WO2017148419A1 - 数据传输方法及服务器 - Google Patents

数据传输方法及服务器 Download PDF

Info

Publication number
WO2017148419A1
WO2017148419A1 PCT/CN2017/075458 CN2017075458W WO2017148419A1 WO 2017148419 A1 WO2017148419 A1 WO 2017148419A1 CN 2017075458 W CN2017075458 W CN 2017075458W WO 2017148419 A1 WO2017148419 A1 WO 2017148419A1
Authority
WO
WIPO (PCT)
Prior art keywords
application information
service data
data
sensing node
server
Prior art date
Application number
PCT/CN2017/075458
Other languages
English (en)
French (fr)
Inventor
魏含宇
韩磊
程剑
尤建洁
王浩
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP17759270.6A priority Critical patent/EP3413533B1/en
Publication of WO2017148419A1 publication Critical patent/WO2017148419A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0245—Filtering by information in the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/629—Protecting access to data via a platform, e.g. using keys or access control rules to features or functions of an application
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/105—Multiple levels of security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/166—Implementing security features at a particular protocol layer at the transport layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/168—Implementing security features at a particular protocol layer above the transport layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2149—Restricted operating environment

Definitions

  • the present invention relates to the field of Internet technologies, and in particular, to a data transmission method and a server.
  • HTTP Hyper Text Transfer Protocol
  • the HTTP protocol is an application layer protocol, a plain text protocol, and is usually a plaintext transmission. Therefore, data based on the HTTP protocol is easily hijacked and even falsified, resulting in leakage of user privacy, and even causing economic loss to the user.
  • TLS Transport Layer Security
  • Users accessing the Internet need to use the HTTP protocol based on TLS encryption, that is, the data transmitted on the Internet. encryption.
  • the data encryption of the Internet provides security for the freedom of Internet communication.
  • some services based on content perception are invalidated, and in some cases, the user service experience is degraded.
  • a traffic management scenario in a wireless network provides different service policies for different types of service data flows, ensuring that the user's service experience is optimal, and data encryption results in a service type that cannot identify the data, and thus cannot use limited resources for the service.
  • the parent-child account service of the fixed network can filter according to the data content of the Internet, and filter out data that is not suitable for children to access, so as to ensure that the child's online environment is healthy and safe, but if the data of the Internet is encrypted, it cannot be effectively identified.
  • the type and content of the business that the child visits may result in the child being able to access content that is illegal or inappropriate for the child. Therefore, how to ensure the normal operation of the service system based on Internet data content becomes a technical problem that needs to be solved under the premise of providing users with security for accessing the Internet.
  • a data transmission method and a server are provided to solve the technical problem that the service information cannot be effectively identified in the case of the encryption of the Internet service data.
  • the following technical solutions are disclosed in the embodiment of the present invention:
  • the present invention provides a data transmission method, which is applied to a system based on Internet communication, the system comprising a terminal device, a server, and a sensing node; the method comprising: receiving, by the server, an application access request sent by the terminal device Obtaining, according to the application access request, the encrypted first service data and the application information corresponding to the first service data, where the application information is used to represent service information of the first service data; Application information and the first service data are provided to the sensing node; The application information identifies the service information of the first service data; the sensing node forwards the first service data, or the first service data and the application information.
  • the server transmits the application information required by the sensing node to the sensing node, so that the sensing node can learn the terminal device and the server according to the application information.
  • the service information of the encrypted service data is transmitted, and the perceived service system completes the service related to the service content.
  • the application information is transmitted in a clear text manner, and the server does not need to additionally add an encryption and decryption protocol cluster. Under the premise of ensuring the encryption of the service data between the terminal device and the server, the data transmission is more convenient and the system cost is lower.
  • the server provides the application information and the first service data to the sensing node, including: the server generates the first data packet, the first The data packet includes a message header and a payload, the message header carries the application information, the payload carries the first service data, and the server sends the first data packet to the sensing node.
  • the Internet communication system further includes a packet device for re-encapsulating data; the server provides the application information and the first service data to The sensing node includes: the server sending the application information and the first service data to the packet device; the packet device generates a first data packet, where the first data includes a message header and a payload, and the message header carries the application information, The payload carries the first service data; the packet device sends the first data packet to the sensing node.
  • the first data packet is constructed based on any one of the following: a transmission control protocol TCP, a secure transport layer protocol TLS, a network protocol IP, and User Datagram Protocol UDP.
  • TCP transmission control protocol
  • TLS secure transport layer protocol
  • IP network protocol
  • UDP User Datagram Protocol
  • the server by using the server, the application information and the first service data to the sensing node, including: the server sending the first service data And sending, by the server, the application information and the feature information of the first service data to the sensing node, so that the sensing node establishes an association between the first service data and the application information according to the feature information.
  • the server sends the application information and the feature information of the first service data to the sensing node, including: the server generates a notification message, where the notification message includes the application information and the feature. Information; the server sends a notification message to the sensing node.
  • the Internet communications system includes a packet device for re-encapsulating data, and the server sends the application information and the feature information of the first service data
  • the sensing node includes: the server sends the application information and the feature information to the packet device; the packet device generates a notification message, where the notification message includes the application information and the feature information, and sends the notification message to the sensing node.
  • the present invention provides a server, which is applied to an Internet communication system, the system further includes a terminal device and a sensing node; the server includes: a receiver, a processor, and a transmitter; and a receiver, configured to receive the terminal device
  • the application access request is sent by the processor, and is configured to obtain, according to the application access request, the encrypted first service data and the application information corresponding to the first service data, where the application information is used to represent the service information of the first service data.
  • a transmitter for providing application information and first service data to the sensing node for sensing the section The point identifies the service information of the first service data by using the application information.
  • the server provided by the second aspect, in the process of transmitting the encrypted service data to the terminal device, transmits the application information corresponding to the service data to the sensing node, so that the sensing node can learn the service information of the encrypted service data according to the application information, and further Enable the perceived business system to complete services related to the business content.
  • the application information is transmitted in a clear text manner, and the server does not need to additionally add an encryption and decryption protocol cluster. Under the premise of ensuring the encryption of the service data between the terminal device and the server, the data transmission is more convenient and the system cost is lower.
  • the processor is further configured to generate a first data packet, where the first data packet includes a message header and a payload, where the message header carries The application information, the load carries the first service data, and the sender is configured to send the first data packet to the sensing node.
  • the Internet communications system further includes a packet device for re-encapsulating data; the transmitter, the application information, and the When the service data is provided to the sensing node, specifically, the sender sends the application information and the first service data to the packet device, so that the packet device generates the first data packet and the The first data packet is sent to the sensing node, the first data packet includes a message header and a payload, the message header carries the application information, and the payload carries the first service data.
  • the first data packet is constructed based on any one of the following: a transmission control protocol TCP, a secure transport layer protocol TLS, a network protocol IP, and User Datagram Protocol UDP.
  • TCP transmission control protocol
  • TLS secure transport layer protocol
  • IP network protocol
  • UDP User Datagram Protocol
  • the method is: Sending the service data to the sensing node, and sending the application information and the feature information of the first service data to the sensing node, so that the sensing node establishes the first service data according to the feature information. An association with the application information.
  • the sender when the sender sends the application information and the feature information of the first service data to the sensing node, specifically:
  • the processor is further configured to generate a notification message, where the notification message includes the application information and the feature information, and the sender is configured to send the notification message to the sensing node.
  • the Internet communications system includes a packet device for re-encapsulating data, and the transmitter uses the application information and the When the feature information of the service data is sent to the sensing node, the sending device is configured to send the application information and the feature information to the packet device, so that the packet device generates a notification. a message, the notification message including the application information and the feature information, and causing the packet device to send the notification message to the sensing node.
  • the present invention provides a packet device, which is applied to an Internet communication system, the system further includes a server and a sensing node; the packet device includes: a receiver, a processor, and a transmitter; Receiving first service data sent by the server, and an application letter corresponding to the first service data
  • the processor is configured to generate a first data packet, where the first data packet includes a message header and a payload, the message header carries the application information, and the payload carries the first service data;
  • a transmitter configured to send the first data packet to the sensing node, so that the sensing node identifies the service information of the first service data according to the application information.
  • the present invention provides a packet device, which is applied to an Internet communication system, the system further includes a server and a sensing node; the packet device includes: a receiver, a processor, and a transmitter; Receiving, by the server, application information corresponding to the first service data, and feature information of the first service data; the processor, configured to generate a notification message, where the notification message includes the application information and And the identifier is configured to send the notification message to the sensing node, so that the sensing node establishes an association between the application information and the first service data according to the feature information. And causing the sensing node to identify the service information of the first service data according to the application information.
  • the data transmission method provided by the embodiment of the present invention sends an application access request to a corresponding server when the user accesses the Internet service.
  • the server sends the encrypted first service data to the sensing node in response to the application access request, and provides the application information corresponding to the first service data to the sensing node.
  • the sensing node obtains the service information of the first service data through the application information, and further provides the service system that needs to be applied to the application, so that, in the case of the encryption of the service data, the service information of the service data can also be identified through the application information, for example, the service Types, etc., which in turn enable service systems based on business data content to function properly.
  • FIG. 1 is a schematic structural diagram of a data transmission system according to an embodiment of the present invention.
  • FIG. 2 is a flowchart of a data transmission method according to an embodiment of the present invention.
  • FIG. 3 is a schematic diagram of a message format of application information according to an embodiment of the present invention.
  • FIG. 4 is a flowchart of a data transmission method according to an embodiment of the present invention.
  • FIG. 5 is a flowchart of another data transmission method according to an embodiment of the present invention.
  • FIG. 6 is a flowchart of another data transmission method according to an embodiment of the present invention.
  • FIG. 7 is a schematic diagram of a message format of a TCP protocol packet according to an embodiment of the present invention.
  • FIG. 8 is a schematic diagram of a message format of a TLS protocol packet according to an embodiment of the present invention.
  • FIG. 9 is a schematic diagram of a message format of an IPv6 protocol packet according to an embodiment of the present invention.
  • FIG. 10 is a schematic diagram of a message format of an IPv6 protocol packet according to an embodiment of the present invention.
  • FIG. 11 is a schematic diagram of a message format of a UDP protocol according to an embodiment of the present invention.
  • FIG. 12 is a schematic diagram of a protocol message format of an ICMP according to an embodiment of the present invention.
  • FIG. 13 is a block diagram of a server according to an embodiment of the present invention.
  • FIG. 14 is a block diagram of a packet device according to an embodiment of the present invention.
  • FIG. 1 is a schematic structural diagram of a data transmission system according to an embodiment of the present invention. As shown in FIG. 1 , the system includes a terminal device 110, a sensing node 120, a packet device 130, and a server 140.
  • the terminal device 110 may be any terminal capable of Internet access, such as a computer or a mobile phone, wherein the terminal device 110 communicates with the server 140 through a wired communication network or a wireless communication network.
  • the server 140 refers to a server provided by a non-operator to provide various Internet services to users.
  • the server 140 receives the HTTP-based request initiated by the terminal device 110 and provides the corresponding application service to the terminal device 110.
  • the packet device 130 may be deployed on the server 140, or may be a standalone device independent of the server, or may be a program fragment on the server.
  • the packet device is used to re-packet the data specified by the server and forward it.
  • the server 140 may be in a function call manner, for example, the server may pass the data required to be encapsulated to the packet device 130 through the application programming interface; if the packet device 130 is not deployed on the server In 140, the server 140 passes the data that needs to be encapsulated to the packet device 130 by sending a message.
  • the sensing node 120 is configured to sense service information of service data transmitted between the terminal device 110 and the server 140.
  • the input of the sensing node 120 is the data output by the packet device 130.
  • the sensing node 120 may be deployed on a network path between the server 140 and the terminal device 110, and one or more sensing nodes may be deployed on the network path to cooperate with other sensing service systems at different locations on the network path.
  • 150 for example, the parent-child account system
  • the sensing node 120 can be an independent device, can also be integrated with other systems (for example, a cognitive service system) or a device, or can be directly integrated with the terminal device (in this case, the sensing node is actually a program fragment in the terminal device) .
  • the sensing node 120 provides an external query interface, and other sensing service systems are authorized to query the service information of the specified service through the query interface.
