WO2019206254A1

WO2019206254A1 - Penetration method, device, server and medium for devices under different nat nodes

Info

Publication number: WO2019206254A1
Application number: PCT/CN2019/084447
Authority: WO
Inventors: 陈志兴; 熊第彬
Original assignee: 深圳市网心科技有限公司
Priority date: 2018-04-24
Filing date: 2019-04-26
Publication date: 2019-10-31
Also published as: CN108366078A

Abstract

Disclosed by the present application are a penetration method and penetration system for devices under different NAT nodes. The system comprises: a first device under a first NAT node, a second device under a second NAT node, a data transfer server and a signaling server; when the first device needs to transmit data to the second device, the first device needs to establish a data channel to the second device by means of the data transfer server and the signaling server; after the data channel is established, data to be transmitted is encrypted by means of a preset type of encryption mode, and the encrypted data is transmitted to the second device on the basis of the established data channel. Also provided by the present application are a device, a server and a medium. Since the communication information between devices is transmitted by means of a preset type of encryption, reliable data transmission and private data transmission may be achieved, and a transmission channel may be further established at high speed.

Description

Penetration method, device, server and medium of devices under different NAT nodes

This application is based on the priority of the Chinese Patent Application entitled "Penetration Method and Penetration System for Devices Under Different NAT Nodes", filed on April 24, 2018, with the application number CN2018103720572 submitted by the Paris Convention. The entire content of the application is incorporated herein by reference.

Technical field

The present application relates to the field of communications technologies, and in particular, to a method, a penetration system, a device, a server, and a storage medium for a device under different NAT nodes.

Background technique

NAT (Network Address Translation) penetration technology, which is a WAN (Wide Area Network) technology, is a conversion technology that converts private (reserved) addresses into legal IP addresses.

At present, most solutions for NAT penetration technology in network applications are based on STUN (Simple Traversal of UDP over NATs, NAT UDP (User Data Protocol) simple penetration) and TURN (Traversal Using Relays around NAT). Relay through NAT) protocol family. The two clients behind the NAT use the STUN protocol to obtain the public network address of the client, and obtain the relay address of the public network where the client is located through the TURN protocol. Finally, the signaling server exchanges the public network address and relay address of the peer. P2P (peer-to-peer) communication is preferred. If it fails, the TURN protocol is used for data transfer. In most cases, the application scenarios of client device communication under different NAT nodes are usually real-time streaming services such as voice and video. Among them, VoIP (Voice over Internet Protocol) is the most typical. Since this kind of real-time streaming media service experience pays more attention to real-time transmission, it does not pursue reliable transmission of data, and because it transmits multimedia data, the security of data transmission is not particularly harsh, and usually such service pairs are established. The speed of the transmission channel is also relatively tolerant. Therefore, based on these characteristics, there are already mature penetration schemes of devices under different NAT nodes, for example, WebRTC (Web Real-Time Communication).

However, such mature penetration schemes are generally not suitable for application scenarios with high data reliability and security requirements. With the continuous development of the mobile Internet, devices under different NAT nodes are applied to data reliability and There are more and more requirements for application scenarios with high security requirements. Therefore, how to provide more reliable data transmission, higher transmission security, and faster transmission of transmission channels for devices under different NAT nodes. The program has become a technical problem that needs to be solved urgently.

Summary of the invention

The technical problem to be solved by the present application is to provide a device penetration method, a penetration system, a device, a server, and a storage medium under different NAT nodes, which can solve the problem of reliable data transmission, private data transmission, and rapid establishment of a transmission channel. .

In order to solve the above technical problem, a technical solution adopted by the present application is to provide a method for penetrating devices under different NAT nodes, the penetration method being applicable to the first penetration system of devices under different NAT nodes. Establishing a data channel between the first device under the NAT node and the second device located under the second NAT node, and performing data interaction based on the established data channel, the penetration system further includes a data relay server and a signaling server, and the The method includes:

Sending, by the first device, a request for obtaining a communication address of the data relay server to the signaling server if the data needs to be transmitted to the second device;

Receiving and responding to the request, the signaling server feeds back the communication address and a secret key for generating a preset type key to the first device, and sends the communication address and the key seed to The second device;

The first device and the second device send a resource allocation request to the data relay server, where the data relay server allocates resources for communication between the first device and the second device;

The first device acquires a relay address of the second device from the signaling server, and sends a data channel establishment request with the relay address to the data relay server, after the data channel is established Generating a corresponding encryption key based on the secret key seed, and encrypting the data to be transmitted according to an encryption algorithm corresponding to the secret key seed, and transmitting the encrypted data to the data channel based on the established data channel Said second device.

The application of the present application is: different from the prior art, the present application provides a method for penetrating a device under different NAT nodes, a penetration system, a device, a server, and a storage medium, wherein the device includes the first The first device under the NAT node and the second device under the second NAT node, the method for penetrating includes: first, the first device and the second device respectively obtain a communication address and a key seed of the data relay server, and then the first device further Obtaining a relay address of the second device, and requesting the data relay channel to establish a data channel with the relay address, and finally the first device establishes a data channel with the second device, and generates a corresponding key according to the secret key, and uses the corresponding encryption. Way to transfer data. Therefore, since the communication information between the devices is transmitted through an agreed encryption method, the present application can solve the problem of reliable data transmission and private data transmission, and further establish a transmission channel at a high speed.

