identifier in the first session information when the session code of the session identifier matches the session code in the first server.

In one embodiment, FIG. 6 is a structural block diagram of a communication apparatus of a server in an embodiment. Referring to FIG. 6 , this embodiment provides a communication apparatus of a server, and the apparatus includes:

The third handshake request receiving module 610 is configured to receive a third handshake request, where the third handshake request includes a third certificate, third session information and a target domain name;

The first handshake request sending module 620 is configured to match the domain name information in the third certificate with the third domain name of the second server, successfully verify the session identifier in the third session information, and not search the memory of the second server. In the case of content matching the target domain name, generate a first handshake request, and send the first handshake request to the first server, where the first handshake request includes the first certificate, the first session information and the target domain name; and

The first response content receiving module 630 is configured to receive the response content from the first server.

In one embodiment, the response content is that in the case that the domain name information in the first certificate matches the first domain name of the first server, and the verification of the session identifier in the first session information is successful, on the storage of the first server The content found that matches the target domain name.

In one embodiment, the response content is that the domain name information in the first certificate matches the first domain name of the first server, the session identifier in the first session information is successfully verified, and the memory of the first server is not found. In the case of the content matching the target domain name, the content matching the target domain name is searched from the storage of the origin server through the content distribution network.

In one embodiment, FIG. 7 is a structural block diagram of a communication apparatus of a server in an embodiment. Referring to FIG. 7 , this embodiment provides a communication apparatus of a server, and the apparatus includes:

The third handshake request sending module 710 is configured to send a fourth handshake request to the second server, where the fourth handshake request includes the target domain name, the communication address information and the second session information; and

The second response content receiving module 720 is configured to receive a message from the second server when the domain name information in the communication address information matches the second domain name of the second server and the session identifier in the second session information is successfully verified. Response content, the response content is the content matching the target domain name.

Figure 8 shows an internal structure diagram of a computer device in one embodiment. The computer device may be the client 110 in FIG. 1 (or a server in the content distribution network 120). As shown in FIG. 8, the computer device includes a processor, a memory, a network interface, an input device, and a display screen connected through a system bus. Wherein, the memory includes a non-volatile storage medium and an internal memory. The non-volatile storage medium of the computer device stores an operating system, and also stores a computer program, which, when executed by the processor, enables the processor to implement the communication method of the server. A computer program may also be stored in the internal memory, and when the computer program is executed by the processor, the processor may execute the communication method of the server. The display screen of the computer equipment may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer equipment may be a touch layer covered on the display screen, or a button, a trackball or a touchpad set on the shell of the computer equipment, or It can be an external keyboard, trackpad or mouse, etc.

Those skilled in the art can understand that the structure shown in FIG. 8 is only a block diagram of a part of the structure related to the solution of the present disclosure, and does not constitute a limitation on the computer equipment to which the solution of the present disclosure is applied. More or fewer components are shown in the figures, either in combination or with different arrangements of components.

In one embodiment, the communication apparatus of the server provided by the present disclosure may be implemented in the form of a computer program, and the computer program may be executed on a computer device as shown in FIG. 8 . The memory of the computer device may store various program modules constituting the communication device of the server, for example, the first handshake request receiving module 510 and the handshake response module 520 shown in FIG. 5 . The computer program constituted by each program module causes the processor to execute the steps in the communication method of the server according to the various embodiments of the present disclosure described in this specification.

The computer device shown in FIG. 8 may receive the first handshake request through the first handshake request receiving module 510 in the communication apparatus of the server as shown in FIG. 5 , where the first handshake request includes the first certificate, the first session information and the target domain name. The computer device may respond to the first handshake request through the handshake response module 520 when the domain name information in the first certificate matches the first domain name of the first server and the session identifier in the first session information is successfully verified. , where all servers in the content distribution network have the same domain name.