  • the sensing service system is a service system related to service content awareness, for example, a parent-child account system, or a system for performing traffic management scheduling according to services.
  • FIG. 2 is a flowchart of a data transmission method according to an embodiment of the present invention. The method is applied to the system shown in FIG. 1. As shown in FIG. 2, the data transmission method includes:
  • the terminal device sends an application access request to the server.
  • a terminal device accesses a specific video in a video website
  • a corresponding access request is generated and sent to the server of the website.
  • the server acquires the encrypted first service data and the application information corresponding to the first service data according to the application access request.
  • the application information is used to represent service information of the first service data, for example, service type, priority, and the like.
  • An application scenario in which the service data is encrypted in the embodiment of the present invention, that is, all service data returned by the server in response to the access request of the terminal device is transmitted to the terminal device in cipher text.
  • the server After receiving the application access request sent by the terminal device, the server encrypts the service data that responds to the application access request to obtain the first service data.
  • the application information of the first service data is obtained, where the application information represents the first service data. Business content.
  • FIG. 3 a schematic diagram of a message format of application information according to an embodiment of the present invention is shown.
  • the application information includes two fields: H-Length (total length) and FLOW-INFO (flow information).
  • H-Length indicates the total length of the entire application information header
  • FLOW-INFO is a variable length field that can contain one or more pieces of information (INFO); each piece of information (INFO) contains three fields: TYPE (type), T-Length (length), and Sub- Information (sub-information), the specific meaning of these three fields are shown in Table 1;
  • TYPE represents the type of the subsequent Sub-information field
  • Sub-information which indicates the specific information content carried in this INFO field.
  • the server provides the first service data and the application information to the sensing node.
  • the server provides the application information to the sensing node, so that the sensing node acquires the service information of the service data delivered by the server to the terminal device, so that the service sensing system completes the service related to the service information.
  • a packet device is deployed in the server, and the server re-encapsulates the first service data and the application information by using the packet device, and forwards the packet to the sensing node.
  • the packet device is deployed independently of the server, and the server sends the first service data and the application information to the packet device, and the packet device forwards the first service data and the application information to the sensing node.
  • the server may directly provide the application information and the first service data to the sensing node.
  • the sensing node uses the application information to identify service information of the first service data.
  • the sensing node determines the service information of the first service data, for example, the service type and the like, according to the received application information.
  • the sensing node forwards the first service data, or the first service data and the application information.
  • the sensing node may forward only the first service data to the next node, and does not need to forward the application information
  • the sensing node may forward both the first service data and the application information to the next node.
  • the next node may be a terminal device, a next sensing node, or other sensing service system (for example, a parent-child account system).
  • the server transmits the application information required by the sensing node to the sensing node, so that the sensing node can learn the terminal device and the server according to the application information.
  • the service information of the encrypted service data is transmitted, and the perceived service system completes the service related to the service content.
  • the application information is transmitted in a clear text manner, and the server does not need to additionally add an encryption and decryption protocol cluster. Under the premise of ensuring the encryption of the service data between the terminal device and the server, the data transmission is more convenient and the system cost is lower.
  • FIG. 4 is a flowchart of a data transmission method according to an embodiment of the present invention. The method is applied to the system shown in FIG. 1.
  • the packet device is deployed independently of the server.
  • the packet device may be any A device that can unpack and pack data.
  • the data transmission method includes:
  • the terminal device sends an application access request to the server.
  • the server obtains the encrypted first service data and the application information corresponding to the first service data according to the received application access request, and sends the first service data and the application information to the packet device.
  • the packet device is independent of the server, and the server sends the application information to the packet device through the network connection by sending a message, and notifies the packet device to re-encapsulate the application information and the service data.
  • the packet device generates a first data packet.
  • the first data packet includes a message header and a payload, where the message header carries the application information, and the payload carries the first service data.
  • the packet device After receiving the application information sent by the server, the packet device caches the local device and returns a confirmation message to the server. Then, the packet device receives the first service data sent by the server, according to the feature information of the first service data.
  • the feature information of the service data may be a quintuple, and the quintuple includes a source IP address, a source port, and a destination IP address.
  • the destination port and the transport layer protocol are used to distinguish different data packets, and query whether there is application information matching the first service data locally. If yes, the packet device modifies the first service data and repackages the first service.
  • the packet header of the data is used to write the application information that matches the first service data into the header of the first service data, thereby generating the first data packet.
  • the application information may be written in an optional field of the packet header, or a new field may be added to the packet header to carry the application information.
  • the packet device sends the first data packet to the sensing node.
  • the packet device sends the first data packet obtained by re-encapsulation to the sensing node.
  • the sensing node extracts the application information from the first data packet to generate a second data packet, and identifies service information of the first service data according to the application information, where the second data packet includes the first service data.
  • the sensing node parses the received first data packet, determines whether the first data packet carries the application information, and if the application information is carried, extracts the application information from the first data packet, and queries the local flow table (the flow table is used for storing Whether the application information exists in the application information corresponding to each service data received; if the corresponding flow table entry already exists, the flow application information recorded in the flow table entry is refreshed according to the received application information; if the corresponding For the flow table entry, the flow table entry is added and the received application information is inserted into the flow table. In the initial state, there is no flow table entry for the application information in the flow table.
  • the sensing node forwards the second data packet, or the first data packet.
  • the second data packet includes first service data, where the first data packet includes first service data and application information corresponding to the first service data.
  • the sensing node needs to restore the first data packet after repackaging the packet device to the original one.
  • a service data The sensing node strips the application information from the packet header of the first data packet, and restores the packet of the first data packet to the packet of the first service data, and forwards the packet to the next node.
  • the sensing node may directly forward the first data repackaged by the packet device to the Next node.
  • the system shown in FIG. 1 may include multiple sensing nodes, and the specific service node on which the service data packet is restored may be determined according to the sensing node provider.
  • the data transmission method provided in this embodiment is that the server sends the encrypted service data to the terminal device.
  • the server transmits the application information required by the sensing node to the sensing node, so that the sensing node learns the service information of the encrypted service data transmitted between the terminal device and the server according to the application information, so that the sensing service system completes the service information related to the service information. service.
  • the application information is transmitted in a clear text manner, and the server does not need to additionally add an encryption and decryption protocol cluster. Under the premise of ensuring the encryption of the service data between the terminal device and the server, the data transmission is more convenient and the system cost is lower.
  • FIG. 5 is a flowchart of another data transmission method according to an embodiment of the present invention.
  • a parent-child account system is taken as an example to introduce a parent-child account system and the system shown in FIG. 1 adopts the data transmission shown in FIG. 4.
  • the method completes the content filtering service.
  • the parent-child account system is used to filter according to the data content of the Internet, and filter out data that is not suitable for children to access, thereby ensuring the child's online environment is healthy and safe.
  • the sensing node forwards the first data packet or the second data packet to the parent and child account system;
  • the data packet includes first service data and application information corresponding to the first service data; and the second data packet includes the first service data.
  • the parent-child account system sends a service query message to the sensing node.
  • the service query message is used to query the sensing node for the application information of the first service data, where the service query message carries the feature information of the first service data, for example, the quintuple information.
  • the sensing node After receiving the service query message, the sensing node queries the local flow table according to the feature information to obtain application information that matches the feature information.
  • the sensing node After receiving the service query message, the sensing node queries, according to the feature information of the service data carried in the query message, whether the flow table entry matching the feature information exists in the local flow table, and if yes, obtains the application in the flow table entry. Information; if not, ends the current process.
  • the sensing node feeds back the obtained application information to the parent and child account system.
  • the parent-child account system determines, according to the application information, whether the first service data can be accessed by the sub-account. If yes, execute S350; if not, execute S360.
  • S360 sending an error code to the terminal device.
  • error code For example, 403Forbidden.
  • the data transmission service in other service-aware-based services is similar to the parent-child account service, and will not be introduced here.
  • the sensing node sends the restored first service data to the sensing service system, and the sensing service system queries the sensing node for the application information of the first service data, so that the service data can be encrypted.
  • the service information of the first service data is identified, and the first service data is processed accordingly.
  • FIG. 6 is a flowchart of another data transmission method according to an embodiment of the present invention, which is applied to the system shown in FIG. 1.
  • the packet device is deployed in the server, for example, the related function is implemented in the protocol stack of the server, that is, the service data sent by the server includes the application layer information, and the application layer information is stored in the plain text.
  • the method includes:
  • the terminal device sends an application access request to the server.
  • the server obtains the encrypted first service data and the application information corresponding to the first service data according to the received application access request.
  • the server invokes the packet device to generate a first data packet.
  • the first data packet includes a message header and a payload, wherein the message header carries application information, and the payload carries the first service data.
  • the server can call the packet device by calling the Extended Socket API (Application Programming Interface) function.
  • Extended Socket API Application Programming Interface
  • the server sends the first data packet to the sensing node.
  • the sensing node obtains the application information from the first data packet to generate a second data packet, and identifies the service information of the first service data according to the application information.
  • the second data packet includes the first service data.
  • the sensing node forwards the second data packet or the first data packet to the next node.
  • the sensing node since the packet device is deployed in the server, that is, the first data packet output by the server carries the application information, in order to ensure that the data sent and received between the terminal device and the server is consistent, the sensing node does not need to be the first.
  • the packet of the data packet is modified and forwarded directly to the next node.
  • the application information and the first service data are re-encapsulated by the packet device deployed in the server, and the first data packet is obtained and sent to the sensing node.
  • the sensing node acquires the application information from the first data packet, and identifies the service information of the first service data according to the application information. Moreover, the sensing node does not need to modify the first data packet to directly forward to the next node. This method requires the function of the server side integrated packet device, but the sensing node does not need to modify the first data packet.
  • the application information can be directly carried in the packet of the service data stream, which is called in-band transmission mode.
  • the application information can also be transmitted independently of the service data stream, which is called the out-of-band transmission mode.
  • the in-band transmission mode can write application information into a protocol header used for transmitting a service data stream, for example, a TCP protocol, a TLS (Transport Layer Security) protocol, and an IP (Internet Protocol) protocol.
  • the UDP User Datagram Protocol
  • the protocol header to which the application information is carried needs to be determined according to the specific application scenario.
  • the out-of-band transmission mode that is, the application information is independent of the service data flow between the terminal device and the server.
  • the application information can be separately carried by the ICMP (Internet Control Message Protocol) protocol packet or other protocol packets.
  • the invention is not limited thereto.
  • the application information can be carried in the TCP protocol packet.
  • TCP Transmission Control Protocol
  • FIG. 7 is a schematic diagram of a message format of a TCP protocol packet according to an embodiment of the present invention.
  • the application information may be filled in an optional field of the TCP protocol.
  • Source port number 16 bits, which identifies the port number of the remote end.
  • Destination port number 16 bits, which identifies the local port number.
  • Serial number 32 bits, indicating the order of the transmitted datagrams.
  • Header length 4 bits, indicating how many 32-bit words are included in the TCP header.
  • the emergency mode of TCP is a way for the sender to send urgent data to the other end. It is applied together with the emergency pointer field.
  • the emergency pointer points to a byte in the datagram, indicating that the datagram is from the first byte to the urgent pointer.
  • the index bytes are urgent data. If they do not enter the receive buffer, they are directly handed over to the upper layer process, and other data enters the receive buffer.
  • ACK Acknowledgement: ACK is 1, indicating that the acknowledgment sequence number is legal; if ACK is 0, it indicates that the datagram does not contain acknowledgment information, and the acknowledgment field is omitted.
  • PSH Push: When PSH is 1, it indicates that the data is with the PUSH flag. The receiver requests the datagram to be immediately transmitted to the application without waiting for the buffer to be full.
  • RST (Reset): Indicates a connection reset request to reset an erroneous connection due to a host crash or other cause; it can also be used to reject an illegal datagram or reject a connection request.
  • SYN synchronization sequence number