DRAWINGS

1 is a schematic structural diagram of a penetration system of a device under different NAT nodes according to an embodiment of the present application;

2 is a schematic diagram of a packet format of a Remote module of the first device and the second device;

3 is a schematic diagram of a first signaling server provided by an embodiment of the present application;

4 is a schematic flowchart of a method for penetrating a device under different NAT nodes according to an embodiment of the present application;

5 is a schematic diagram of a program module of the first node device penetration program in FIG. 3;

FIG. 6 is a schematic diagram of a first device according to an embodiment of the present disclosure;

7 is a schematic diagram of a program module of the second node device penetration program of FIG. 6;

FIG. 8 is a schematic diagram of a second signaling server according to an embodiment of the present application;

9 is a schematic diagram of a program module of the third node device penetration program of FIG. 8;

10 is a schematic diagram of a data relay server according to an embodiment of the present application;

11 is a schematic diagram of a program module of the fourth node device penetration program in FIG. 10;

FIG. 12 is a schematic flowchart of a method for penetrating a device under different NAT nodes according to another embodiment of the present application;

FIG. 13 is a schematic diagram of a network architecture corresponding to the penetration method shown in FIG.

detailed description

Please refer to FIG. 1. FIG. 1 is a schematic structural diagram of a penetration system 01 of a device under different NAT nodes according to an embodiment of the present application.

As shown in FIG. 1, the penetration system 01 of the present embodiment includes a first device 1 located under a first NAT node, a second device 2 located under a second NAT node, a data relay server 3, and a signaling server 4.

If the first device 1 and the second device 2 need to perform data transmission, a data channel needs to be established between the two. After the data channel between the first device 1 and the second device 2 is established, the first device 1 encrypts the data to be transmitted, and transmits the encrypted data to the second device based on the established data channel. 2.

Further, the signaling server 4 includes a first signaling server 41 corresponding to the first NAT node. The first signaling server 41 can perform data transmission with the first device 1, the second device 2, and the data relay server 3.

The signaling server 4 also includes a second signaling server 42 corresponding to the second NAT node. The second signaling server 42 can perform data transmission with the second device 2, the data relay server 3, and the first signaling server 41.

It should be noted that both the first device 1 and the second device 2 are integrated with a Remote module. It communicates with the data relay server 3 through the Remote module. The first device 1 includes an Http client (not shown) and a Remote module (not shown), and the second device 2 includes an Http server (not shown) and an NGINX server (not shown). Out) and the Remote module (not shown).

When the first device 1 and the second device 2 are respectively behind the NAT node, the first device 1 will implement fast and secure access to the second device 2 through the Remote module. The Remote module completes the work of reliable data transmission, encrypted transmission, and fast establishment of transmission channels. The message format is shown in Figure 2.

Please refer to FIG. 3. FIG. 3 is a schematic diagram of a first signaling server 41 according to an embodiment of the present application.

The first signaling server 41 includes a first memory 411 and a first processor 412.

The first memory 411 includes at least one type of readable storage medium including a flash memory, a hard disk, a multimedia card, a card type memory (eg, SD or DX memory, etc.), a magnetic memory, a magnetic disk, an optical disk, and the like. The first memory 411 may be an internal storage unit of the first signaling server 41, such as a hard disk of the first signaling server 41, in some embodiments. The first memory 411 may also be an external storage device of the first signaling server 41 in other embodiments, such as a plug-in hard disk equipped with the first signaling server 41, and a smart memory card (Smart Media Card, SMC), Secure Digital (SD) card, Flash Card, etc. Further, the first memory 411 may also include both an internal storage unit of the first signaling server 41 and an external storage device.

The first memory 411 can be used not only for storing application software and various types of data installed in the first signaling server 41, for example, the first node device penetration program 10 of the device under different NAT nodes, and the like. Store data that has been output or will be output.

The first processor 412, in some embodiments, may be a central processing unit (CPU), controller, microcontroller, microprocessor, or other data processing chip for running the program stored in the first memory 411 The code or processing data, such as the first node device penetration program 10.

FIG. 3 shows only the first signaling server 41 with components 411-412. It will be understood by those skilled in the art that the structure shown in FIG. 3 does not constitute a limitation on the first signaling server 41, and may include ratios. Less or more components are illustrated, or some components are combined, or different component arrangements.

Optionally, the first signaling server 41 may further include a user interface, and the user interface may include a display, an input unit such as a keyboard, and the optional user interface may further include a standard wired interface and a wireless interface.

In some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, and an Organic Light-Emitting Diode (OLED) touch device. Therein, the display may also be referred to as a display screen or display unit for displaying information processed in the first signaling server 41 and a user interface for displaying visualizations.

Optionally, the first signaling server 41 may further include a communication unit, for example, a Wi-Fi unit, a SIM (Subscriber Identification Module) card-based mobile communication unit, and the like.

The embodiment of the present application further provides a method for penetrating devices under different NAT nodes.

Referring to FIG. 4, FIG. 4 is a schematic flowchart of a method for penetrating a device under different NAT nodes according to an embodiment of the present application.

In this embodiment, the method for penetrating the device under different NAT nodes is applicable to the first signaling server 41, the first signaling server 41 is corresponding to the first NAT node, and the first signaling server 41 is applicable to A data channel is established between the first device 1 under the first NAT node and the second device 2 under the second NAT node. The method includes:

A10: Detecting and receiving a request for acquiring the communication address of the data relay server 3 sent by the first device 1.

The first device 1 requests the communication address of the data relay server 3 through the first signaling server 41.

A20: After receiving the request, in response to the request, feed back the communication address and a key seed for generating a preset type key to the first device 1.

In this embodiment, the key seed of the preset type includes an AES (Advanced Encryption Standard) key seed, a DES (DES full name Data Encryption Standard) data key and RSA (Ron Rivest). At least one of the key seeds, Adi Shamir, asymmetric asymmetric encryption algorithm proposed by Leonard Adleman.

For example, only one of the AES key seed, the DES key seed, or the RSA key seed may be employed. That is to say, only one of the encryption methods of AES, DES or RSA is adopted. Two or three key seeds of the AES key seed, the DES key seed, or the RSA key seed may also be employed. That is to say, the encryption method using two or three combinations of AES, DES or RSA.