In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the following steps are implemented: receiving a first handshake request, first The handshake request includes the first certificate, the first session information and the target domain name; in the case that the domain name information in the first certificate matches the first domain name of the first server and the session identifier in the first session information is successfully verified, the The first handshake request is responded, wherein the domain names of all servers in the content distribution network are the same.

In one embodiment, the processor further implements the following steps when executing the computer program: parsing the second domain name from the first certificate, and obtaining the first domain name configured for the first server; In this case, it is determined that the domain name information matches the first domain name.

In one embodiment, the processor further implements the following steps when executing the computer program: receiving a configuration instruction, wherein the configuration instruction is an instruction sent to all servers in the content distribution network; configuring the domain name of the first server according to the instruction of the configuration instruction for the first domain name.

In one embodiment, when the processor executes the computer program, the processor further implements the following steps: if the first content matching the target domain name is found on the memory of the first server, returning the first content; on the memory of the first server, the first content is returned; If the first content matching the target domain name is not found, return the second content, where the second content is the content matching the target domain name found by the content distribution network from the storage of the origin server.

In one embodiment, the processor further implements the following steps when executing the computer program: generating a second handshake request, wherein the second handshake request includes the second certificate, the second session information and the target domain name; sending the second handshake request to the source station The server; receives the second content fed back from the origin server, where the second content is that the parsed logical address of the domain name information in the second certificate matches the logical address in the origin server, and the origin server verifies the second session information In the case of success, the content found in the origin server's storage that matches the target domain name.

In one embodiment, the processor further implements the following steps when executing the computer program: in the case that the first server successfully validates the session ticket of the session identifier, or the session code of the session identifier matches the encoded session identifier in the first server, The verification of the session identifier in the first session information is successful.

In one embodiment, the processor further implements the following steps when executing the computer program: in the case that the first server successfully verifies the session ticket of the session identifier, verifying the session identifier in the first session information succeeds In the case that the first server fails to verify the session ticket of the session identification, verify whether the session encoding of the session identification matches the session encoding in the first server; the session encoding in the session identification matches the session encoding in the first server. In this case, the verification of the session identifier in the first session information is successful.

In one embodiment, the processor further implements the following steps when executing the computer program: receiving a third handshake request, where the third handshake request includes the third certificate, the third session information and the target domain name; the domain name information in the third certificate and the third When the third domain name of the second server matches, the session identifier in the third session information is successfully verified, and no content matching the target domain name is found in the memory of the second server, a first handshake request is generated, and a second handshake request is sent. A handshake request is sent to the first server, and the first handshake request includes the first certificate, the first session information and the target domain name; and the response content from the first server is received.

In one embodiment, the processor further implements the following steps when executing the computer program: sending a fourth handshake request to the second server, where the fourth handshake request includes the target domain name, communication address information and second session information; When the domain name information matches the second domain name of the second server and the session identifier in the second session information is successfully verified, a response content from the second server is received, and the response content is content matching the target domain name.

In one embodiment, a computer-readable storage medium is provided, a computer program is stored thereon, and when the computer program is executed by the processor, the following steps are implemented: receiving a first handshake request, where the first handshake request includes a first certificate, a first session information and the target domain name; in the case that the domain name information in the first certificate matches the first domain name of the first server, and the session identifier in the first session information is successfully verified, respond to the first handshake request, wherein the content All servers in the distribution network have the same domain name.

In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: parsing the second domain name from the first certificate, and obtaining the first domain name configured for the first server; when the second domain name is the same as the first domain name In the case of , it is determined that the domain name information matches the first domain name.

In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: receiving a configuration instruction, wherein the configuration instruction is an instruction sent to all servers in the content distribution network; Configured as the first domain name.

In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: if the first content matching the target domain name is found in the memory of the first server, returning the first content; in the memory of the first server, the first content is returned; If the first content matching the target domain name is not found on the Internet, the second content is returned, where the second content is the content matching the target domain name found by the content distribution network from the storage of the origin server.