  • FIN Fluorescence, end signal: indicates that the sender has reached the end of the data, that is, the data transfer completion connection of both parties will be disconnected.
  • Window size 16 bits, indicating how many bytes can be sent after the byte has been acknowledged.
  • Checksum 16 bits are set to ensure high reliability. It verifies the sum of the header, data, and pseudo TCP headers.
  • Application Info Option 0 or more 32-bit words.
  • the field is used to carry application information of service data, where the field includes Option and Padding.
  • the Option item carries application information.
  • This field is used to carry business data.
  • the application information of the service data can be written in the header of the TLS protocol message in plain text.
  • FIG. 8 is a schematic diagram of a message format of a TLS protocol packet according to an embodiment of the present invention.
  • the application information may be written between a Version field and a Length field of a TLS header.
  • TYPE Indicates the type of subsequent fields.
  • Version Indicates the version information of the protocol.
  • Application Info This field is the written application information.
  • the message format of the application information is shown in Figure 3.
  • Length indicates the length of the TSL frame header to indicate the location of the application information in the TLS data frame.
  • the application information can be written into the IP header.
  • FIG. 9 is a schematic diagram of a message format of an IPv6 protocol packet according to an embodiment of the present invention, and the application information is filled in an Options field.
  • VER Version, version number: 4 bits, the protocol version number is 4, so it is called IPv4.
  • IHL Internet Header Length
  • the length of the header refers to the number of 32-bit words in the IP layer header. That is, how many 4 bytes are included in the IP layer header, including any options.
  • TOS Type Of Service: 8 bits, indicating the quality of service expected by the upper layer protocol to process the current datagram, and assigning the datagram according to the importance level. This field is used to assign priorities, delays, throughput, and reliability.
  • Total Length Specifies the byte length of the entire IP packet, including the data and protocol headers; its maximum value is 65,535 bytes, and a typical host can receive 576-byte datagrams.
  • Identification 16 bits, this field is used to identify the current datagram. This field is allocated by the sender to help the receiver to centralize the datagram fragmentation.
  • Flags 3 bits, where the least significant bit (MF) controls the slice, and the next slice is set to 1, otherwise 0 is set to end the slice.
  • the middle bit (DF) indicates whether the packet can be sliced.
  • the third bit, the highest bit, is reserved and not used, but must be zero.
  • Fragment OFF Fragment Offset 13 bits, indicating the location of the fragment data associated with the start of the source datagram, and supporting the target IP to properly reconstruct the source datagram.
  • TTL Time To Live: 8 bits, which is a counter. Each point value of the discarded datagram is decremented by 1 until it is reduced to 0. This ensures an endless loop process for the packet.
  • Protocol 8 bits indicate which upper layer protocol receives the imported data packet after the IP processing process is completed.
  • IP Header Checksum 16 bits to help ensure the integrity of the IP header. Due to changes in some protocol header fields, such as TTL, each point needs to be recalculated and verified. The Internet Protocol header needs to be processed.
  • Source Address 32 bits, source host IP address.
  • DestinationAddress 32 bits, the destination host IP address.
  • Application Info Options This field is used to populate the application information, where The message format of the application information is shown in Figure 3.
  • FIG. 10 is a schematic diagram of a message format of an IPv6 protocol packet according to an embodiment of the present invention, in an Extension Header field of the IPv6.
  • Version (version number) 4 digits, IP protocol version number, and the version number of Ipv6 is 6.
  • Traffic Class 8-bit indicating the IPv6 traffic class or priority. The function is similar to the TOS field of IPv4.
  • IPv6 20-bit, IPv6 new field, marking the data stream that needs special processing by the IPv6 router. This field is used for some communications that have special requirements for the quality of service of the connection, such as real-time data transmission such as audio or video.
  • IPv6 there can be multiple different data streams between the same source and sink, separated from each other by a non-zero stream tag. If the router is not required to do special processing, the value of this field is set to "0".
  • Payload Length 16 bits.
  • the payload length includes the extended header and the upper layer PDU (Packet Data Unit).
  • the 16 bits can represent up to 65535 bytes of payload length. For loads above this number of bytes, the field value is set to "0", using the Jumbo Payload option in the Hop-by-Hop option.
  • Next Header 8 bits that identify the type of header that follows the IPv6 header, such as the extension header (if there is an extension header) or a transport layer protocol header (such as TCP, UDP, or ICMPv6).
  • Hop Limit 8-bit, similar to the TTL field of IPv4, which defines the lifetime of the packet by the number of times the packet is forwarded between routers. This field is decremented by 1 each time the packet is forwarded. When it is reduced to 0, the packet is discarded.
  • Source Address 128 bits, the sender's host address.
  • Destination Address 128 bits. In most cases, the destination address is the destination address. However, if there is an extension header, the destination address may be the next router interface in the sender's routing table.
  • Application Info Extension Header Application information is filled in this field.
  • the application information may be written in a field after the UDP protocol header.
  • FIG. 11 is a schematic diagram of a message format of a UDP protocol according to an embodiment of the present invention. As shown in FIG. 11, the meanings of the fields included in the UDP protocol are as follows:
  • Source port number the port number of the remote end
  • Destination port number local port number
  • Length The length of the entire header, in bytes
  • Preamble used to identify application information in subsequent data
  • Application Info identifies application information corresponding to the service data flow between the terminal device and the server;
  • This field is a data field.
  • the application information may also be transmitted by using an out-of-band transmission manner, that is, the application information is independent of the service data flow between the terminal device and the server; the application information and the service data stream are separately transmitted, and therefore, It is also necessary to associate the service data flow with the application information, for example, including, in the application information, feature information of the service data flow between the terminal device and the server, for example, a quintuple or a feature string, so that the sensing node receives the application. After the information, the application information can be mapped with the service data according to the feature information, so that the flow table of the local application information is correctly established.
  • FIG. 12 is a schematic diagram of a protocol message format of an ICMP according to an embodiment of the present invention.
  • Application information may be used to write application information in an ICMP protocol.
  • Figure 12 the meanings of the various fields included in the ICMP protocol are as follows:
  • TYPE type: 8 bits, which identifies the type of ICMP message
  • Code 8 bits, this field and the TYPE field together determine the type of ICMP message
  • ICMP Checksum The checksum of the entire ICMP message including the data
  • This field carries application information. This field should also contain the feature information of the service data flow.
  • the server transmits the application information and the feature information of the service data corresponding to the application information to the packet device.
  • the packet device generates a notification message according to the application information and the feature information of the service data, where the notification message includes application information and feature information, and is transmitted to the sensing node.
  • the sensing node parses the received notification message, obtains the feature information of the application information and the service data, and establishes a flow table of the application information; at the same time, the server sends the service data stream to the packet device, and the packet device does not perform the service data flow. Any modification is directly forwarded to the sensing node, and the sensing node forwards the service data to the next node (terminal device, other service-aware service system or next sensing node).
  • the packet device may not be set in this application scenario.
  • the application information and the feature information corresponding to the service data are encapsulated by the server into a notification message in a set protocol format, and then the notification message is sent to the sensing node, and the sensing node parses the notification message to obtain the application information, and establishes a flow of the application information. table.
  • the server sends a service data flow to the sensing node, and the sensing node queries the application information flow table through the feature information of the service data, and obtains the application information of the service data flow.
  • the sensing node then forwards the traffic data stream to the next node.
  • the present application also provides a corresponding device embodiment.
  • FIG. 13 is a block diagram of a server according to an embodiment of the present invention.
  • the server is applied to an internet communication system, and the system includes a terminal device, a server, and a sensing node.
  • the server includes a receiver 210, a processor 220, and a transmitter 230.
  • the receiver 210 is configured to receive an application access request sent by the terminal device, and transmit the request to the processor 220.
  • the processor 220 is configured to obtain the encrypted first service data and the application information corresponding to the first service data according to the application access request delivered by the receiver 210.
  • the application information is used to represent the service information of the first service data.
  • the transmitter 230 is configured to provide the first service data and the application information obtained by the processor 220 to the sensing node, so that the sensing node uses the application information to identify the service information of the first service data.
  • the processor 220 is configured to generate a first data packet according to the first service data and the corresponding application information, where the first data packet includes a message header and a payload, and the message header carries application information, and the payload bearer First business data.
  • the first data packet generated by the processor 220 is transmitted by the transmitter 230 to the sensing node in the Internet communication system.
  • the Internet communication system further includes a packet device for re-encapsulating data; in this application scenario, the transmitter 230 sends the application information and the first service data to the packet device, The packet device generates a first data packet according to the application information and the first service data, and the first data packet is sent by the packet device to the sensing node.
  • the first data packet generated by the packet device includes a message header and a payload, and the message header carries the application. Information, the payload carries the first service data.
  • the application information is carried in the packet of the first service data for transmission, that is, the in-band transmission mode; in the transmission mode, the first data
  • the headers included in the packet may include a TCP packet header, a TLS packet header, an IP packet header, or a UDP packet header.
  • the application information may also be transmitted in an out-of-band transmission manner, that is, the application information is not carried in the service data transmitted between the terminal device and the server, that is, the application information of the service data and the service data. Transfer separately.
  • an association between the service data and the application information needs to be established, so that the node is aware of the application information associated with the service data.
  • the transmitter 230 sends the first service data to the sensing node, and sends the application information corresponding to the first service data and the feature information of the first service data to the sensing node, so that the sensing node establishes the first service data and the application according to the feature information. The association between the information. Then, the sensing node identifies the service information of the first service data according to the application information.
  • the server when the application information is transmitted by using an out-of-band transmission manner, the server sends the application information and the feature information of the first service data to the packet device, and the packet device generates a notification message according to the application information and the feature information.
  • the application header and the feature information are included in the message header of the notification message, and then the packet device sends the notification message to the sensing node.
  • the processor 220 of the server directly generates a notification message according to the application information and the feature information of the first service data, where the message header carries the application information and the feature information.
  • the server in the process of sending the encrypted service data to the terminal device, transmits the application information required by the sensing node to the sensing node, so that the sensing node can learn the transmission between the terminal device and the server according to the application information.
  • the business information of the business data is encrypted, and the perceived service system completes the service related to the business content.
  • the application information is transmitted in a clear text manner, and the server does not need to additionally add an encryption and decryption protocol cluster. Under the premise of ensuring the encryption of the service data between the terminal device and the server, the data transmission is more convenient and the system cost is lower.
  • FIG. 14 is a block diagram of a packet device, which is applied to an internet communication system, and includes a server, a sensing node, and a terminal device. As shown in FIG. 14, the packet device includes a receiver 310, a processor 320, and a transmitter 330.
  • the receiver 310 is configured to receive first service data sent by the server, and application information corresponding to the first service data.
  • the processor 320 is configured to generate a first data packet according to the first service data and the application information, where the first data packet includes a message header and a payload, the message header carries the application information, and the payload carries the first service data.
  • the sender 330 is configured to send the first data packet to the sensing node, so that the sensing node identifies the service information of the first service data according to the application information.
  • the packet device needs to re-encapsulate the application information and the feature information corresponding to the first service data sent by the server.
  • the receiver 310 is configured to receive the first service data sent by the server.
  • the application information and the feature information are generated by the processor 320, and the processor 320 is configured to generate the notification message according to the received application information and the feature information, and carry the application information and the feature information in the message header of the notification message.
  • the sender 330 is configured to send the notification message generated by the processor 320 to the sensing node, so that the sensing node establishes management between the first service data and the application information according to the feature information, so that the sensing node identifies the first service data according to the application information.
  • Business information is configured to send the notification message generated by the processor 320 to the sensing node, so that the sensing node establishes management between the first service data and the application information according to the feature information, so that the sensing node identifies the first service data according to the application information.
  • the packet device provided by the embodiment generates a first data packet according to the first service data and the corresponding application information sent by the received server, that is, writes the application information into a message header of the first service data, so that the sensing node While receiving the first service data, the application information of the first service data can be obtained, and the service information of the first service data is identified according to the application information, and the service related to the service content is completed.
  • the application information is transmitted in a clear text manner, and the server does not need to additionally add an encryption and decryption protocol cluster. Under the premise of ensuring the encryption of the service data between the terminal device and the server, the data transmission is more convenient and the system cost is lower.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本发明实施例公开了一种数据传输方法，在服务器向终端设备发送加密业务数据的过程中，服务器将感知节点需要的应用信息传递给感知节点，从而使感知节点能够根据该应用信息获知终端设备与服务器之间传输的加密业务数据的业务信息，进而使感知业务系统完成与业务内容相关的服务。其中，应用信息以明文方式传输，不需要服务器额外增加加解密协议簇，在保证终端设备与服务器之间业务数据加密的前提下，数据传输更方便、系统成本更低。