Since each encryption method has its own unique advantages, it also has its shortcomings. Therefore, the combined encryption method can better integrate advantages and avoid disadvantages. For example, the encryption method combining DES and RSA makes the advantages and disadvantages of DES and RSA complement each other, that is, the DES encryption speed is fast, and it is suitable for encrypting long messages, which can be used to encrypt plaintext; RSA encryption speed is slow and security is good. The encryption applied to the DES key solves the problem of DES key distribution.

At present, this method of combining RSA and DES has become the EMAIL confidential communication standard.

A30: Send the communication address and the secret key to the second device 2.

In other embodiments, the step A30 includes: sending the communication address and the key seed to the second signaling server 42 corresponding to the second NAT node, and the second signaling server 42 The communication address and the secret key are sent to the second device 2.

The second device 2 in this embodiment may receive the first signaling server 41 corresponding to the first NAT node and request the communication address of the data relay server 3, which means that only the first signaling server 41 exists; The communication address and key seed of the data relay server 3 sent by the second signaling server 42 corresponding to the second NAT node means that the first signaling server 41 and the second signaling server 42 exist simultaneously.

It is to be noted that, while the first device 1 receives the communication address and key seed of the data relay server 3, the second device 2 also receives the communication address and key seed of the data relay server 3. In this way, the timeliness of information transmission is ensured, so that the establishment of subsequent data channels can be timely and fast.

A40: receiving an acquisition request of the relay address of the second device 2 sent by the first device 1, sending the acquisition request to the data relay server 3, and responding to the acquisition request by the data relay server 3, A reporting instruction of the relay address is sent to the second device 2.

Specifically, the first signaling server 41 sends the acquisition request to the second signaling server 42, and the second signaling server 42 sends the acquisition request to the data relay server 3, The data relay server 3 transmits a report request of the relay address to the second device 2 in response to the acquisition request.

A50: Receive the relay address reported by the second device 2, and feed back the received relay address to the first device 1.

In other embodiments, receiving the relay address reported by the second device includes: receiving the relay address reported by the second device 2 from the data relay server 3 or the second signaling server 42.

After the first device 1 acquires the relay address of the second device 2, the first device 1 requests the data relay server 3 to establish a data channel, and then the second device 2 completes the connection bundling with the data relay server 3, and the first device 1 and the first device 1 The data relay server 3 also completes the connection bundle, that is, the data channel is established between the first device 1 and the second device 2.

After the data channel is established, the corresponding key is generated according to the key seed and the data is transmitted by using the corresponding encryption method.

When the signaling server 4 includes the first signaling server 41 and the second signaling server 42, the first signaling server 41 can perform data transmission with the first device 1, the second device 2, and the data relay server 3, or The second device 2 performs data transmission; the second signaling server 42 can only perform data transmission with the second device 2 and the data relay server 3.

In the first signaling server 41 embodiment shown in FIG. 3, the first memory 411 as a computer storage medium stores, on the first processor 412, under different NAT nodes. The first node device of the device penetrates the program 10, and when the first node device penetration program 10 is executed by the first processor 412, the method for penetrating the devices under different NAT nodes is implemented.

Please refer to FIG. 5. FIG. 5 is a schematic diagram of a program module of the first node device penetration program 10 of FIG. In the present embodiment, the first node device penetration program 10 can be divided into one or more modules, and the modules referred to in the present application refer to a series of computer program instruction segments capable of performing specific functions. For example, in FIG. 5, the first node device penetration program 10 can be divided into a first receiving module 101, a first feedback module 102, a second feedback module 103, a second receiving module 104, and a third feedback module 105. The functions implemented by each module are substantially the same as those of the foregoing method embodiments, and are not described herein.

Please refer to FIG. 6. FIG. 6 is a schematic diagram of a first device 1 according to an embodiment of the present application.

The first device 1 includes a second memory 11 and a second processor 12.

The second memory 11 includes at least one type of readable storage medium including a flash memory, a hard disk, a multimedia card, a card type memory (for example, SD or DX memory, etc.), a magnetic memory, a magnetic disk, an optical disk, and the like. The second memory 11 may in some embodiments be an internal storage unit of the first device 1, such as a hard disk of the first device 1. The second memory 11 may also be an external storage device of the first device 1 in other embodiments, such as a plug-in hard disk equipped on the first device 1, a smart memory card (SMC), and security. Digital (Secure Digital, SD) card, flash card (Flash Card), etc. Further, the second memory 11 may also include both an internal storage unit of the first device 1 and an external storage device.

The second memory 11 can be used not only for storing application software and various types of data installed in the first device 1, such as the second node device penetration program 20, but also for temporarily storing data that has been output or is to be output.

The second processor 12 may be a central processing unit (CPU), controller, microcontroller, microprocessor or other data processing chip for running the program stored in the second memory 11 in some embodiments. Code or processing data, such as second node device penetration program 20, and the like.

Figure 6 shows only the first device 1 with the components 11-12, it will be understood by those skilled in the art that the structure shown in Figure 6 does not constitute a limitation of the first device 1, and may include fewer than the illustration Or more parts, or some parts, or different parts.

Optionally, the first device 1 may further include a user interface, the user interface may include a display, an input unit such as a keyboard, and the optional user interface may further include a standard wired interface and a wireless interface.

In some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, and an Organic Light-Emitting Diode (OLED) touch sensor. The display may also be referred to as a display screen or display unit for displaying information processed in the first device 1 and a user interface for displaying visualizations.

Optionally, the first device 1 may further include a communication unit, for example, a Wi-Fi unit, a SIM (Subscriber Identification Module) card-based mobile communication unit, and the like.

In this embodiment, the method for penetrating the devices under different NAT nodes is applicable to the first device 1 located under the first NAT node, and the first device 1 is applicable to the second device located under the second NAT node. A data channel is established between devices 2. The method includes:

B10: if there is data to be transmitted to the second device 2, send a request for acquiring the communication address of the data relay server 3 to the signaling server 4, and receive the communication address from the signaling server 4 and use for generating Preset type key.

