WO2024027598A1 - 一种数据传输方法、装置、存储介质及电子设备 - Google Patents

一种数据传输方法、装置、存储介质及电子设备 Download PDF

Info

Publication number
WO2024027598A1
WO2024027598A1 PCT/CN2023/109887 CN2023109887W WO2024027598A1 WO 2024027598 A1 WO2024027598 A1 WO 2024027598A1 CN 2023109887 W CN2023109887 W CN 2023109887W WO 2024027598 A1 WO2024027598 A1 WO 2024027598A1
Authority
WO
WIPO (PCT)
Prior art keywords
session
state information
client
session state
connection request
Prior art date
Application number
PCT/CN2023/109887
Other languages
English (en)
French (fr)
Inventor
张成龙
杨洋
Original Assignee
支付宝(杭州)信息技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 支付宝(杭州)信息技术有限公司 filed Critical 支付宝(杭州)信息技术有限公司
Publication of WO2024027598A1 publication Critical patent/WO2024027598A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H04L67/141—Setup of application sessions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H04L67/143—Termination or inactivation of sessions, e.g. event-controlled end of session
    • H04L67/145—Termination or inactivation of sessions, e.g. event-controlled end of session avoiding end of session, e.g. keep-alive, heartbeats, resumption message or wake-up for inactive or interrupted session

Definitions

  • This specification relates to the field of communication technology, and in particular, to a data transmission method, device, storage medium and electronic equipment.
  • the server can create a session (that is, the process of communication between the client and the server).
  • the server can save the created session.
  • the server can reuse the saved session to continue communicating with the client (that is, there is no need to re-handshake).
  • the server often communicates with a large number of clients concurrently, which results in the sessions saved by the server with different clients occupying a large amount of the server's memory. This requires more stringent requirements on the server's memory, and, If the memory usage is too high, it may cause abnormal operation of the server or even leak private data.
  • This specification provides a data transmission method, device, storage medium and electronic device to solve the problem in related technologies that the sessions stored in the server occupy a high content.
  • This specification adopts the following technical solution:
  • This specification provides a data transmission method.
  • the method is applied to the server and includes: responding to a connection request sent by the client, determining whether the connection request carries session state information.
  • the session state information includes the parameters based on which the server and the client perform data transmission through the created session, as well as the session identifier; if so, restore communication with the client based on the session state information carried in the connection request. session between clients, and perform data transmission with the client through the restored session; if not, create a session with the client, and send the session state information generated for the created session to the client so that the client can save.
  • sending the session state information generated for the created session to the client specifically includes: encrypting the session state information generated for the created session using predetermined encryption keys. , obtain the encrypted session state information; and send the encrypted session state information to the client.
  • each encryption key specifically including: obtaining the initial key and N key parameters, where N is a positive integer; and generating the N-th encryption key and Nth key parameter based on the obtained N encryption keys, where the first encryption key is generated by the initial key and the first key parameter.
  • the session state information generated for the created session is encrypted using each predetermined encryption key to obtain the encrypted session state information, which specifically includes: encrypting the session state information according to each encryption key.
  • each encryption key is used to encrypt the session state information in turn to obtain the encrypted session state information; wherein, for each encryption key, the previous encryption key is encrypted with the encryption key to obtain The session state information is encrypted to obtain the session state information encrypted by the encryption key.
  • use the encryption key to encrypt the session state information obtained after encrypting the previous encryption key to obtain the session state information encrypted with the encryption key which specifically includes: using the encryption key to encrypt the session state information.
  • the session state information obtained after encryption with an encryption key is encrypted to obtain basic encrypted session state information; the basic encrypted session state information is replaced by at least one preset replacement method to obtain the session state information encrypted by the encryption key.
  • session state information, and the permutation method includes: at least one of nonlinear permutation, linear permutation, and reverse order permutation.
  • resuming the session with the client based on the session state information carried in the connection request specifically includes: checking the session state carried in the connection request according to a preset integrity check algorithm. The information is verified for integrity; if it is determined that the session state information is complete, the session with the client is restored based on the session state information.
  • resuming the session with the client specifically includes: determining each decryption key corresponding to the session state information according to the key identifier carried in the session state information; key, decrypt the session state information to obtain decrypted session state information; and restore the session with the client based on the decrypted session state information.
  • This specification provides a data transmission method.