Description

数据传输方法及服务器 技术领域
本发明涉及互联网技术领域，特别是涉及一种数据传输方法及服务器。
背景技术
随着互联网兴起，用户通常使用HTTP(Hyper Text Transfer Protocol，超文本传输协议)访问各种互联网站点或服务。HTTP协议是应用层协议，纯文本协议，而且通常是明文传输，因此，基于HTTP协议的数据很容易被劫持侦听，甚至篡改，从而导致用户隐私泄露，严重的甚至造成用户的经济损失。
为了保证互联网中数据的安全性，引入了提供认证、鉴权等功能的TLS(Transport Layer Security，安全传输层)协议，用户访问互联网需要使用基于TLS加密的HTTP协议，即将互联网中传输的数据进行加密。互联网的数据加密为互联网通信自由提供了安全保障，但是，对互联网的数据内容加密后，使得基于内容感知的部分业务失效，从而在某些情况下会导致用户业务体验下降。
例如，无线网络中的流量管理场景，对不同类型的业务数据流提供不同的服务策略，保障用户的服务体验最优，数据加密导致无法识别数据的业务类型，因此不能将有限的资源用于服务用户最关心的数据。例如，固网的父子账号业务，该业务可以根据互联网的数据内容进行过滤，过滤掉不适宜儿童访问的数据，从而保证儿童上网环境健康安全，但是，如果对互联网的数据加密后，无法有效识别儿童访问的业务类型和内容，导致儿童可能会访问到非法的或不适宜儿童的内容。因此，如何在能够为用户访问互联网提供安全保障的前提下，保证基于互联网数据内容的服务系统正常运行成为亟需解决的技术问题。
发明内容
本发明实施例中提供了一种数据传输方法及服务器，以解决在互联网业务数据加密的情况下无法有效识别业务信息的技术问题，本发明实施例公开了如下技术方案：
第一方面，本发明提供一种数据传输方法，应用于基于互联网通信的系统中，所述系统包括终端设备、服务器和感知节点；所述方法包括：服务器接收所述终端设备发送的应用访问请求；服务器根据所述应用访问请求获取加密后的第一业务数据及与所述第一业务数据对应的应用信息，所述应用信息用于表征所述第一业务数据的业务信息；服务器将所述应用信息及所述第一业务数据提供给感知节点；感知节点利用所 述应用信息识别所述第一业务数据的业务信息；感知节点转发所述第一业务数据，或者，所述第一业务数据和所述应用信息。
第一方面提供的数据传输方法，在服务器向终端设备发送加密业务数据的过程中，服务器将感知节点需要的应用信息传递给感知节点，从而使感知节点能够根据该应用信息获知终端设备与服务器之间传输的加密业务数据的业务信息，进而使感知业务系统完成与业务内容相关的服务。其中，应用信息以明文方式传输，不需要服务器额外增加加解密协议簇，在保证终端设备与服务器之间业务数据加密的前提下，数据传输更方便、系统成本更低。
结合第一方面，在第一方面的第一种可能的实现方式中，所述服务器将所述应用信息及所述第一业务数据提供给感知节点，包括：服务器生成第一数据包，第一数据包包括消息头和载荷，所述消息头承载所述应用信息，所述载荷承载所述第一业务数据；服务器将所述第一数据包发送给所述感知节点。
结合第一方面，在第一方面的第二种可能的实现方式中，互联网通信系统还包括用于对数据进行重封装的封包设备；服务器将所述应用信息及所述第一业务数据提供给感知节点，包括：服务器将所述应用信息及所述第一业务数据发送给所述封包设备；封包设备生成第一数据包，第一数据包括消息头和载荷，消息头承载所述应用信息，载荷承载所述第一业务数据；封包设备将第一数据包发送给所述感知节点。
结合第一方面，在第一方面的第三种可能的实现方式中，所述第一数据包基于以下协议中的任意一种构建：传输控制协议TCP、安全传输层协议TLS、网络协议IP和用户数据报协议UDP。
结合第一方面，在第一方面的第四种可能的实现方式中，所述服务器将所述应用信息及所述第一业务数据提供给感知节点，包括：服务器将所述第一业务数据发送给感知节点；服务器将应用信息及第一业务数据的特征信息发送给所述感知节点，以使感知节点根据特征信息建立第一业务数据与应用信息之间的关联。
结合第一方面，在第一方面的第五种可能的实现方式中，服务器将应用信息及第一业务数据的特征信息发送给感知节点，包括：服务器生成通知消息，通知消息包含应用信息和特征信息；服务器将通知消息发送给感知节点。
结合第一方面，在第一方面的第六种可能的实现方式中，所述互联网通信系统中包含用于对数据进行重封装的封包设备；服务器将应用信息及第一业务数据的特征信息发送给感知节点，包括：服务器将应用信息及特征信息发送给封包设备；封包设备生成通知消息，通知消息包含应用信息及特征信息，并将所述通知消息发送给所述感知节点。
第二方面，本发明提供了一种服务器，应用于互联网通信系统中，系统还包括终端设备和感知节点；所述服务器包括：接收器、处理器和发送器；接收器，用于接收终端设备发送的应用访问请求；处理器，用于根据应用访问请求获取加密后的第一业务数据及与所述第一业务数据对应的应用信息，所述应用信息用于表征第一业务数据的业务信息；发送器，用于将应用信息及第一业务数据提供给感知节点，以便感知节 点利用所述应用信息识别第一业务数据的业务信息。
第二方面提供的服务器，在向终端设备发送加密业务数据的过程中，将该业务数据对应的应用信息传递给感知节点，从而使感知节点能够根据该应用信息获知加密业务数据的业务信息，进而使感知业务系统完成与业务内容相关的服务。其中，应用信息以明文方式传输，不需要服务器额外增加加解密协议簇，在保证终端设备与服务器之间业务数据加密的前提下，数据传输更方便、系统成本更低。
结合第二方面，在第二方面的第一种可能的实现方式中，所述处理器还用于，生成第一数据包，所述第一数据包包括消息头和载荷，所述消息头承载所述应用信息，所述载荷承载所述第一业务数据；所述发送器，用于将所述第一数据包发送给所述感知节点。
结合第二方面，在第二方面的第二种可能的实现方式中，所述互联网通信系统还包括用于对数据进行重封装的封包设备；所述发送器将所述应用信息及所述第一业务数据提供给感知节点时，具体用于：所述发送器将所述应用信息及所述第一业务数据发送给所述封包设备，以便所述封包设备生成第一数据包并将所述第一数据包发送给所述感知节点，所述第一数据包包括消息头和载荷，所述消息头承载所述应用信息，所述载荷承载所述第一业务数据。
结合第二方面，在第二方面的第三种可能的实现方式中，所述第一数据包基于以下协议中的任意一种构建：传输控制协议TCP、安全传输层协议TLS、网络协议IP和用户数据报协议UDP。
结合第二方面，在第二方面的第四种可能的实现方式中，所述发送器用于将所述应用信息及所述第一业务数据提供给感知节点时，具体用于：将所述第一业务数据发送给所述感知节点；将所述应用信息及所述第一业务数据的特征信息发送给所述感知节点，以使所述感知节点根据所述特征信息建立所述第一业务数据与所述应用信息之间的关联。
结合第二方面，在第二方面的第五种可能的实现方式中，所述发送器将所述应用信息及所述第一业务数据的特征信息发送给所述感知节点时，具体包括：所述处理器器，还用于生成通知消息，所述通知消息包含所述应用信息和所述特征信息；所述发送器，用于将所述通知消息发送给所述感知节点。
结合第二方面，在第二方面的第六种可能的实现方式中，所述互联网通信系统中包含用于对数据进行重封装的封包设备；所述发送器将所述应用信息及所述第一业务数据的特征信息发送给所述感知节点时，具体用于：所述发送器，用于将所述应用信息及所述特征信息发送给所述封包设备，以使所述封包设备生成通知消息，所述通知消息包含所述应用信息及所述特征信息，以及使所述封包设备将所述通知消息发送给所述感知节点。
第三方面，本发明提供一种封包设备，应用于互联网通信系统中，所述系统还包括服务器和感知节点；所述封包设备包括：接收器、处理器和发送器；所述接收器，用于接收所述服务器发送的第一业务数据，以及，与所述第一业务数据对应的应用信 息；所述处理器，用于生成第一数据包，所述第一数据包包括消息头和载荷，所述消息头承载所述应用信息，所述载荷承载所述第一业务数据；所述发送器，用于将所述第一数据包发送给所述感知节点，以便所述感知节点根据所述应用信息识别所述第一业务数据的业务信息。
第四方面，本发明提供一种封包设备，应用于互联网通信系统中，所述系统还包括服务器和感知节点；所述封包设备包括：接收器、处理器和发送器；所述接收器，用于接收所述服务器发送的与第一业务数据对应的应用信息，以及，所述第一业务数据的特征信息；所述处理器，用于生成通知消息，所述通知消息包括所述应用信息和所述特征信息；所述发送器，用于将所述通知消息发送给所述感知节点，以便所述感知节点根据所述特征信息建立所述应用信息与所述第一业务数据之间的关联，并使所述感知节点根据所述应用信息识别所述第一业务数据的业务信息。
由以上技术方案可见，本发明实施例提供的数据传输方法，当用户访问互联网业务时，向相应的服务器发送应用访问请求。服务器响应所述应用访问请求，获取加密的第一业务数据提供给感知节点，同时，将与第一业务数据对应的应用信息提供给感知节点。感知节点通过应用信息获知第一业务数据的业务信息，进一步提供给其它需要应用感知的服务系统，从而，在业务数据加密的情况下，通过应用信息也能够识别业务数据的业务信息，例如，业务类型等，进而使得基于业务数据内容的服务系统正常运行。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，对于本领域普通技术人员而言，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例一种数据传输系统的架构示意图；
图2为本发明实施例一种数据传输方法的流程图；
图3为本发明实施例一种应用信息的消息格式示意图；
图4为本发明实施例一种数据传输方法的流程图；
图5为本发明实施例另一种数据传输方法的流程图；
图6为本发明实施例另一种数据传输方法的流程图；
图7为本发明实施例一种TCP协议报文的消息格式示意图；
图8为本发明实施例一种TLS协议报文的消息格式示意图；
图9为本发明实施例一种Ipv4协议报文的消息格式示意图；