The first device 1 requests the signaling server 4 for the communication address of the data relay server 3. The signaling server 4 feeds back the communication address and key seed of the data relay server 3 to the first device 1. At the same time, the signaling server 4 transmits the communication address and the secret key of the data relay server 3 to the second device 2.

B20: Send a resource allocation request to the data relay server 3, where the data relay server 3 allocates resources for communication between the first device 1 and the second device 2.

The data relay server 3 of this embodiment may be a TURN server supporting the RFC6062 protocol. Therefore, the first device 1 and the second device 2 specifically request resource allocation to the data relay server 3 in the manner of the RFC6062 protocol.

Further, the first device 1 and the second device 2 may request resource allocation from the data relay server 3CS through the same signaling server 4, or may forward the data to the server through the first signaling server 41 and the second signaling server 42, respectively. 3 request resource allocation.

B30: Obtain a relay address of the second device 2 from the signaling server 4, and send a data channel establishment request with the relay address to the data relay server 3, where the data channel is established. And generating a corresponding encryption key based on the secret key, and encrypting the data to be transmitted according to an encryption algorithm corresponding to the secret key, and transmitting the encrypted data to the created data channel according to the established The second device 2.

After the data channel is established, the corresponding key is generated according to the key seed, and the corresponding encryption method is used to transmit the data.

Optionally, the obtaining the relay address of the second device 2 from the signaling server 4 in step B30 includes:

The first device 1 sends an acquisition request of the relay address of the second device 2 to the signaling server 4;

The signaling server 4 sends the acquisition request to the data relay server 3, and the data relay server 3 sends a report request of the relay address to the second device 2 in response to the acquisition request;

Responding to the reporting instruction, the second device 2 reports the relay address corresponding to the second device 2 to the data relay server 3, and the data relay server 3 relays the relay reported by the second device 2 The address is fed back to the signaling server 4;

The signaling server 4 feeds back the relay address reported by the second device 2 to the first device 1.

When only the first signaling server 41 is included, the first signaling server 41 receives both the relay address acquisition request sent by the first device 1 and sends the request to the data relay server 3; and receives the data relay server 3 feedback. The relay address reported by the second device 2 is fed back to the first device 1.

In other embodiments, the signaling server 4 includes a first signaling server 41 corresponding to the first NAT node, and a second signaling server 42 corresponding to the second NAT node, in step B30. The obtaining, by the signaling server 4, the relay address of the second device 2 includes:

The first device 1 sends an acquisition request of the relay address of the second device 2 to the first signaling server 41;

The first signaling server 41 sends the acquisition request to the data relay server 3, and the data relay server 3 sends a report request of the relay address to the second device 2 in response to the acquisition request, or The first signaling server 41 sends the acquisition request to the second signaling server 42, and the second signaling server 42 sends the acquisition request to the data relay server 3, by the The data relay server 3 sends a report instruction of the relay address to the second device 2 in response to the acquisition request;

Responding to the reporting instruction, the second device 2 reports the relay address corresponding to the second device 2 to the data relay server 3, and the data relay server 3 relays the relay reported by the second device 2 The address is fed back to the first signaling server 41 or the second signaling server 42;

The first signaling server 41 feeds back the relay address reported by the second device 2 to the first device 1, or the second signaling server 42 relays the relay reported by the second device 2 The address is sent to the first signaling server 41, and the relay address reported by the second device 2 is fed back to the first device 1 by the first signaling server 41.

In the first device 1 embodiment shown in FIG. 6, the second memory 11 as a computer storage medium stores devices under different NAT nodes that can be run on the second processor 12. The second node device penetrates the program 20, and when the second node device penetration program 20 is executed by the second processor 12, the method for penetrating the devices under different NAT nodes is implemented.

Please refer to FIG. 7. FIG. 7 is a schematic diagram of a program module of the second node device penetration program 20 of FIG. In this embodiment, the second node device penetration program 20 can be divided into one or more modules, and the module referred to herein refers to a series of computer program instruction segments capable of performing a specific function. For example, in FIG. 7, the second node device penetration program 20 can be divided into a third receiving module 201, a resource allocation requesting module 202, and a data transmission module 203. The functions implemented by each module are substantially the same as those of the foregoing method embodiments, and are not described herein.

Please refer to FIG. 8. FIG. 8 is a schematic diagram of a second signaling server 42 according to an embodiment of the present application.

The second signaling server 42 includes a third memory 421 and a third processor 422.

The third memory 421 includes at least one type of readable storage medium including a flash memory, a hard disk, a multimedia card, a card type memory (eg, SD or DX memory, etc.), a magnetic memory, a magnetic disk, an optical disk, and the like. The third memory 421 may be an internal storage unit of the second signaling server 42, such as a hard disk of the second signaling server 42, in some embodiments. The third memory 421 may also be an external storage device of the second signaling server 42 in other embodiments, such as a plug-in hard disk equipped on the second signaling server 42, a smart memory card (Smart Media Card, SMC), Secure Digital (SD) card, Flash Card, etc. Further, the third memory 421 may also include both an internal storage unit of the second signaling server 42 and an external storage device.

The third memory 421 can be used not only for storing application software and various types of data installed in the second signaling server 42, such as the third node device penetration program 30, but also for temporarily storing the output that has been output or will be output. data.

The third processor 422 may be a central processing unit (CPU), controller, microcontroller, microprocessor or other data processing chip for running the program stored in the third memory 421 in some embodiments. The code or processing data, such as the third node device penetration program 30.

FIG. 8 shows only the second signaling server 42 having components 421-422. It will be understood by those skilled in the art that the structure illustrated in FIG. 8 does not constitute a limitation to the second signaling server 42, and may include ratios. Less or more components are illustrated, or some components are combined, or different component arrangements.