  • the method is applied to a client and includes: the client determines a target server, and the target server is used to transmit data with the client; and determines whether the client locally saves Session state information based on the session with the target server; if so, send a connection request carrying the session state information to the target server, so that the target server can resume communication with the target server based on the session state information. session between the clients, and perform data transmission through the restored session; if not, send a connection request to the target server, so that the target server creates a connection with the client based on the connection request. session.
  • This specification provides a data transmission device, including: a judgment module, used to respond to the connection sent by the client. Receive the request and determine whether the connection request carries session state information.
  • the session state information includes the parameters based on the data transmission between the server and the client through the created session, and the session identifier; the recovery module, When it is determined that the connection request carries session state information, restore the session with the client according to the session state information carried in the connection request, and use the restored session to communicate with the client.
  • This specification provides a data transmission device, including: a determination module, used to determine a target server, the target server is used to transmit data with the client; a judgment and execution module, used to judge whether the client is local
  • the session state information based on the session with the target server is saved; if so, a connection request carrying the session state information is sent to the target server, so that the target server restores the session state information based on the session state information. session with the client, and perform data transmission through the restored session; if not, send a connection request to the target server, so that the target server creates a connection with the client based on the connection request. conversations between.
  • This specification provides a computer-readable storage medium.
  • the storage medium stores a computer program.
  • the computer program is executed by a processor, the above-mentioned data transmission method is implemented.
  • This specification provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor.
  • the processor executes the program, the above data transmission method is implemented.
  • connection request in response to the connection request sent by the client, it is determined whether the connection request carries session state information, and the session state information includes the server Parameters based on data transmission through the created session with the client, and the session identifier. If so, the session with the client is restored based on the session state information carried in the connection request, and through the restored session, with the client Perform data transmission, if not, create a session with the client, and send the session state information generated for the created session to the client so that the client can save it.
  • the server can send the session state information of the session with the client to the client for storage, so that when the client needs to use the session again, the session state information can be carried in the connection request and sent to
  • the server can resume the session with the client based on the connection request sent by the client that carries session status information, thereby reducing the server memory occupied by the sessions saved by the server with each client.
  • Figure 1 is a schematic flow chart of a data transmission method provided in this specification
  • FIG. 2 is a schematic flow chart of another data transmission method provided in this specification.
  • FIG. 3 is a schematic diagram of a data transmission device provided in this specification.
  • FIG. 4 is a schematic diagram of another data transmission device provided in this specification.
  • FIG. 5 is a schematic diagram of an electronic device corresponding to FIG. 1 provided in this specification.
  • the server when the client and the server establish a connection through the handshake protocol, the server will create a session with the client and send the session's unique identification information Session ID to the client, and then data can be transmitted with the client through the session.
  • the server can save the session state with the client, so that the client does not need to re-establish the connection through the handshake protocol the next time it needs to transmit data, but can instead establish a connection based on the data saved in the client.
  • Session ID directly restores the session and performs data transfer.
  • server cluster that is, when a single server is used, the performance of a single server cannot be increased infinitely due to its own hardware resources and other conditions. Therefore, in order to improve the performance of the server, With further expansion, multiple servers can be used to provide services together, that is, server clusters are used to provide services).
  • the server that the client accesses each time may not be the same, which results in the new server not being able to respond to the client's request.
  • the Session ID saved in the client is used to restore the session between the client and the previous server, resulting in Session reuse cannot be well implemented based on Session ID in a server cluster.
  • FIG. 1 is a schematic flowchart of a software management method provided in this specification, including the following steps S100 to S104.
  • connection request In response to the connection request sent by the client, determine whether the connection request carries session state information.
  • the session state information includes parameters based on data transmission between the server and the client through the created session. , and the session identifier. If yes, execute step S102; if not, execute step S104.
  • the server can respond to the connection request sent by the client and determine whether the received connection request carries session state information. If so, restore the connection request based on the session state information.
  • the session with the client, and through the restored session, data transmission with the client if not, create a session with the client, and through the created session, data transmission with the client, where, session The status information contains parameters based on the data transmission between the server and the client through the session, such as: the version of the encryption protocol negotiated by the client and the server, the cipher suite cipher used for data communication negotiated by the client and the server, the client The key master_key used for data communication negotiated with the server, the time timestamp at which session state information can be reused, etc., as well as the session ID of the session.
  • S102 According to the session state information carried in the connection request, restore the session with the client, and perform data transmission with the client through the restored session.