图10为本发明实施例一种Ipv6协议报文的消息格式示意图；
图11为本发明实施例一种UDP协议的消息格式示意图；
图12为本发明实施例一种ICMP的协议消息格式示意图；
图13为本发明实施例一种服务器的框图；
图14为本发明实施例一种封包设备的框图。
具体实施方式
为了使本技术领域的人员更好地理解本发明中的技术方案，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都应当属于本发明保护的范围。
参见图1，为本发明实施例提供的一种数据传输系统的架构示意图，如图1所示，该系统包括终端设备110、感知节点120、封包设备130和服务器140。
终端设备110可以是电脑、手机等任何能够进行互联网访问的终端，其中，终端设备110与服务器140之间通过有线通信网络或无线通信网络进行通信。
本发明实施例中，服务器140是指非运营商提供的，用于向用户提供各种互联网业务的服务端。服务器140接收终端设备110发起的基于HTTP的请求，并向终端设备110提供相应的应用服务。
封包设备130可以部署在服务器140上，也可以是独立于服务器的独立设备，或者，可以是服务器上的程序片段。封包设备用于对服务器指定的数据进行重封包后转发。其中，如果封包设备130部署在服务器140内部，则服务器140可以通过函数调用的方式，例如，服务器可以通过应用程序编程接口将需要封包的数据传递给封包设备130；如果封包设备130未部署在服务器140中，则服务器140通过发送消息的方式将需要封包的数据传递给封包设备130。
感知节点120用于感知终端设备110和服务器140之间传输的业务数据的业务信息。感知节点120的输入是封包设备130输出的数据。
其中，感知节点120可以部署在从服务器140到终端设备110之间的网络路径上，可以在该网络路径上部署一个或多个感知节点，以配合在该网络路径上不同位置的其它感知业务系统150(例如，父子账号系统)完成业务内容感知。感知节点120可以是独立的装置，也可以与其它系统(例如，感知业务系统)或装置集成，或者，可以与终端设备直接集成在一起(此时，感知节点实际是终端设备内的程序片段)。
感知节点120提供对外的查询接口，其它的感知业务系统经过授权可以通过该查询接口查询到指定业务的业务信息。其中，感知业务系统即与业务内容感知相关的业务系统，例如，父子账号系统，或者，根据业务进行流量管理调度的系统等。
参见图2，为本发明实施例提供的一种数据传输方法的流程图，该方法应用于图1所示的系统中，如图2所示，该数据传输方法包括：
S110，终端设备向服务器发送应用访问请求。
例如，终端设备访问某个视频网站中具体的视频时会产生相应的访问请求并发送给该网站的服务器。
S120，服务器根据应用访问请求获取加密后的第一业务数据及与该第一业务数据相对应的应用信息。
该应用信息用于表征第一业务数据的业务信息，例如，业务类型、优先级等信息。
本发明实施例针对业务数据进行加密的应用场景，即服务器响应终端设备的访问请求时返回的所有业务数据均以密文形式传输给终端设备。服务器接收到终端设备发送的应用访问请求后，对响应该应用访问请求的业务数据进行加密，得到第一业务数据；同时，获取该第一业务数据的应用信息，该应用信息表征第一业务数据的业务内容。
参见图3，示出了本发明实施例一种应用信息的消息格式示意图，如图3所示，应用信息包括H-Length(总长度)和FLOW-INFO(流信息)两个字段。
H-Length：表示整个应用信息头的总长度；
FLOW-INFO：是一个可变长字段，可以包含一个或多个信息段(INFO)；每个信息段(INFO)均包含3个字段：TYPE(类型)、T-Length(长度)和Sub-information(子信息)，这3个字段的具体含义参见表1；
其中，TYPE，表示后续Sub-information字段的类型；
T-Length，表明本INFO字段的长度；
Sub-information，表示本INFO字段携带的具体信息内容。
表1
Figure PCTCN2017075458-appb-000001
Figure PCTCN2017075458-appb-000002
S130，服务器将第一业务数据及应用信息提供给感知节点。
服务器将应用信息提供给感知节点，以便感知节点获取服务器传递给终端设备的业务数据的业务信息，进而使业务感知系统完成与业务信息相关的服务。
在本发明的一些实施例中，服务器内部署有封包设备，服务器通过该封包设备将第一业务数据及应用信息进行重封包，并转发给感知节点。
在本发明的另一些实施例中，封包设备独立于服务器部署，服务器将第一业务数据及应用信息发送给封包设备，封包设备将第一业务数据及应用信息进行重封包之后转发给感知节点。
在本发明的又一个实施例中，服务器可以直接将应用信息和第一业务数据提供给感知节点。
针对上述几个具体实施方式，后面将详细介绍，此处不再详述。
S140，感知节点利用所述应用信息识别所述第一业务数据的业务信息。
感知节点根据接收到的应用信息，确定所述第一业务数据的业务信息，例如，业务类型等信息。
S150，感知节点转发第一业务数据，或者，第一业务数据和应用信息。
在本发明的一些实施例中，感知节点可以只将第一业务数据转发给下一个节点，不需要转发应用信息；
在本发明的另一些实施例中，感知节点可以将第一业务数据和应用信息都转发给下一个节点。
其中，下一个节点可能是终端设备、下一个感知节点，或其它感知业务系统(例如，父子账号系统)。本实施例提供的数据传输方法，在服务器向终端设备发送加密业务数据的过程中，服务器将感知节点需要的应用信息传递给感知节点，从而使感知节点能够根据该应用信息获知终端设备与服务器之间传输的加密业务数据的业务信息，进而使感知业务系统完成与业务内容相关的服务。其中，应用信息以明文方式传输，不需要服务器额外增加加解密协议簇，在保证终端设备与服务器之间业务数据加密的前提下，数据传输更方便、系统成本更低。
参见图4，为本发明实施例提供的一种数据传输方法的流程图，该方法应用于图1所示的系统，本实施例中，封包设备独立于服务器部署，例如，封包设备可以是任何能够对数据进行拆包、封包的设备。如图4所示，所述数据传输方法包括：
S210，终端设备向服务器发送应用访问请求。
S220，服务器根据接收到的应用访问请求，获取加密后的第一业务数据及与第一业务数据对应的应用信息，并将第一业务数据及应用信息发送给封包设备。
封包设备独立于服务器，服务器以发送消息的方式通过网络连接将应用信息发送给封包设备，通知封包设备对该应用信息和业务数据进行重封装。
S230，封包设备生成第一数据包；该第一数据包包括消息头和载荷，该消息头承载所述应用信息，所述载荷承载所述第一业务数据。
封包设备接收到服务器发送的应用信息后，缓存在本地，并向服务器返回确认信息。然后，封包设备接收服务器发送的第一业务数据，根据该第一业务数据的特征信息(例如，业务数据的特征信息可以是五元组，五元组包括源IP地址、源端口、目的IP地址、目的端口和传输层协议，用于区分不同的数据报文)查询本地是否存在与该第一业务数据匹配的应用信息，如果存在，则封包设备修改该第一业务数据，重新封装第一业务数据的报文头，将与该第一业务数据匹配的应用信息写入该第一业务数据的报文头中，从而生成第一数据包。其中，可以将应用信息写入报文头的可选字段中，或者，可以在报文头中增加新的字段用来承载该应用信息。
S240，封包设备将第一数据包发送给感知节点。
封包设备将重新封装得到的第一数据包发送给感知节点。
S250，感知节点从所述第一数据包中提取所述应用信息生成第二数据包，并根据应用信息识别所述第一业务数据的业务信息，其中，第二数据包包含第一业务数据。
感知节点解析接收到的第一数据包，判断第一数据包中是否携带应用信息，如果携带应用信息，则从第一数据包中提取应用信息，并查询本地流表(该流表用于存储接收到的各个业务数据对应的应用信息)中是否存在该应用信息；如果已经存在相应的流表条目，则根据接收到的应用信息刷新流表条目中记录的流应用信息；如果不存在相应的流表条目，则新增流表条目并记录接收到的应用信息插入流表中。初始状态下，流表内没有应用信息的流表条目。
S260，感知节点转发所述第二数据包，或所述第一数据包。
第二数据包包含第一业务数据，第一数据包包含第一业务数据及第一业务数据对应的应用信息。
在本发明的一些应用场景中，需要保证终端设备与服务器之间收发的数据一致，因此，在此种应用场景下，感知节点需要对封包设备重新封装后的第一数据包还原成原始的第一业务数据：感知节点将应用信息从第一数据包的报文头中剥离出来，将第一数据包的报文还原成第一业务数据的报文，并转发给下一个节点。
在本发明的另一些应用场景中，不需要保证终端设备接收的数据与服务器发送的数据完全一致，因此，在此种应用场景下，感知节点可以直接将封包设备重新封装的第一数据转发给下一个节点。
图1所示的系统中可能包含多个感知节点，具体在哪个感知节点上还原业务数据报文，可以根据感知节点提供方自行确定。
本实施例提供的数据传输方法，在服务器向终端设备发送加密业务数据的过 程中，服务器将感知节点需要的应用信息传递给感知节点，从而使感知节点根据应用信息获知终端设备与服务器之间传输的加密业务数据的业务信息，进而使感知业务系统完成与业务信息相关的服务。其中，应用信息以明文方式传输，不需要服务器额外增加加解密协议簇，在保证终端设备与服务器之间业务数据加密的前提下，数据传输更方便、系统成本更低。
参见图5，为本发明实施例提供的另一种数据传输方法的流程图，本实施例以父子账号系统为例，介绍父子账号系统与图1所示的系统采用图4所示的数据传输方法完成内容过滤服务。
父子账号系统用于根据互联网的数据内容进行过滤，过滤掉不适宜儿童访问的数据，从而保证儿童上网环境健康安全。
图5中的S210～S260与图4中标号相同的步骤相同，此处不再赘述，其中，S260中，感知节点将第一数据包或第二数据包转发给父子账号系统；其中，第一数据包包含第一业务数据及第一业务数据对应的应用信息；第二数据包包含第一业务数据。