In one embodiment, the computer program further implements the following steps when executed by the processor: generating a second handshake request, wherein the second handshake request includes the second certificate, the second session information and the target domain name; sending the second handshake request to the source site server; receive the second content fed back from the origin site server, where the second content is that the logical address parsed from the domain name information in the second certificate matches the logical address in the origin site server, and the origin site server responds to the second session information If the verification is successful, the content found in the storage of the origin server that matches the target domain name.

In one embodiment, the computer program further implements the following steps when executed by the processor: when the first server successfully validates the session ticket of the session ID, or the session code of the session ID matches the encoded session ID in the first server , the verification of the session identifier in the first session information is successful.

In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: in the case that the first server successfully verifies the session ticket of the session identifier, verifying the session identifier in the first session information success; in the case that the first server fails to verify the session ticket of the session identification, verify whether the session encoding of the session identification matches the session encoding in the first server; the session encoding of the session identification matches the session encoding in the first server In the case of , the verification of the session identifier in the first session information is successful.

In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: receiving a third handshake request, where the third handshake request includes the third certificate, the third session information and the target domain name; the domain name information in the third certificate is the same as the When the third domain name of the second server matches, the session identifier in the third session information is successfully verified, and no content matching the target domain name is found in the memory of the second server, a first handshake request is generated and sent The first handshake request is sent to the first server, and the first handshake request includes the first certificate, the first session information and the target domain name; the response content from the first server is received.

In one embodiment, the computer program further implements the following steps when executed by the processor: sending a fourth handshake request to the second server, where the fourth handshake request includes the target domain name, the communication address information and the second session information; in the communication address information When the domain name information of the second server matches the second domain name of the second server, and the session identifier in the second session information is successfully verified, the response content from the second server is received, and the response content is the content matching the target domain name.

Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing relevant hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium , when the program is executed, it may include the flow of the above-mentioned method embodiments. Wherein, any reference to memory, storage, database, or other medium used in the various embodiments provided in this disclosure may include non-volatile and/or volatile memory. Nonvolatile memory may include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous chain Road (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

It should be noted that, in this document, relational terms such as "first" and "second" etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply these There is no such actual relationship or sequence between entities or operations. Moreover, the terms "comprising", "comprising" or any other variation thereof are intended to encompass a non-exclusive inclusion such that a process, method, article or device that includes a list of elements includes not only those elements, but also includes not explicitly listed or other elements inherent to such a process, method, article or apparatus. Without further limitation, an element qualified by the phrase "comprising a..." does not preclude the presence of additional identical elements in a process, method, article or apparatus that includes the element.

The above descriptions are only specific embodiments of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure is not to be limited to the embodiments shown herein, but is to be accorded the widest scope commensurate with the principles and novel features disclosed herein.

Industrial Applicability

The present disclosure provides a communication method, apparatus, computer device and storage medium for a server, the method includes: receiving a first handshake request, where the first handshake request includes a first certificate, first session information and a target domain name; In the case that the domain name information in the first certificate matches the first domain name of the first server, and the verification of the session identifier in the first session information is successful, respond to the first handshake request, wherein the All servers in the content delivery network have the same domain name. Handshake with other servers or clients through the domain name information and session information in the certificate. Since different clients use different domain names in the TLS/SSL handshake process, it is easy to cause excessive CPU consumption in the CDN during the handshake process. The domain names of all servers in the CDN are configured with the same domain name, which shortens the handshake between each server in the content distribution network, thereby reducing the internal CPU consumption of the CDN.