  • the server determines that the connection request sent by the client carries session state information, it can restore the session between the server and the client based on the session state information carried in the connection request sent by the client, and communicate with the client through the restored session. end for data transmission.
  • the server can use a preset integrity check algorithm to check the encrypted session state information before sending the session state information to the client for storage.
  • Integrity encryption in which the preset integrity check algorithm can be such as: Hash Message Authentication Code (HMAC), message digest algorithm (SM3), etc.
  • HMAC Hash Message Authentication Code
  • SM3 message digest algorithm
  • the server needs to be based on The session state information carried in the client needs to be integrity checked before resuming the session with the client.
  • the following uses the HMAC algorithm as an example to verify the integrity of the session state information by the server. The process is explained in detail.
  • the server can determine the HMAC key corresponding to the session state information from the preset configuration file based on the identifier of the session state information. And use the HMAC key to calculate the key identifier key-name and initialization vector iv in the session state information, as well as the HMAC value corresponding to the encrypted session state information, and use the calculated key identifier key-name and initialization vector iv , and the HMAC value corresponding to the encrypted session state information is compared with the MAC value carried in the session state information. If they are consistent, it can be determined that the session state information is complete.
  • the key identifier key-name in the above content is the identifier corresponding to a set of keys used when encrypting session state information
  • the initialization vector iv is the initialization vector used when further encrypting session state data, that is, After the server encrypts the session state information, it can save the key identifier corresponding to the key used in the encryption process and the initialization vector used in the encryption process to the session state information
  • the encryption here is Refers to the above content including the version of the encryption protocol negotiated by the client and the server, the cipher suite cipher negotiated by the client and server for data communication, and the key used for data communication negotiated by the client and server.
  • the master_key, the time timestamp at which the session state information can be reused, and the session state information such as the Session ID of the session are encrypted.
  • the server determines the above key identifier key-name, initialization vector iv, and encryption. After ensuring the integrity of the session state information, the encrypted session state information can be decrypted according to the above-mentioned key identifier key-name and initialization vector iv).
  • the server can determine each decryption key corresponding to the session state information based on the key identifier carried in the session state information, and pass Each decryption key decrypts the session state information to obtain the decrypted session state information, and restores the session with the client based on the decrypted session state information.
  • the server can determine the time timestamp at which the session state information carried in the decrypted session state information can be reused, and determine the time of the last session with the client, and communicate with the client. The time interval between when the client sends a connection request again, whether it exceeds the time timestamp when the session state information can be reused. If not, the session with the client is restored. If so, the server needs to go through the preset handshake again. protocol to connect with the client.
  • S104 Create a session with the client, and send the session state information generated for the created session to the client so that the client can save it.
  • the server determines that the connection request sent by the client does not carry session state information, it can receive the connection request sent by the client, and in response to the received connection request, authenticate each other with the client according to the preset handshake protocol. , and negotiate with the client to determine the version of the encryption protocol used in the data transmission process. After negotiating with the client to determine the cipher suite, cipher, key master_key and other information used for data transmission, create a session with the client. .
  • the server After the server creates a session with the client, it can generate session state information for the created session and send the session state information to the client so that the client can use it when it needs to initiate a session again after the current session ends.
  • the server can encrypt the session state information through a preset encryption method and send the encrypted session state information to the client.
  • the method for the server to encrypt the session state information may be to encrypt the session state information using each predetermined encryption key, obtain the encrypted session state information, and send the encrypted session state information to the client. .
  • the server can use each encryption key to encrypt the session state information in sequence according to the predetermined order in which each encryption key encrypts the session state information, and obtains the encrypted session state information, where, for each encryption key , use the encryption key to encrypt the session state information obtained after encrypting the previous encryption key, and obtain the session state information encrypted by the encryption key.
  • the method for the server to use the encryption key to encrypt the session state information obtained after encrypting the previous encryption key may be: the server can determine the difference between the encryption key and the encryption key after encrypting the previous encryption key according to a preset calculation method.
  • the operation value of the session state information can be such as: XOR operation, AND operation, sum operation, etc.
  • the operation method used by the server is XOR operation, the above operation value is XOR operation. Operation value.
  • the server can use the calculated value of the determined encryption key and the session state information encrypted by the previous encryption key as the basic encrypted session state, and further can use at least one preset replacement method to modify the basic encrypted session state.
  • the encrypted session state information is replaced to obtain the final output session state information encrypted by the encryption key.