In this embodiment, the method for penetrating the devices under different NAT nodes is applicable to the second signaling server 42, the second signaling server 42 is corresponding to the second NAT node, and the second signaling server 42 is applicable to A data channel is established between the first device 1 under the first NAT node and the second device 2 under the second NAT node. The method includes:

C10: receiving a communication address of the data relay server 3 sent by the first signaling server 41 corresponding to the first NAT node, and a secret key for generating a preset type secret key, and the communication address and the The secret key seed is sent to the second device 2.

The first device 1 requests the first signaling server 41 corresponding to the first NAT node to request the communication address of the data relay server 3. The first signaling server 41 feeds back the communication address and key seed of the data relay server 3 to the first device 1. At the same time, the first signaling server 41 sends the communication address and the secret key of the data relay server 3 to the second signaling server 42 to transmit the communication address and the secret key of the data relay server 3 to the second device 2.

C20: receiving, from the first signaling server 41, an acquisition request of the relay address of the second device 2 sent by the first device 1, and sending the acquisition request to the data relay server 3, by the The data relay server 3 transmits a report request of the relay address to the second device 2 in response to the acquisition request.

C30: receiving, from the data relay server 3, the relay address reported by the second device 2, and transmitting the relay address reported by the second device 2 to the first signaling server 41, and by the A signaling server 41 feeds back the relay address reported by the second device 2 to the first device 1.

The first device 1 sends an acquisition request of the relay address of the second device 2 to the first signaling server 41, and the first signaling server 41 sends the acquisition request to the second signaling. The server 42 sends the acquisition request to the data relay server 3 by the second signaling server 42, and the data relay server 3 sends a relay address to the second device 2 in response to the acquisition request. Evaluating the instruction, or the first signaling server 41 sends the acquisition request to the data relay server 3, and the data relay server 3 sends a relay address to the second device 2 in response to the acquisition request. Report the instructions.

Responding to the reporting instruction, the second device 2 reports the relay address corresponding to the second device 2 to the data relay server 3, and the data relay server 3 relays the relay reported by the second device 2 The address is fed back to the first signaling server 41 or the second signaling server 42; the first signaling server 41 feeds back the relay address reported by the second device 2 to the first device 1, or The second signaling server 42 sends the relay address reported by the second device 2 to the first signaling server 41, and reports the second device 2 by the first signaling server 41. The relay address is fed back to the first device 1.

In the second signaling server 42 embodiment shown in FIG. 8, a third node device 421 that is operable on the third processor 422 is stored on the third memory 421 as a computer storage medium. The program 30, when the second power saving device penetration program 30 is executed by the third processor 422, implements the above-mentioned method for penetrating devices under different NAT nodes.

Please refer to FIG. 9. FIG. 9 is a schematic diagram of a program module of the third node device penetration program 30 of FIG. In this embodiment, the third node device penetration program 30 can be divided into one or more modules, and the modules referred to in the present application refer to a series of computer program instruction segments capable of performing specific functions. For example, in FIG. 9, the third node device penetration program 30 may be divided into a first relay module 301, a second relay module 302, and a third relay module 303. The functions implemented by each module are substantially the same as those of the foregoing method embodiments, and are not described herein.

Referring to FIG. 10, FIG. 10 is a schematic diagram of a data relay server 3 according to an embodiment of the present application.

The data relay server 3 includes a fourth memory 31 and a fourth processor 32.

The fourth memory 31 includes at least one type of readable storage medium including a flash memory, a hard disk, a multimedia card, a card type memory (for example, an SD or DX memory, etc.), a magnetic memory, a magnetic disk, an optical disk, and the like. The fourth memory 31 may be an internal storage unit of the data relay server 3, such as a hard disk of the data relay server 3, in some embodiments. The fourth memory 31 may also be an external storage device of the data relay server 3 in other embodiments, such as a plug-in hard disk equipped on the data relay server 3, a smart memory card (SMC), and security. Digital (Secure Digital, SD) card, flash card (Flash Card), etc. Further, the fourth memory 31 may also include both an internal storage unit of the data relay server 3 and an external storage device.

The fourth memory 31 can be used not only for storing application software and various types of data installed in the data relay server 3, such as the fourth node device penetration program 30, but also for temporarily storing data that has been output or is to be output.

The fourth processor 32, in some embodiments, may be a central processing unit (CPU), controller, microcontroller, microprocessor or other data processing chip for operating the memory stored in the fourth memory 31. Program code or processing data, such as fourth node device penetration program 30, and the like.

FIG. 10 shows only the data relay server 3 having the components 31-32. It will be understood by those skilled in the art that the structure shown in FIG. 10 does not constitute a limitation of the data relay server 3, and may include less than the illustration. Or more parts, or some parts, or different parts.

In this embodiment, the method for penetrating the devices under different NAT nodes is applicable to the transit server, and the transit server is applicable to the first device 1 under the first NAT node and the second device under the second NAT node. Establish a data channel between 2. The method includes:

D10: Receive and respond to a resource allocation request sent by the first device 1 and the second device 2, and allocate resources for communication between the first device 1 and the second device 2.

Further, the first device 1 and the second device 2 can request resource allocation from the data relay server 3 through the first signaling server 41 and the second signaling server 42, respectively.

D20: receiving, from the first signaling server 41 or the second signaling server 42, a response request of a relay address of the second device 2, and sending a reporting instruction of the relay address to the second device 2 Receiving, by the second device 2, the relay address corresponding to the second device 2, and reporting the relay address reported by the second device 2 to the first signaling server 41 or the second signaling Server 42.

D30: receiving and responding to the establishment request of the data channel with the relay address of the second device 2 sent by the first device 1, according to the received relay address of the second device 2, in the A data channel is established between a device 1 and the second device 2, for the first device 1 to transmit data to the second device 2 based on the established data channel.