Claims (22)

1. The communication method of the server is applied to a first server, where the first server is a server in a content distribution network, including:

   receiving a first handshake request, the first handshake request including a first certificate and first session information; and

   In the case that the domain name information in the first certificate matches the first domain name of the first server and the session identifier in the first session information is successfully verified, responding to the first handshake request, Wherein, the domain names of all servers in the content distribution network are the same.
2. The method of claim 1, wherein the domain name information includes a second domain name, and determining that the domain name information matches the first domain name of the first server comprises:

   Parse the second domain name from the first certificate, and obtain the first domain name configured for the first server; and

   In the case that the second domain name is the same as the first domain name, it is determined that the domain name information matches the first domain name.
3. The method according to claim 1 or 2, wherein before the receiving the first handshake request, the method further comprises:

   receiving configuration instructions, wherein the configuration instructions are instructions sent to all servers in the content distribution network; and

   Configure the domain name of the first server as the first domain name according to the instruction of the configuration instruction.
4. The method according to any one of claims 1 to 3, wherein the first handshake request further includes a target domain name, and responding to the first handshake request includes:

   Returning the first content if the first content matching the target domain name is found on the memory of the first server; and

   In the case where the first content matching the target domain name is not found on the storage of the first server, return the second content, where the second content is the storage of the source server from the content distribution network The content that matches the target domain name found in .
5. The method of claim 4, wherein before the returning the second content, the method further comprises:

   generating a second handshake request, wherein the second handshake request includes the second certificate, the second session information and the target domain name;

   sending the second handshake request to the origin server; and

   Receive the second content fed back from the origin server, where the second content is that the logical address parsed from the domain name information in the second certificate matches the logical address in the origin server, and all When the source site server successfully verifies the second session information, the content that matches the target domain name is found in the memory of the origin site server.
6. The method according to any one of claims 1 to 5, wherein the session identifier includes a session ticket and a session code, and the successful verification of the session identifier in the first session information includes:

   In the case that the session ticket of the session identifier is successfully verified by the first server, or the session code of the session identifier matches the encoded session identifier in the first server, the first session information Session ID verification succeeded.
7. The method according to any one of claims 1 to 5, wherein the session identifier includes a session ticket and a session code, and the successful verification of the session identifier in the first session information includes:

   If the session ticket of the session identifier is successfully verified by the first server, the session identifier in the first session information is verified successfully; and

   In the case that the first server fails to verify the session ticket of the session identifier, verifying whether the session encoding of the session identifier matches the session encoding in the first server,

   In the case that the session code of the session identifier matches the session code in the first server, the verification of the session identifier in the first session information is successful.
8. The communication method of the server is applied to a second server, where the second server is a server in a content distribution network, and the method includes:

   receiving a third handshake request, where the third handshake request includes a third certificate, third session information, and a target domain name;

   The domain name information in the third certificate matches the third domain name of the second server, the session identification in the third session information is successfully verified, and no match is found in the memory of the second server. If the content of the target domain name matches, generate a first handshake request, and send the first handshake request to the first server, where the first handshake request includes the first certificate, the first session information and the target domain name ;as well as

   A response content from the first server is received.
9. The method of claim 8, wherein the response content is that the domain name information in the first certificate matches the first domain name of the first server, and the session identifier in the first session information is matched If the verification is successful, the content matching the target domain name is found on the memory of the first server.
10. The method according to claim 8, wherein the response content is that the domain name information in the first certificate matches the first domain name of the first server, and the session identifier in the first session information is verified. If the content matching the target domain name is not found in the storage of the first server, the content matching the target domain name is found from the storage of the origin server through the content distribution network. content.
11. The communication method of the server, applied to the client, including:

    sending a fourth handshake request to the second server, the fourth handshake request including the target domain name, communication address information and second session information; and

    In the case that the domain name information in the communication address information matches the second domain name of the second server, and the verification of the session identifier in the second session information is successful, receive the response content from the second server , and the response content is content matching the target domain name.
12. The communication device of a server is applied to a first server, where the first server is a server in a content distribution network, and the device includes:

    a first handshake request receiving module configured to receive a first handshake request, where the first handshake request includes a first certificate, first session information and a target domain name; and

    a handshake response module, configured to: in the case that the domain name information in the first certificate matches the first domain name of the first server and the session identifier in the first session information is successfully verified, A handshake request is responded to, wherein the domain names of all servers in the content distribution network are the same.
13. The communication device of claim 12, wherein the domain name information includes a second domain name, and the handshake response module includes:

    a domain name obtaining unit, configured to resolve the second domain name from the first certificate, and obtain the first domain name configured for the first server; and