  • the replacement methods here include: non-linear replacement (for example: replacement with S box S box), linear replacement (for example: by left Shift operation for replacement), reverse order replacement (that is, adjusting the order of each value in the basic encrypted session state information, for example: assuming that the values before reverse order replacement are: (a1, a2, a3, a4), then The value after reverse order replacement is at least one of (a4, a3, a2, a1).
  • the method for determining each encryption key used in each round of encryption may be to obtain the initial key and N key parameters, where N is a positive integer, based on the obtained N-1th encryption key and the Nth key parameters.
  • N key parameters are used to generate the Nth encryption key.
  • the first encryption key is generated through the initial key and the first key parameter.
  • the key parameters here are a preset fixed set. parameter.
  • the method for generating the Nth key may be that the server can determine the N-1th encryption key and the Nth encryption key according to a preset operation method.
  • the operation value of the Nth key parameter, the operation method here can be such as: XOR operation, AND operation, sum operation, etc., further, through The preset replacement algorithm replaces the determined N-1th encryption key and the operation value of the Nth key parameter to obtain the Nth encryption key.
  • the server can also group the session state information that needs to be encrypted (for example: every 128 bits in the session state information is a group, that is, every 16 bytes is a group), and then target each group separately.
  • the session state information is encrypted by the above method to obtain the encrypted result of each group of session state information.
  • the encrypted session state information of this group can be compared with the previous group's encrypted session state information.
  • the encrypted session state information is calculated according to a preset algorithm (for example, XOR operation) to obtain the group of encrypted session state information and the further encrypted session state information.
  • the first group of encrypted session information is obtained.
  • the status information can be budgeted with the preset initial value iv to obtain the first encrypted session status information and the further encrypted session status information.
  • the server can determine a key identifier key-name corresponding to each encryption key used in the above content (the key identifier can be determined through a random number generator or other methods, or can be obtained from the configuration file), and Determine the key identification, the initial value iv used in the above content, and the final encrypted session through the predetermined HMAC key (which can be generated by a random number generator or obtained from the configuration file)
  • the initial value iv used in the content, the HMAC value of the finally encrypted session state information, and the above MAC value are sent to the client for saving, where the message verification code MAC is used to verify the session state. Integrity of information.
  • the encryption key used by the server to encrypt the session state information can be generated by the above method, or it can be obtained from a preset configuration file (the configuration file here contains multiple keys set by the developer).
  • a set of encryption keys where each set of encryption keys corresponds to a key identifier, and several servers in a server cluster can use each encryption key obtained from the same set of configuration files).
  • other servers in the same cluster as the server can also determine the corresponding decryption key from the configuration file based on the key identifier in the session state information carried in the connection request sent by the client. key, thereby decrypting the session state information through the decryption key, and restoring the session with the client, thereby enabling a session between the client and any server in the server cluster, on different servers in the server cluster of reuse.
  • the session state information of the session is encrypted through the preset encryption algorithm, and the encrypted session state information is sent to the client for storage.
  • the session status information saved in the client can be sent in the connection request.
  • the server can restore the session based on the session state information, thereby reducing the server memory occupied by the sessions saved by the server with each client, and enabling session reuse in the server cluster.
  • this specification also provides a data transmission method, as shown in Figure 2.
  • FIG. 2 is a schematic flowchart of another data transmission method provided in this specification, including the following steps S200 to S206.
  • the client determines a target server, and the target server is used for data transmission with the client.
  • step S202 Determine whether the client locally stores session state information based on the session with the target server. If yes, execute step S204. If not, execute step S206.
  • S204 Send a connection request carrying the session state information to the target server, so that the target server can resume the session with the client based on the session state information, and use the restored session, Perform data transfer.
  • S206 Send a connection request to the target server, so that the target server creates a session with the client according to the connection request.
  • the client Before sending a connection request to the server, the client can first determine the server that receives the connection request as the target server, and then determine whether the session state information based on the session with the target server is stored locally on the client. If it is determined that there is no session state information, , you can send a connection request to the server, authenticate with the server according to the preset handshake protocol, negotiate with the server to determine the version of the encryption protocol used in the data transmission process, and negotiate with the client to determine the version used for data transmission. After receiving the cipher suite cipher, key master_key and other information, it responds to the session created by the server with the client, transmits data with the server, receives the session status information sent by the server, and saves it.