After the first device 1 acquires the relay address of the second device 2, the first device 1 requests the data relay server 3 to establish a data channel, and then the second device 2 completes the connection bundling with the data relay server 3, and the first device 1 and the first device 1 The data relay server 3 also completes the connection bundle, that is, the data channel is established between the first device 1 and the second device 2. After the data channel is established, the corresponding key is generated according to the key seed, and the corresponding encryption method is used to transmit the data.

In the embodiment of the data relay server 3 shown in FIG. 10, a fourth node device penetration program 40 executable on the fourth processor 32 is stored on the fourth memory 31 as a computer storage medium. When the fourth node device penetration program 40 is executed by the fourth processor 32, the method for penetrating the devices under different NAT nodes is implemented.

Please refer to FIG. 11. FIG. 11 is a schematic diagram of a program module of the fourth node device penetration program 40 of FIG. In this embodiment, the fourth node device penetration program 40 can be divided into one or more modules, and the modules referred to in the present application refer to a series of computer program instruction segments capable of performing specific functions. For example, in FIG. 11, the fourth node device penetration program 40 can be divided into a resource allocation module 401, a fourth relay module 402, and a channel establishment module 403. The functions implemented by each module are substantially the same as those of the foregoing method embodiments, and are not described herein.

The embodiment of the present application further provides a computer readable storage medium, where the computer readable storage medium stores a first/second/third/fourth node device penetration program, the first/second/third The fourth node device penetration procedure can be performed by at least one processor to cause the at least one processor to perform a penetration method of devices under different NAT nodes in any of the above embodiments.

Referring to FIG. 12 and FIG. 13 , FIG. 12 is a schematic flowchart of a method for penetrating a device under different NAT nodes according to an embodiment of the present disclosure, and FIG. 13 is a schematic diagram of a network architecture corresponding to the penetrating method illustrated in FIG. 12 . .

In this embodiment, the method for penetrating the device under different NAT nodes is applicable to establishing a data channel between the first device 1 under the first NAT node and the second device 2 located under the second NAT node, and Data interaction based on established data channels.

NAT can be used when some hosts inside the private network have already been assigned a local IP address (that is, a private address only used in the private network), but now want to communicate with the host on the Internet (and do not need to encrypt) method.

This method requires the installation of NAT software on a router that has a private network connected to the Internet. A router with NAT software is called a NAT router and it has at least one valid external global IP address. In this way, all hosts using local addresses must convert their local addresses to global IP addresses on the NAT router when communicating with the outside world to connect to the Internet.

As shown in FIG. 12 and FIG. 13, the penetration method of this embodiment includes the following steps:

Step S10: If the first device 1 needs to transmit data to the second device 2, the first device 1 sends a request for acquiring the communication address of the data relay server 3 to the signaling server 4.

The first device 1 in this embodiment acquires the communication address of the data relay server 3 from the signaling server through the HTTPS (Hyper Text Transfer Protocol over Secure Socket Layer) protocol. It can be understood that the first device 1 can also obtain the communication address of the data relay server 3 from the signaling server through other protocols, such as the HTTP protocol.

Step S20: the signaling server receives and responds to the request, and feeds back to the first device 1 the communication address and a secret key used to generate a preset type secret key, and the communication address and the secret The key seed is sent to the second device 2.

Optionally, the signaling server 4 includes a first signaling server 41 corresponding to the first NAT node, and a second signaling server 42 corresponding to the second NAT node, where the step S20 includes:

Receiving and responding to the request, the first signaling server 41 feeds back the communication address and a key seed for generating a preset type key to the first device 1;

The first signaling server 41 sends the communication address and the secret key to the second device 2, or the first signaling server 41 sends the communication address and the key seed The second signaling server 42 is sent to the second device 2 by the second signaling server 42 to send the communication address and the secret key.

The first device 1 in this embodiment requests the first signaling server 41 corresponding to the first NAT node to request the communication address of the data relay server 3, and further receives the communication address of the data relay server 3 returned by the first signaling server 41. And key seed.

For example, only one of the AES key seed, DES key seed, or RSA key seed may be employed. That is to say, only one of the encryption methods of AES, DES or RSA is adopted. Two or three key seeds of the AES key seed, the DES key seed, or the RSA key seed may also be employed. That is to say, the encryption method using two or three combinations of AES, DES or RSA.

Step S30: The first device 1 and the second device 2 send a resource allocation request to the data relay server 3, where the data relay server 3 is the first device 1 and the second device 2 Communication allocates resources.

Step S40: The first device 1 acquires a relay address of the second device 2 from the signaling server 4, and sends a data channel establishment request with the relay address to the data relay server 3, where After the data channel is established, the corresponding encryption key is generated based on the secret key, and the data to be transmitted is encrypted according to an encryption algorithm corresponding to the key seed, and the encrypted data is established based on the established The data channel is transmitted to the second device 2.

After the data channel is established, the corresponding key is generated according to the key seed, and the corresponding encryption method is used to transmit the data. It should be understood that which key seed is obtained in the foregoing step S20, and which encryption method is used in this step for data transmission. For example, if the AES key seed is obtained in step S20, this step generates an AES key and transmits the data using AES encryption.

Optionally, the first device 1 in step S40 acquires the relay address of the second device 2 from the signaling server 4, including:

In other embodiments, the signaling server 4 includes a first signaling server 41 corresponding to the first NAT node, and a second signaling server 42 corresponding to the second NAT node, in step S40. The acquiring, by the first device 1, the relay address of the second device 2 from the signaling server 4 includes:

Therefore, the present application can solve the problem of reliable data transmission and private data transmission, and further establish a transmission channel at a very high speed.

The above description is only the embodiment of the present application, and thus does not limit the scope of the patent application, and the equivalent structure or equivalent process transformation made by using the specification and the drawings of the present application, or directly or indirectly applied to other related technologies. The fields are all included in the scope of patent protection of this application.