S310，父子账号系统向感知节点发送业务查询消息。业务查询消息用于向感知节点查询第一业务数据的应用信息，该业务查询消息携带第一业务数据的特征信息，例如，五元组信息。
S320，感知节点接收到业务查询消息后，根据特征信息查询本地的流表获得与该特征信息相匹配的应用信息。
感知节点接收到业务查询消息后，根据查询消息所携带的业务数据的特征信息查询本地流表中是否存在与该特征信息相匹配的流表条目，如果存在，则获取该流表条目中的应用信息；如果不存在，则结束当前流程。
S330，感知节点将获得的应用信息反馈给父子账号系统。
S340，父子账号系统根据应用信息判断第一业务数据能否被子账号访问，如果是，则执行S350；如果否，则执行S360。
S350，将接收到的第一业务数据发送给终端设备。
S360，向终端设备发送错误代码。例如，403Forbidden。
其它基于业务感知的业务中数据传输业务与父子账号业务相似，此处不再一一介绍。
本实施例提供的数据传输方法，感知节点将还原得到的第一业务数据发送给感知业务系统，感知业务系统向感知节点查询该第一业务数据的应用信息，从而在业务数据加密的情况下能够识别该第一业务数据的业务信息，进而对第一业务数据进行相应的处理。
参见图6，为本发明实施例提供的另一种数据传输方法的流程图，该方法应用于图1所示的系统中。本实施例中，封包设备部署在服务器中，例如，在服务器的协议栈中实现相关功能，即服务器发出的业务数据就包含了应用层信息，该应用层信息以明文形式存储。如图6所示，该方法包括：
S410，终端设备向服务器发送应用访问请求。
S420，服务器根据接收到的应用访问请求，获取加密后的第一业务数据及与第一业务数据对应的应用信息。
S430，服务器调用封包设备生成第一数据包。第一数据包包括消息头和载荷，其中，消息头承载应用信息，载荷承载第一业务数据。
服务器可以通过调用扩展Socket API(Application Programming Interface，应用程序编程接口)函数调用封包设备。
S440，服务器将第一数据包发送给感知节点。
S450，感知节点从第一数据包中获得应用信息生成第二数据包，并根据所述应用信息识别所述第一业务数据的业务信息；其中，第二数据包包含第一业务数据。
S460，感知节点将第二数据包或第一数据包转发给下一个节点。
在本发明的一些实施例中，由于封包设备部署在服务器内，即服务器输出的第一数据包中携带应用信息，为了保证终端设备和服务器之间收发的数据一致，感知节点不需要对第一数据包的报文进行修改，直接转发给下一个节点即可。
本实施例提供的数据传输方法，由部署在服务器内部的封包设备对应用信息和第一业务数据进行重新封装，得到第一数据包并发送给感知节点。感知节点从第一数据包中获取应用信息，并根据应用信息识别第一业务数据的业务信息。而且，感知节点不需要对第一数据包进行修改直接转发给下一个节点即可。该方法需要服务器侧集成封包设备的功能，但感知节点不需要修改第一数据包。
应用信息可以直接携带于业务数据流的报文中，称为带内传输方式；应用信息也可以独立于业务数据流进行传输，称为带外传输方式。其中，带内传输方式可以将应用信息写入到传输业务数据流所使用的协议报头中，例如，TCP协议、TLS(Transport Layer Security，安全传输层)协议、IP(Internet Protocol，网络协议)协议、UDP(User Datagram Protocol，用户数据报协议)等，本发明对此并不限定。将应用信息携带到哪个协议报头中，需要根据具体应用场景确定。带外传输方式，即应用信息独立于终端设备与服务器之间的业务数据流，例如，可以通过ICMP(Internet Control Message Protocol，网络控制报文协议)协议报文或其它协议报文单独承载应用信息，本发明对此并不限定。
下面结合图7～图10分别介绍以下几种应用场景：
在终端设备与服务器之间采用TCP(Transmission Control Protocol，传输控制协议)协议作为传输层协议的应用场景中，应用信息可以承载于TCP协议报文中。
参见图7，为本发明实施例提供的一种TCP协议报文的消息格式示意图，应用信息可以填写到TCP协议的可选项字段。
其中，TCP协议报文中各个字段的含义如下：
源端口号：16位，标识出远端的端口号。
目的端口号：16位，标识出本地的端口号。
序列号：32位，表明发送的数据报的顺序。
确认序列号：32位，希望收到的下一个数据报的序列号。
首部长度：4位，表明TCP报头中包含多少个32位字。
接下来的6位保留未用。
URG(紧急位)：当URG＝1时，表示该报文应尽快传送不需要按本来的列队次序来传送。TCP的紧急方式是发送端向另一端发送紧急数据的一种方式，与紧急指针字段共同应用，紧急指针指向数据报内的某个字节，表示数据报内从第一字节到紧急指针所指字节都是紧急数据，不进入接收缓冲就直接交给上层进程，其它的数据进入接收缓冲。
ACK(Acknowledgement，确认字符)：ACK为1，表明确认序列号合法；如果ACK为0，表明数据报不包含确认信息，确认字段被省略。
PSH(Push，推送)：当PSH为1时，表示是带有PUSH标志的数据，接收方请求数据报立即传送给应用程序而不必等到缓冲区装满时才传送。
RST(复位)：表示连接复位请求，用于复位由于主机崩溃或其它原因而出现的错误连接；还可以用于拒绝非法的数据报或拒绝连接请求。
SYN(同步序号)：用于建立连接。
FIN(Final，结束信号)：表示发送端已经达到数据末尾，即，双方的数据传送完成连接将被断开。
窗口大小：16位，表示在确认了字节之后还可以发送多少个字节。
校验和：16位，是为了确保高可靠性而设置的。它校验头部、数据和伪TCP头部之和。
Application Info Option(应用信息选项)：0个或多个32位字，本实施例中该字段用于承载业务数据的应用信息，其中，该字段包括Option(选项)和Padding(增加)两项，Option项承载应用信息。
Data(数据)：该字段用于承载业务数据。
在终端设备与服务器之间采用TLS协议作为传输层加密协议的应用场景中，业务数据的应用信息可以以明文的方式写入TLS协议报文的报头中。
参见图8，为本发明实施例提供的一种TLS协议报文的消息格式示意图，应用信息可以写入TLS报头的Version字段和Length字段之间。
如图8所示，TLS协议报文中各个字段的含义如下：
TYPE(类型)：表示后续字段的类型。
Version(版本)：表示协议的版本信息。
Application Info(应用信息)：该字段为写入的应用信息，应用信息的消息格式如图3所示。
Length(长度)：表示TSL帧报头的长度，用于示意应用信息在TLS数据帧中的位置。
本领域技术人员可以理解的是，某些传输层的协议，例如，TCP、UDP等，在传输层报头中加入一些校验、长度字段，封包设备在修改了TLS报头写入应用信息的同时，需要修改传输层底层协议的报头中的相关字段，避免后续节点处理错误。
在终端设备与服务器采用IP作为承载协议(基本所有互联网流量均使用IP协议)的应用场景中，应用信息可以写入到IP报头中。
参见图9，为本发明实施例提供的一种Ipv4协议报文的消息格式示意图，应用信息填写到Options字段中。
其中，Ipv4协议中各个字段的含义如下：
VER(Version，版本号)：4位，协议版本号是4，因此称作IPv4。
IHL(Internet Header Length，报头长度)：报头长度，4位，首部长度是指IP层头部占32位字的数目，即，IP层头部包含多少个4字节，包括任何选项。
TOS(Type Of Service，服务类型)：8位，指出上层协议对处理当前数据报所期望的服务质量，并对数据报按照重要性级别进行分配。这个字段用于分配优先级、延迟、吞吐量以及可靠性等。
Total Length(IP包总长度)：指定整个IP数据包的字节长度，包括数据和协议头；其最大值为65,535字节，典型的主机可以接收576字节的数据报。
Identification(标识符)：16位，该字段用于识别当前数据报。该字段由发送端分配帮助接收端集中数据报分片。
Flags(标记)：3位，其中最低位(MF)控制分片，存在下一个分片置为1，否则置0代表结束分片。中间位(DF)指出数据包是否可进行分片。第三位即最高位保留不使用，但是必须为0。
Fragment OFF(Fragment Offset，片偏移)：13位，指出与源数据报的起始端相关的分片数据位置，支持目标IP适当重建源数据报。
TTL(Time To Live，生存期)：8位，是一种计数器，在丢弃数据报的每个点值依次减1直至减少为0。这样确保数据包无止境的环路过程。
Protocol(协议)：8位指出在IP处理过程完成之后，有哪种上层协议接收导入数据包。
Header Checksum(头部校验)：16位，帮助确保IP协议头的完整性。由于某些协议头字段的改变，如TTL，需要对每个点重新计算和检验。Internet协议头需要进行处理。
Source Address(源地址)：32位，源主机IP地址。
DestinationAddress(目标地址)：32位，目标主机IP地址。
Application Info Options(应用信息项)：该字段用于填充应用信息，其中， 应用信息的消息格式如图3所示。
Data(数据)：数据字段。
参见图10，为本发明实施例提供的一种Ipv6协议报文的消息格式示意图，在Ipv6的Extension Header(扩展头)字段中。
如图10所示，Ipv6报头包含的各个字段的含义如下：
Version(版本号)：4位，IP协议版本号，Ipv6的版本号为6。
Traffic Class(通信类别)：8位，指示IPv6数据流通信类别或优先级。功能类似于IPv4的TOS字段。
Flow Label(流标记)：20位，IPv6新增字段，标记需要IPv6路由器特殊处理的数据流。该字段用于某些对连接的服务质量有特殊要求的通信，诸如音频或视频等实时数据传输。在IPv6中，同一信源和信宿之间可以有多种不同的数据流，彼此之间以非“0”流标记区分。如果不要求路由器做特殊处理，则该字段值置为“0”。