  • the client determines that the session state information based on the session with the target server is stored locally, the client can obtain the session state information locally, and then send a connection request carrying the session state information to the server, so that the server can The connection request for the session state information is used to restore the session with the client, and data is transmitted with the server through the session restored by the server with the client.
  • the client since the session state information stored in the client is encrypted by the server, the client can only save the session state information, but cannot read the specific content of the session state information, nor can it Session state information is modified.
  • the client can save the encrypted session state information sent by the server, and when sending a connection request to the server again, carry the session state information in the connection request and send it to the server, thus achieving Reuse of sessions, thus reducing the impact of sessions saved by the server with each client on the server Storage occupation.
  • Figure 3 is a schematic diagram of a data transmission device provided in this specification, including: a determination module 301, configured to respond to a connection request sent by a client and determine whether the connection request carries session state information.
  • the session state information includes the parameters based on which the server and the client perform data transmission through the created session, as well as the session identifier;
  • the recovery module 302 is configured to, when it is determined that the connection request carries session status information, The session state information carried in the request is used to restore the session with the client, and data is transmitted with the client through the restored session;
  • the creation module 303 is used to determine that the connection request does not carry When receiving the session state information, create a session with the client, and send the session state information generated for the created session to the client, so that the client can save it.
  • the creation module 303 is specifically configured to encrypt the session state information generated for the created session through each predetermined encryption key to obtain encrypted session state information; Session state information is sent to the client.
  • the creation module 303 is specifically configured to obtain the initial key and N key parameters, where N is a positive integer; and generate the N-1th encryption key and Nth key parameter based on the obtained N encryption keys, where the first encryption key is generated by the initial key and the first key parameter.
  • the creation module 303 is specifically configured to encrypt the session state information using each encryption key in sequence according to the order in which each encryption key encrypts the session state information, to obtain encrypted session state information; For each encryption key, the session state information obtained after encrypting the previous encryption key is encrypted using the encryption key to obtain the session state information encrypted by the encryption key.
  • the creation module 303 is specifically configured to use the encryption key to encrypt the session state information obtained after encrypting the previous encryption key to obtain basic encrypted session state information; through at least one preset replacement Method: perform replacement on the basic encrypted session state information to obtain session state information encrypted by the encryption key, and the replacement method includes at least one of: nonlinear replacement, linear replacement, and reverse order replacement.
  • the recovery module 302 is specifically configured to perform integrity verification on the session state information carried in the connection request according to a preset integrity verification algorithm; if it is determined that the session state information is complete, verify the session state information according to The session state information is used to restore the session with the client.
  • the recovery module 302 is specifically configured to determine each decryption key corresponding to the session state information according to the key identifier carried in the session state information; use the each decryption key to determine the decryption key for the session state information.
  • the session state information is decrypted to obtain the decrypted session state information; based on the decrypted session state information, the relationship with the session state information is restored. Sessions between clients.
  • Figure 4 is a schematic diagram of another data transmission device provided in this specification, including: a determination module 401, used to determine a target server, the target server is used to transmit data with the client; a judgment and execution module 402, used to To determine whether the client locally stores session state information based on the session with the target server; if so, send a connection request carrying the session state information to the target server, so that the target server According to the session status information, restore the session with the client, and perform data transmission through the restored session; if not, send a connection request to the target server so that the target server can Request to create a session with said client.
  • a determination module 401 used to determine a target server, the target server is used to transmit data with the client
  • a judgment and execution module 402 used to To determine whether the client locally stores session state information based on the session with the target server; if so, send a connection request carrying the session state information to the target server, so that the target server According to the session status information, restore the session with the client, and perform data transmission through
  • This specification also provides a computer-readable storage medium that stores a computer program.
  • the computer program can be used to execute the data transmission method provided in Figure 1 above.
  • FIG. 5 This specification also provides a schematic structural diagram of the electronic device shown in FIG. 5 corresponding to FIG. 1 .
  • the electronic device includes a processor, internal bus, network interface, memory and non-volatile memory, and of course may also include other hardware required for business.
  • the processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to implement the data transmission method in Figure 1 above.
  • this specification does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc. That is to say, the execution subject of the following processing flow is not limited to each logical unit, and may also be hardware or logic device.