Claims

a first signaling server, the first signaling server corresponding to the first NAT node, the first signaling server being applicable to the first device under the first NAT node and the second device under the second NAT node Establishing a data channel, wherein the first signaling server includes a first memory and a first processor, wherein the first memory stores a first node device operable on the first processor Through the program, when the first node device penetration program is executed by the first processor:

Detecting and receiving a request for acquiring a communication address of the data relay server sent by the first device;

After receiving the request, responding to the request, feeding back the communication address and a key seed for generating a preset type key to the first device;

Transmitting the communication address and the secret key to the second device;

Receiving the acquisition request of the second device relay address sent by the first device, sending the acquisition request to the data relay server, and responding to the acquisition request by the data relay server to the second device Sending a report of the relay address; and

Receiving a relay address reported by the second device, and feeding back the received relay address to the first device.
The first signaling server according to claim 1, wherein the second NAT node corresponds to a second signaling server, wherein the transmitting the communication address and the secret key to the second device ,include:

Transmitting the communication address and the secret key to the second signaling server, and sending, by the second signaling server, the communication address and the secret key to the second device.
The first signaling server according to claim 2, wherein the receiving the acquisition request of the second device relay address sent by the first device, and sending the acquisition request to the data relay The server, in response to the obtaining request by the data relay server, sends a reporting instruction of the relay address to the second device, including:

Sending, by the first signaling server, the acquisition request to the second signaling server, and sending, by the second signaling server, the acquisition request to the data relay server, and the data relay server is ringing A request should be obtained to send a reporting instruction of the relay address to the second device.
The first signaling server according to claim 3, wherein the receiving the relay address reported by the second device comprises:

Receiving, by the data relay server or the second signaling server, a relay address reported by the second device, where the relay address reported by the second device is fed back to the first by the data relay server Signaling server or second signaling server.
A method for penetrating a device under different NAT nodes, the penetrating method is applicable to a first signaling server, the first signaling server is corresponding to a first NAT node, and the first signaling server is applicable to the first A data channel is established between the first device of the NAT node and the second device of the second NAT node, where the method includes:

Detecting and receiving a request for acquiring a communication address of the data relay server sent by the first device;

After receiving the request, responding to the request, feeding back the communication address and a key seed for generating a preset type key to the first device;

Transmitting the communication address and the secret key to the second device;

Receiving the acquisition request of the second device relay address sent by the first device, sending the acquisition request to the data relay server, and responding to the acquisition request by the data relay server to the second device Sending a report of the relay address; and

Receiving a relay address reported by the second device, and feeding back the received relay address to the first device.
The penetration method according to claim 5, wherein the second NAT node corresponds to the second signaling server, wherein the transmitting the communication address and the secret key to the second device comprises :

Transmitting the communication address and the secret key to the second signaling server, and sending, by the second signaling server, the communication address and the secret key to the second device.
The penetration method according to claim 6, wherein the receiving the acquisition request of the second device relay address sent by the first device, and sending the acquisition request to the data relay server, Responding to the obtaining request by the data relay server, sending a reporting instruction of the relay address to the second device, including:

Sending, by the first signaling server, the acquisition request to the second signaling server, and sending, by the second signaling server, the acquisition request to the data relay server, and the data relay server is ringing A request should be obtained to send a reporting instruction of the relay address to the second device.
The method of claim 7, wherein the receiving the relay address reported by the second device comprises:

Receiving, by the data relay server or the second signaling server, a relay address reported by the second device, where the relay address reported by the second device is fed back to the first by the data relay server Signaling server or second signaling server.
A computer readable storage medium, wherein the computer readable storage medium stores a first node device penetration program, the first node device penetration program executable by at least one processor to cause the At least one processor performs a method of penetrating a device under different NAT nodes as claimed in any one of claims 5 to 8.
A first device, the first device corresponding to the first NAT node, the first device being adapted to establish a data channel between the second device and the second device located under the second NAT node, wherein the first device comprises a second memory and a second processor, the second memory storing a second node device penetration program operable on the second processor, the second node device penetration program being the second When the processor executes:

And if there is data to be transmitted to the second device, sending a request for acquiring a communication address of the data relay server to the signaling server, and receiving the communication address from the signaling server and generating a preset type key;

Sending a resource allocation request to the data relay server, where the data relay server allocates resources for communication between the first device and the second device;

Obtaining, by the signaling server, a relay address of the second device, and sending, to the data relay server, a request for establishing a data channel with the relay address, after the data channel is established, based on the Generating a corresponding encryption key, and encrypting the data to be transmitted according to an encryption algorithm corresponding to the key seed, and transmitting the encrypted data to the second device based on the established data channel .
The first device according to claim 10, wherein the obtaining the relay address of the second device from the signaling server comprises:

Sending, by the first device, an acquisition request of the second device relay address to the signaling server;

The signaling server sends the acquisition request to the data relay server, and the data relay server sends a report request of the relay address to the second device in response to the acquisition request;

Responding to the reporting instruction, the second device reports the relay address corresponding to the second device to the data relay server, and the data relay server feeds back the relay address reported by the second device to the Signaling server; and

The signaling server feeds back the relay address reported by the second device to the first device.
The first device according to claim 11, wherein the signaling server comprises a first signaling server corresponding to the first NAT node, and a second signaling corresponding to the second NAT node The server, the obtaining, by the signaling server, a relay address of the second device, including:

Sending, by the first device, an acquisition request of the second device relay address to the first signaling server;

Sending, by the first signaling server, the acquisition request to the data relay server, and sending, by the data relay server, the reporting request of the relay address to the second device, or the first The signaling server sends the acquisition request to the second signaling server, and the second signaling server sends the acquisition request to the data relay server, and the data relay server responds to the acquisition request, Sending a reporting instruction of the relay address to the second device;

Responding to the reporting instruction, the second device reports the relay address corresponding to the second device to the data relay server, and the data relay server feeds back the relay address reported by the second device to the a first signaling server or a second signaling server; and