Payload Length(负载长度)：16位，负载长度包括扩展头和上层PDU(Packet Data Unit，分组数据单元)，16位最多可表示65535字节负载长度。超过这一字节数的负载，该字段值置为“0”，使用扩展头逐个跳段(Hop-by-Hop)选项中的巨量负载(Jumbo Payload)选项。
Next Header(下一包头)：8位，识别紧跟IPv6头后的包头类型，如扩展头(如果有扩展头)或某个传输层协议头(诸如TCP，UDP或者ICMPv6)。
Hop Limit(跳段数限制)：8位，类似于IPv4的TTL字段，用数据包在路由器之间的转发次数来限定包的生命期。数据包每经过一次转发，该字段减1，减到0时就把这个包丢弃。
Source Address(源地址)：128位，发送方主机地址。
Destination Address(目的地址)：128位，在大多数情况下，目的地址即信宿地址。但如果存在扩展头的话，目的地址可能是发送方路由表中下一个路由器接口。
Application Info Extension Header(应用信息扩展头)：应用信息填写在该字段中。
Data(数据)：该字段填写数据。
终端设备与服务器之间的业务数据流基于UDP协议进行传输的应用场景中，可以将应用信息写入UDP协议报头以后的字段中。
参见图11，为本发明实施例提供的一种UDP协议的消息格式示意图，如图11所示，UDP协议包含的各个字段的含义如下：
源端口号：远端的端口号；
目的端口号：本地的端口号；
长度：整个报头的长度，以字节为单位；
校验和：确保高可靠性，校验头部和数据之和；
前导符(增加字段)：用于标识后续数据中包含应用信息；
Application Info(应用信息)：标识终端设备与服务器之间业务数据流所对应的应用信息；
Data：此字段为数据字段。
在本发明的另一些实施例中，应用信息还可以通过带外传输方式进行传输，即应用信息独立于终端设备与服务器之间的业务数据流；应用信息与业务数据流分别单独传输，因此，还需要为业务数据流与应用信息建立关联，例如，在应用信息中包含终端设备与服务器之间的业务数据流的特征信息，例如，五元组，或特征字串，以便感知节点接收到应用信息后，能够根据该特征信息将应用信息与业务数据进行映射，从而正确建立本地应用信息的流表。
参见图12，为本发明实施例提供的一种ICMP的协议消息格式示意图，应用信息可以在ICMP协议中写入应用信息。如图12所示，ICMP协议包含的各个字段的含义如下：
TYPE(类型)：8位，标识ICMP报文的类型；
Code(代码)：8位，该字段与TYPE字段共同决定了ICMP报文的类型；
ICMP Checksum(ICMP包校验和)：包括数据在内的整个ICMP报文的校验和；
Application Info(应用信息)：该字段承载应用信息，该字段内还应该包含业务数据流的特征信息。
下面将介绍通过带外传输方式传输应用信息时，各个节点的操作：服务器将应用信息及与该应用信息对应的业务数据的特征信息，传递给封包设备。封包设备根据应用信息及业务数据的特征信息生成通知消息，该通知消息包括应用信息及特征信息，并传输给感知节点。感知节点解析收到的通知消息，获得应用信息及业务数据的特征信息，并建立应用信息的流表；与此同时，服务器将业务数据流发送给封包设备，封包设备对该业务数据流不做任何修改直接转发给感知节点，感知节点再将该业务数据转发给下一个节点(终端设备、其它基于业务感知的业务系统或下一个感知节点)。
在另一种场景中，通过带外传输方式传输应用信息时，不需要对业务数据流做任何修改，因此，在此应用场景中可以不设置封包设备。这样，业务数据对应的应用信息及特征信息由服务器封装成设定协议格式的通知消息，然后，将该通知消息发送给感知节点，感知节点解析该通知消息获得应用信息，并建立应用信息的流表。与此同时，服务器向感知节点发送业务数据流，感知节点通过业务数据的特征信息，查询应用信息流表，获知该业务数据流的应用信息。然后，感知节点将业务数据流转发给下一个节点。
相应于上述的数据传输方法实施例，本申请还提供了相应的装置实施例。
参见图13，为本发明实施例提供的一种服务器的框图，该服务器应用于互联网通信系统中，该系统包括终端设备、服务器和感知节点。如图13所示，该服务器包括：接收器210、处理器220和发送器230。
接收器210用于接收终端设备发送的应用访问请求，并传递给处理器220。
处理器220用于根据接收器210传递的应用访问请求获取加密后的第一业务数据及该第一业务数据对应的应用信息。其中，该应用信息用于表征第一业务数据的业务信息。
发送器230用于将处理器220获得的第一业务数据及应用信息提供给感知节点，从而使感知节点利用该应用信息识别第一业务数据的业务信息。
在本申请的一些实施例中，处理器220用于根据第一业务数据及对应的应用信息生成第一数据包，其中第一数据包包括消息头和载荷，该消息头承载应用信息，载荷承载第一业务数据。并由发送器230将处理器220生成的第一数据包发送给互联网通信系统中的感知节点。
在本申请的另一些实施例中，互联网通信系统还包括用于对数据进行重新封装的封包设备；在此种应用场景下，发送器230将应用信息及第一业务数据发送给封包设备，由封包设备根据应用信息和第一业务数据生成第一数据包，并由封包设备将第一数据包发送给感知节点；其中，封包设备生成的第一数据包包括消息头和载荷，消息头承载应用信息，载荷承载第一业务数据。
无论是服务器生成的第一数据包，还是封包设备生成的第一数据包，应用信息携带于第一业务数据的报文中进行传输，即带内传输方式；此种传输方式下，第一数据包所包含的消息头均可以包括TCP报文头、TLS报文头、IP报文头或UDP报文头。
在本申请的另一些实施例中，应用信息还可以以带外传输方式进行传输，即应用信息不携带于终端设备与服务器之间传输的业务数据中，即，业务数据及业务数据的应用信息分别单独传输。此种应用场景下，需要建立业务数据与应用信息之间的关联，以便感知节点获知业务数据关联的应用信息。
发送器230将第一业务数据发送给感知节点，同时，将第一业务数据对应的应用信息及第一业务数据的特征信息发送给感知节点，以便感知节点根据特征信息建立第一业务数据及应用信息之间的关联。进而使感知节点根据应用信息识别第一业务数据的业务信息。
在本申请的一些实施例中，通过带外传输方式传输应用信息时，服务器将应用信息及第一业务数据的特征信息发送给封包设备，由封包设备根据应用信息及特征信息生成通知消息，该通知消息的消息头中包含该应用信息和特征信息，然后，封包设备将通知消息发送给感知节点。
在本申请的另一些实施例中，由服务器的处理器220直接根据第一业务数据的应用信息及特征信息生成通知消息，该通知消息的消息头中携带应用信息及特征信息。
本实施例提供的服务器，在向终端设备发送加密业务数据的过程中，服务器将感知节点需要的应用信息传递给感知节点，从而使感知节点能够根据该应用信息获知终端设备与服务器之间传输的加密业务数据的业务信息，进而使感知业务系统完成与业务内容相关的服务。其中，应用信息以明文方式传输，不需要服务器额外增加加解密协议簇，在保证终端设备与服务器之间业务数据加密的前提下，数据传输更方便、系统成本更低。
参见图14，为本发明实施例提供的一种封包设备的框图，该封包设备应用于互联网通信系统中，该系统包括服务器、感知节点和终端设备。如图14所示，该封包设备包括接收器310、处理器320和发送器330。
接收器310用于接收服务器发送的第一业务数据，以及，与所述第一业务数据对应的应用信息。
处理器320用于根据第一业务数据及应用信息生成第一数据包，所述第一数据包包括消息头和载荷，所述消息头承载所述应用信息，所述载荷承载所述第一业务数据。
发送器330用于将所述第一数据包发送给所述感知节点，以便所述感知节点根据所述应用信息识别所述第一业务数据的业务信息。
在本申请的一些实施例中，封包设备需要对服务器发送的第一业务数据对应的应用信息及特征信息进行重新封装，此种应用场景下，接收器310用于接收服务器发送的第一业务数据的应用信息及特征信息；处理器320用于根据接收到的应用信息及特征信息生成通知消息，在通知消息的消息头中携带应用信息及特征信息。发送器330用于将处理器320生成的通知消息发送给感知节点，以使感知节点根据特征信息建立第一业务数据与应用信息之间的管理，进而使感知节点根据应用信息识别第一业务数据的业务信息。
本实施例提供的封包设备，根据接收到的服务器发送的第一业务数据及对应的应用信息生成第一数据包，即，将应用信息写入第一业务数据的消息头中，从而使感知节点在接收到第一业务数据的同时，能够获得该第一业务数据的应用信息，并根据该应用信息识别第一业务数据的业务信息，完成与业务内容相关的服务。其中，应用信息以明文方式传输，不需要服务器额外增加加解密协议簇，在保证终端设备与服务器之间业务数据加密的前提下，数据传输更方便、系统成本更低。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于装置或系统实施例而言，由于其基本相似于方法实施例，所以描述得比较简单，相关之处参见方法实施例的部分说明即可。以上所描述的装置及系统实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。本领域普通技术人员在不付出 创造性劳动的情况下，即可以理解并实施。
需要说明的是，在本文中，诸如“第一”和“第二”等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个......”限定的要素，并不排除在包括所述要素的过程、方法、物品或者设备中还存在另外的相同要素。
以上所述仅是本发明的具体实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本发明原理的前提下，还可以做出若干改进和润饰，这些改进和润饰也应视为本发明的保护范围。