  • PLD Programmable Logic Device
  • FPGA Field Programmable Gate Array
  • HDL Hardware Description Language
  • HDL high-density circuit Hardware Description Language
  • ABEL Advanced Boolean Expression Language
  • AHDL Altera Hardware Description Language
  • Confluence CUPL
  • HDCal Component-Dielectric
  • JHDL Java Hardware Description Language
  • Lava Lava
  • Lola MyHDL
  • PALASM RHDL
  • VHDL Very-High-Speed Integrated Circuit Hardware Description Language
  • Verilog Verilog
  • the controller may be implemented in any suitable manner, for example, the controller may take the form of, for example, a microprocessor or processor and a computer readable medium storing computer readable program code (eg, software or firmware) executable by the (micro)processor. , logic gates, switches, Application Specific Integrated Circuit (ASIC), programmable logic controllers and embedded microcontrollers.
  • controllers include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, For Microchip PIC18F26K20 and Silicone Labs C8051F320, the memory controller can also be implemented as part of the memory's control logic.
  • the controller in addition to implementing the controller in the form of pure computer-readable program code, the controller can be completely programmed with logic gates, switches, application-specific integrated circuits, programmable logic controllers and embedded logic by logically programming the method steps. Microcontroller, etc. to achieve the same function. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be considered as structures within the hardware component. Or even, the means for implementing various functions can be considered as structures within hardware components as well as software modules implementing the methods.
  • a typical implementation device is a computer.
  • the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or A combination of any of these devices.
  • embodiments of the present specification may be provided as methods, systems, or computer program products.
  • the present description may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment that combines software and hardware aspects.
  • the present description may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk memory, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
  • These computer program instructions may also be stored in a computer-readable memory that causes a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction means, the instructions
  • the device implements the functions specified in a process or processes of the flowchart and/or a block or blocks of the block diagram.
  • These computer program instructions may also be loaded onto a computer or other programmable data processing device, causing a series of operating steps to be performed on the computer or other programmable device to produce computer-implemented processing, thereby executing on the computer or other programmable device.
  • Instructions provide steps for implementing the functions specified in a process or processes of a flowchart diagram and/or a block or blocks of a block diagram.
  • a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
  • processors CPUs
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • Memory may include non-permanent storage in computer-readable media, random access memory (RAM) and/or non-volatile memory in the form of read-only memory (ROM) or flash memory (flash RAM). Memory is an example of computer-readable media.
  • RAM random access memory
  • ROM read-only memory
  • flash RAM flash random access memory