The first signaling server feeds back the relay address reported by the second device to the first device, or the second signaling server sends the relay address reported by the second device to the a first signaling server, and the relaying address reported by the second device is fed back to the first device by the first signaling server.
A method for penetrating a device under different NAT nodes, the method being applicable to a first device, the first device corresponding to a first NAT node, the first device being applicable to a second device located under the second NAT node A data channel is established between the devices, and the method includes:

And if there is data to be transmitted to the second device, sending a request for acquiring a communication address of the data relay server to the signaling server, and receiving the communication address from the signaling server and generating a preset type key;

Sending a resource allocation request to the data relay server, where the data relay server allocates resources for communication between the first device and the second device;

Obtaining, by the signaling server, a relay address of the second device, and sending, to the data relay server, a request for establishing a data channel with the relay address, after the data channel is established, based on the Generating a corresponding encryption key, and encrypting the data to be transmitted according to an encryption algorithm corresponding to the key seed, and transmitting the encrypted data to the second device based on the established data channel .
The method of claim 13, wherein the obtaining the relay address of the second device from the signaling server comprises:

Sending, by the first device, an acquisition request of the second device relay address to the signaling server;

The signaling server sends the acquisition request to the data relay server, and the data relay server sends a report request of the relay address to the second device in response to the acquisition request;

Responding to the reporting instruction, the second device reports the relay address corresponding to the second device to the data relay server, and the data relay server feeds back the relay address reported by the second device to the Signaling server; and

The signaling server feeds back the relay address reported by the second device to the first device.
The penetration method according to claim 14, wherein the signaling server comprises a first signaling server corresponding to the first NAT node, and a second signaling corresponding to the second NAT node The server, the obtaining, by the signaling server, a relay address of the second device, including:

Sending, by the first device, an acquisition request of the second device relay address to the first signaling server;

Sending, by the first signaling server, the acquisition request to the data relay server, and sending, by the data relay server, the reporting request of the relay address to the second device, or the first The signaling server sends the acquisition request to the second signaling server, and the second signaling server sends the acquisition request to the data relay server, and the data relay server responds to the acquisition request, Sending a reporting instruction of the relay address to the second device;

Responding to the reporting instruction, the second device reports the relay address corresponding to the second device to the data relay server, and the data relay server feeds back the relay address reported by the second device to the a first signaling server or a second signaling server; and

The first signaling server feeds back the relay address reported by the second device to the first device, or the second signaling server sends the relay address reported by the second device to the a first signaling server, and the relaying address reported by the second device is fed back to the first device by the first signaling server.
A computer readable storage medium, wherein the computer readable storage medium stores a second node device penetration program, the second node device penetration program executable by at least one processor to cause the At least one processor performs a method of penetrating devices under different NAT nodes as claimed in any one of claims 13-15.
A method for penetrating a device under different NAT nodes, the penetration method being applicable to a first device under the first NAT node of the penetration system of the device under different NAT nodes and a second device under the second NAT node A data channel is established between the two devices, and data interaction is performed based on the established data channel. The penetration system further includes a data relay server and a signaling server, wherein the penetration method comprises:

Sending, by the first device, a request for obtaining a communication address of the data relay server to the signaling server if the data needs to be transmitted to the second device;

Receiving and responding to the request, the signaling server feeds back the communication address and a secret key for generating a preset type key to the first device, and sends the communication address and the key seed to The second device;

The first device and the second device send a resource allocation request to the data relay server, where the data relay server allocates resources for communication between the first device and the second device;

The first device acquires a relay address of the second device from the signaling server, and sends a data channel establishment request with the relay address to the data relay server, after the data channel is established Generating a corresponding encryption key based on the secret key seed, and encrypting the data to be transmitted according to an encryption algorithm corresponding to the secret key seed, and transmitting the encrypted data to the data channel based on the established data channel Said second device.
The penetration method according to claim 17, wherein the signaling server comprises a first signaling server corresponding to the first NAT node, and a second signaling corresponding to the second NAT node a server, the signaling server receiving and responding to the request, feeding back the communication address and a key seed for generating a preset type key to the first device, and the seed address and the key seed Sending to the second device, including:

Receiving and responding to the request, the first signaling server feeds back the communication address and a key seed for generating a preset type key to the first device; and

Transmitting, by the first signaling server, the communication address and the secret key to the second device, or sending, by the first signaling server, the communication address and the secret key to the a second signaling server, and the second signaling server sends the communication address and the secret key to the second device.
The method of claim 18, wherein the acquiring, by the first device, the relay address of the second device from the signaling server comprises:

Sending, by the first device, an acquisition request of the second device relay address to the signaling server;

The signaling server sends the acquisition request to the data relay server, and the data relay server sends a report request of the relay address to the second device in response to the acquisition request;

Responding to the reporting instruction, the second device reports the relay address corresponding to the second device to the data relay server, and the data relay server feeds back the relay address reported by the second device to the Signaling server; and

The signaling server feeds back the relay address reported by the second device to the first device.
The method of claim 19, wherein the acquiring, by the first device, the relay address of the second device from the signaling server comprises:

Sending, by the first device, an acquisition request of the second device relay address to the first signaling server;

Sending, by the first signaling server, the acquisition request to the data relay server, and sending, by the data relay server, the reporting request of the relay address to the second device, or the first The signaling server sends the acquisition request to the second signaling server, and the second signaling server sends the acquisition request to the data relay server, and the data relay server responds to the acquisition request, Sending a reporting instruction of the relay address to the second device;

Responding to the reporting instruction, the second device reports the relay address corresponding to the second device to the data relay server, and the data relay server feeds back the relay address reported by the second device to the a first signaling server or a second signaling server; and

The first signaling server feeds back the relay address reported by the second device to the first device, or the second signaling server sends the relay address reported by the second device to the a first signaling server, and the relaying address reported by the second device is fed back to the first device by the first signaling server.