Claims (14)

  1. 一种数据传输方法，其特征在于，应用于基于互联网通信的系统中，所述系统包括终端设备、服务器和感知节点；所述方法包括：
    所述服务器接收所述终端设备发送的应用访问请求；
    所述服务器根据所述应用访问请求获取加密后的第一业务数据及与所述第一业务数据对应的应用信息，所述应用信息用于表征所述第一业务数据的业务信息；
    所述服务器将所述应用信息及所述第一业务数据提供给感知节点；
    所述感知节点利用所述应用信息识别所述第一业务数据的业务信息；
    所述感知节点转发所述第一业务数据，或者，所述第一业务数据和所述应用信息。
  2. 根据权利要求1所述的方法，其特征在于，所述服务器将所述应用信息及所述第一业务数据提供给感知节点，包括：
    所述服务器生成第一数据包，所述第一数据包包括消息头和载荷，所述消息头承载所述应用信息，所述载荷承载所述第一业务数据；
    所述服务器将所述第一数据包发送给所述感知节点。
  3. 根据权利要求1所述的方法，其特征在于，所述互联网通信系统还包括用于对数据进行重封装的封包设备；
    所述服务器将所述应用信息及所述第一业务数据提供给感知节点，包括：
    所述服务器将所述应用信息及所述第一业务数据发送给所述封包设备；
    所述封包设备生成第一数据包，所述第一数据包括消息头和载荷，所述消息头承载所述应用信息，所述载荷承载所述第一业务数据；
    所述封包设备将所述第一数据包发送给所述感知节点。
  4. 根据权利要求2或3所述的方法，其特征在于，所述第一数据包基于以下协议中的任意一种构建：传输控制协议TCP、安全传输层协议TLS、网络协议IP和用户数据报协议UDP。
  5. 根据权利要求1所述的方法，其特征在于，所述服务器将所述应用信息及所述第一业务数据提供给感知节点，包括：
    所述服务器将所述第一业务数据发送给所述感知节点；
    所述服务器将所述应用信息及所述第一业务数据的特征信息发送给所述感知节点，以使所述感知节点根据所述特征信息建立所述第一业务数据与所述应用信息之间的关联。
  6. 根据权利要求5所述的方法，其特征在于，
    所述服务器将所述应用信息及所述第一业务数据的特征信息发送给所述感知节点，包括：
    所述服务器生成通知消息，所述通知消息包含所述应用信息和所述特征信息；
    所述服务器将所述通知消息发送给所述感知节点。
  7. 根据权利要求5所述的方法，其特征在于，所述互联网通信系统中包含用于对数据进行重封装的封包设备；
    所述服务器将所述应用信息及所述第一业务数据的特征信息发送给所述感知节点，包括：
    所述服务器将所述应用信息及所述特征信息发送给所述封包设备；
    所述封包设备生成通知消息，所述通知消息包含所述应用信息及所述特征信息，并将所述通知消息发送给所述感知节点。
  8. 一种服务器，其特征在于，应用于互联网通信系统中，所述系统还包括终端设备和感知节点；所述服务器包括：接收器、处理器和发送器；
    所述接收器，用于接收所述终端设备发送的应用访问请求；
    所述处理器，用于根据所述应用访问请求获取加密后的第一业务数据及与所述第一业务数据对应的应用信息，所述应用信息用于表征所述第一业务数据的业务信息；
    所述发送器，用于将所述应用信息及所述第一业务数据提供给感知节点，以便所述感知节点利用所述应用信息识别所述第一业务数据的业务信息。
  9. 根据权利要求8所述的服务器，其特征在于，
    所述处理器还用于，生成第一数据包，所述第一数据包包括消息头和载荷，所述消息头承载所述应用信息，所述载荷承载所述第一业务数据；
    所述发送器，用于将所述第一数据包发送给所述感知节点。
  10. 根据权利要求8所述的服务器，其特征在于，所述互联网通信系统还包括用于对数据进行重封装的封包设备；
    所述发送器将所述应用信息及所述第一业务数据提供给感知节点时，具体用于：
    所述发送器将所述应用信息及所述第一业务数据发送给所述封包设备，以便所述封包设备生成第一数据包并将所述第一数据包发送给所述感知节点，所述第一数据包包括消息头和载荷，所述消息头承载所述应用信息，所述载荷承载所述 第一业务数据。
  11. 根据权利要求9或10所述的服务器，其特征在于，所述第一数据包基于以下协议中的任意一种构建：传输控制协议TCP、安全传输层协议TLS、网络协议IP和用户数据报协议UDP。
  12. 根据权利要求8所述的服务器，其特征在于，所述发送器用于将所述应用信息及所述第一业务数据提供给感知节点时，具体用于：
    将所述第一业务数据发送给所述感知节点；
    将所述应用信息及所述第一业务数据的特征信息发送给所述感知节点，以使所述感知节点根据所述特征信息建立所述第一业务数据与所述应用信息之间的关联。
  13. 根据权利要求12所述的服务器，其特征在于，所述发送器将所述应用信息及所述第一业务数据的特征信息发送给所述感知节点时，具体包括：
    所述处理器器，还用于生成通知消息，所述通知消息包含所述应用信息和所述特征信息；
    所述发送器，用于将所述通知消息发送给所述感知节点。
  14. 根据权利要求12所述的服务器，其特征在于，所述互联网通信系统中包含用于对数据进行重封装的封包设备；
    所述发送器将所述应用信息及所述第一业务数据的特征信息发送给所述感知节点时，具体用于：
    所述发送器，用于将所述应用信息及所述特征信息发送给所述封包设备，以使所述封包设备生成通知消息，所述通知消息包含所述应用信息及所述特征信息，以及使所述封包设备将所述通知消息发送给所述感知节点。
PCT/CN2017/075458 2016-03-03 2017-03-02 数据传输方法及服务器 WO2017148419A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP17759270.6A EP3413533B1 (en) 2016-03-03 2017-03-02 Data transmission method and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610120403.9 2016-03-03
CN201610120403.9A CN107154917B (zh) 2016-03-03 2016-03-03 数据传输方法及服务器

Publications (1)

Publication Number Publication Date
WO2017148419A1 true WO2017148419A1 (zh) 2017-09-08

Family

ID=59743506

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/075458 WO2017148419A1 (zh) 2016-03-03 2017-03-02 数据传输方法及服务器

Country Status (3)

Country Link
EP (1) EP3413533B1 (zh)
CN (1) CN107154917B (zh)
WO (1) WO2017148419A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109743178A (zh) * 2018-12-30 2019-05-10 彭丽娜 一种防止区块链的块链被劫持的方法及系统
CN112788662A (zh) * 2019-11-01 2021-05-11 苏州千米电子科技有限公司 数据发送、接收方法和装置

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112637069B (zh) * 2020-12-18 2022-05-06 支付宝(杭州)信息技术有限公司 数据报文的传输方法和装置
CN115442298A (zh) * 2021-06-04 2022-12-06 华为技术有限公司 报文转发方法、装置及通信网络
CN113949576B (zh) * 2021-10-19 2023-05-12 中国电子科技集团公司第三十研究所 一种基于混合泄露信息的零网通信流量的检测方法及装置

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102047636A (zh) * 2008-06-02 2011-05-04 高通股份有限公司 用于加密支持的pcc增强
CN102752220A (zh) * 2012-07-19 2012-10-24 杭州华三通信技术有限公司 识别SSL VPN数据流的服务质量QoS业务类型的方法及设备
CN104753858A (zh) * 2013-12-26 2015-07-01 联芯科技有限公司 异网终端间收发加密业务数据的方法及系统

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2007038924A1 (en) * 2005-10-03 2007-04-12 Noergaard Ole Method for establishing an access code indicator
CN101467449A (zh) * 2006-04-06 2009-06-24 肯尼思·H·弗格森 媒体内容节目控制方法和装置
CN101510878A (zh) * 2009-03-27 2009-08-19 北京星网锐捷网络技术有限公司 一种对等网络监控方法、装置和设备
CN101977235B (zh) * 2010-11-03 2013-03-27 北京北信源软件股份有限公司 一种针对https加密网站访问的网址过滤方法
US20120159530A1 (en) * 2010-12-16 2012-06-21 Cisco Technology, Inc. Micro-Filtering of Streaming Entertainment Content Based on Parental Control Setting
CN103618726A (zh) * 2013-12-04 2014-03-05 北京中创信测科技股份有限公司 一种基于https协议实现移动数据业务识别的方法
CN103685601A (zh) * 2013-12-10 2014-03-26 华为技术有限公司 应用识别方法及装置
US20150365379A1 (en) * 2014-06-12 2015-12-17 Gryphon Online Safety, Inc. System and method for managing, controlling and configuring an intelligent parental control filter

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102047636A (zh) * 2008-06-02 2011-05-04 高通股份有限公司 用于加密支持的pcc增强
CN102752220A (zh) * 2012-07-19 2012-10-24 杭州华三通信技术有限公司 识别SSL VPN数据流的服务质量QoS业务类型的方法及设备
CN104753858A (zh) * 2013-12-26 2015-07-01 联芯科技有限公司 异网终端间收发加密业务数据的方法及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3413533A4 *

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109743178A (zh) * 2018-12-30 2019-05-10 彭丽娜 一种防止区块链的块链被劫持的方法及系统
CN109743178B (zh) * 2018-12-30 2022-07-08 深圳前海用友力合科技服务有限公司 一种防止区块链的块链被劫持的方法及系统
CN112788662A (zh) * 2019-11-01 2021-05-11 苏州千米电子科技有限公司 数据发送、接收方法和装置
CN112788662B (zh) * 2019-11-01 2022-07-15 苏州千米电子科技有限公司 数据发送、接收方法和装置

Also Published As

Publication number Publication date
CN107154917A (zh) 2017-09-12
CN107154917B (zh) 2020-06-02
EP3413533B1 (en) 2023-05-10
EP3413533A4 (en) 2019-02-20
EP3413533A1 (en) 2018-12-12

Similar Documents

Publication Publication Date Title
US11102181B2 (en) Semantically aware network method and apparatus
US20200358886A1 (en) Data Transmission Method, Apparatus, And System
KR102487923B1 (ko) 서비스들 - 사용자-평면 접근법에 대한 네트워크 토큰들을 이용한 효율적인 정책 집행
WO2017148419A1 (zh) 数据传输方法及服务器
CN108601043B (zh) 用于控制无线接入点的方法和设备
CN107852411B (zh) 在多路径环境下对IPsec隧道的高效使用
WO2019033920A1 (zh) 网络侧对远端用户设备的识别和控制方法以及设备
TW200810421A (en) Providing quality of service for various traffic flows in a communications environment
US11637771B2 (en) Technologies for managing network traffic through heterogeneous networks
US9191377B2 (en) Method for network communication past encryption devices
CN110169030B (zh) 用于在异构网络上发送内容的方法及其设备
CN114095195B (zh) 用于安全套接字层代理的自适应控制的方法、网络设备以及非瞬态计算机可读介质
US20230156468A1 (en) Secure Communication Method, Related Apparatus, and System
EP3552367B1 (en) Method and intermediate network node for managing tcp segment
WO2019037685A1 (zh) Quic业务控制方法及网络设备
WO2017067224A1 (zh) 一种报文处理方法及装置
WO2020103420A1 (zh) 一种数据传输方法、接收方法、装置及系统
CN107547478B (zh) 报文传输方法、装置及系统
WO2022228293A1 (zh) 一种发送报文的方法、处理报文的方法及设备
CN109792408B (zh) 用于数据网络中的传输连接的高效管理的网关
JP2011193055A (ja) 通信装置および通信方法
TW201717579A (zh) 資料分享方法及電子裝置
CN117041156A (zh) 通信方法及装置
WO2023280405A1 (en) Multiple data flows management

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 2017759270

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017759270

Country of ref document: EP

Effective date: 20180903

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17759270

Country of ref document: EP

Kind code of ref document: A1