    A domain name matching unit, configured to determine that the domain name information matches the first domain name when the second domain name is the same as the first domain name.
14. The communication device of claim 12 or 13, wherein the device further comprises:

    A configuration instruction receiving module configured to receive a configuration instruction, wherein the configuration instruction is an instruction sent to all servers in the content distribution network; and

    The configuration instruction execution module is configured to configure the domain name of the first server as the first domain name according to the instruction of the configuration instruction.
15. The communication device according to any one of claims 12 to 14, wherein the handshake response module further comprises:

    a first content returning unit, configured to return the first content when the first content matching the target domain name is found on the memory of the first server; and

    A second content returning unit, configured to return a second content when the first content matching the target domain name is not found on the memory of the first server, where the second content is the content The distribution network finds the content matching the target domain name from the storage of the origin server.
16. The communication device of claim 15, wherein the handshake response module further comprises:

    a handshake request generating unit, configured to generate a second handshake request, wherein the second handshake request includes the second certificate, the second session information and the target domain name; and

    a handshake request sending unit, configured to send the second handshake request to the origin server; and

    A second content receiving unit, configured to receive the second content fed back from the origin server, where the second content is the logical address of the parsed domain name information in the second certificate and the origin server If the logical address in the source site server matches and the verification of the second session information by the origin site server is successful, the content matching the target domain name is found in the memory of the origin site server.
17. The communication device according to any one of claims 12 to 16, wherein the session identification includes a session ticket and a session code, and the handshake response module further includes:

    A first verification unit, configured to verify the session ID of the session ID by the first server successfully, or if the session code of the session ID matches the encoded session ID in the first server, verify the session ID of the session ID. The session identifier in the first session information is verified successfully.
18. The communication device according to any one of claims 12 to 16, wherein the session identification includes a session ticket and a session code, and the handshake response module further includes:

    A priority verification unit, configured to successfully verify the session identifier in the first session information when the first server successfully verifies the session ticket of the session identifier;

    a second verification unit configured to verify whether the session code of the session identifier matches the session code in the first server in the event that the first server fails to verify the session ticket of the session identifier, and

    The session verification success unit is configured to successfully verify the session identifier in the first session information when the session code of the session identifier matches the session code in the first server.
19. The communication device of a server is applied to a second server, where the second server is a server in a content distribution network, and the device includes:

    The third handshake request receiving module is configured to receive a third handshake request, where the third handshake request includes a third certificate, third session information and a target domain name;

    The first handshake request sending module is set to match the domain name information in the third certificate with the third domain name of the second server, successfully verify the session identifier in the third session information, and verify the session identifier in the third session information. If no content matching the target domain name is found in the memory of the second server, generate a first handshake request, and send the first handshake request to the first server, where the first handshake request includes the first certificate, first session information and the target domain name; and

    The first response content receiving module is configured to receive the response content from the first server.
20. A communication device for a server, the device includes:

    The third handshake request sending module is configured to send a fourth handshake request to the second server, where the fourth handshake request includes the target domain name, the communication address information and the second session information; and

    The second response content receiving module is configured to receive the message when the domain name information in the communication address information matches the second domain name of the second server and the session identifier in the second session information is successfully verified. Response content from the second server, where the response content is content matching the target domain name.
21. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the processor implementing the method of any one of claims 1 to 11 when the processor executes the computer program.
22. A computer-readable storage medium having stored thereon a computer program that, when executed by a processor, implements the method of any one of claims 1 to 11.

Images