  • Computer-readable media includes both persistent and non-volatile, removable and non-removable media that can be implemented by any method or technology for storage of information.
  • Information may be computer-readable instructions, data structures, modules of programs, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, Magnetic tape cassettes, tape magnetic disk storage or other magnetic storage devices or any other non-transmission medium can be used to store information that can be accessed by a computing device.
  • computer-readable media does not include transient computer-readable media (transitory media), such as modulated data signals and carrier waves.
  • embodiments of the present specification may be provided as methods, systems, or computer program products.
  • the present description may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment that combines software and hardware aspects.
  • the present description may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk memory, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
  • program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types.
  • the present description may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through communications networks.
  • program modules may be located in both local and remote computer storage media including storage devices.

Abstract

本说明书公开了一种数据传输方法、装置、存储介质及电子设备，服务器可以将与客户端的会话的会话状态信息，发送给客户端保存，在客户端需要再次使用该会话时，可以将会话状态信息携带在连接请求中发送给服务器，服务器可以根据客户端发送的携带有会话状态信息的连接请求，恢复与客户端之间的会话，从而降低了服务器保存的与各个客户端的会话对服务器内存的占用。

Description

一种数据传输方法、装置、存储介质及电子设备 技术领域
本说明书涉及通信技术领域，尤其涉及一种数据传输方法、装置、存储介质及电子设备。
背景技术
目前，客户端和服务器通过握手协议建立连接后，服务器可以创建一个会话Session(即客户端服务器进行通讯的过程)，当客户端与服务器的一段通讯结束后，服务器可以将创建的会话保存起来，以待该客户端再次访问时，服务器可以再次使用已经保存的会话，以与客户端继续进行通讯(即不用重新进行握手)。
但是，服务器往往与大量的客户端并发进行通讯，这就导致服务器保存的与不同客户端之间的会话将会占用服务器的大量内存，这就需要对服务器的内存有着更加严格的要求，并且，如果出现内存占用过高的情况，可能导致服务器的运行出现异常，甚至是发生隐私数据泄露的情况。
发明内容
本说明书提供一种数据传输方法、装置、存储介质及电子设备，以解决相关技术存在的服务器中保存的会话占用内容较高的问题。
本说明书采用下述技术方案：本说明书提供了一种数据传输方法，所述方法应用于服务器，包括：响应于客户端发送的连接请求，判断所述连接请求中是否携带有会话状态信息，所述会话状态信息中包含所述服务器与所述客户端通过创建的会话进行数据传输所基于的参数，以及会话标识；若是，则根据所述连接请求中携带的会话状态信息，恢复与所述客户端之间的会话，并通过恢复的会话，与所述客户端进行数据传输；若否，则创建与所述客户端之间的会话，并将针对创建出的会话所生成的会话状态信息发送给所述客户端，以使所述客户端进行保存。
可选地，将针对创建出的会话所生成的会话状态信息发送给所述客户端，具体包括：通过预先确定出的各加密密钥，对针对创建出的会话所生成的会话状态信息进行加密，得到加密后会话状态信息；将所述加密后会话状态信息发送给所述客户端。
可选地，确定各加密密钥，具体包括：获取初始密钥以及N个密钥参数，N为正整数；根据得到的第N-1个加密密钥以及第N个密钥参数，生成第N个加密密钥，其中，第一个加密密钥是通过所述初始密钥和第一个密钥参数生成的。
可选地，通过预先确定出的各加密密钥，对针对创建出的会话所生成的会话状态信息进行加密，得到加密后会话状态信息，具体包括：按照各加密密钥加密所述会话状态信息的先后顺序，依次使用各加密密钥对所述会话状态信息进行加密，得到加密后会话状态信息；其中，针对每个加密密钥，通过该加密密钥，对上一加密密钥加密后得到的会话状态信息进行加密，得到经过该加密密钥加密后的会话状态信息。
可选地，通过该加密密钥，对上一加密密钥加密后得到的会话状态信息进行加密，得到经过该加密密钥加密后的会话状态信息，具体包括：通过该加密密钥，对上一加密密钥加密后得到的会话状态信息进行加密，得到基础加密会话状态信息；通过至少一种预设的置换方法，对所述基础加密会话状态信息进行置换，得到经过该加密密钥加密后的会话状态信息，所述置换方法包括：非线性置换、线性置换、反序置换中的至少一种。
可选地，根据所述连接请求中携带的会话状态信息，恢复与所述客户端之间的会话，具体包括：根据预设的完整性校验算法，对所述连接请求中携带的会话状态信息进行完整性验证；若确定所述会话状态信息完整后，根据所述会话状态信息，恢复与所述客户端之间的会话。
可选地，恢复与所述客户端之间的会话，具体包括：根据所述会话状态信息中携带的密钥标识，确定所述会话状态信息对应的各解密密钥；通过所述各解密密钥，对所述会话状态信息进行解密，得到解密后的会话状态信息；根据所述解密后的会话状态信息，恢复与所述客户端之间的会话。
本说明书提供了一种数据传输方法，所述方法应用于客户端，包括：客户端确定目标服务器，所述目标服务器用于与所述客户端进行数据传输；判断所述客户端本地是否保存有与所述目标服务器进行会话所基于的会话状态信息；若是，将携带有所述会话状态信息的连接请求发送给所述目标服务器，以使所述目标服务器根据所述会话状态信息，恢复与所述客户端之间的会话，并通过恢复的会话，进行数据传输；若否，向所述目标服务器发送连接请求，以使所述目标服务器根据所述连接请求，创建与所述客户端之间的会话。
本说明书提供了一种数据传输装置，包括：判断模块，用于响应于客户端发送的连 接请求，判断所述连接请求中是否携带有会话状态信息，所述会话状态信息中包含所述服务器与所述客户端通过创建的会话进行数据传输所基于的参数，以及会话标识；恢复模块，用于在确定所述连接请求中携带有会话状态信息时，根据所述连接请求中携带的会话状态信息，恢复与所述客户端之间的会话，并通过恢复的会话，与所述客户端进行数据传输；创建模块，用于在确定所述连接请求中未携带有会话状态信息时，创建与所述客户端之间的会话，并将针对创建出的会话所生成的会话状态信息发送给所述客户端，以使所述客户端进行保存。
本说明书提供了一种数据传输装置，包括：确定模块，用于确定目标服务器，所述目标服务器用于与所述客户端进行数据传输；判断并执行模块，用于判断所述客户端本地是否保存有与所述目标服务器进行会话所基于的会话状态信息；若是，将携带有所述会话状态信息的连接请求发送给所述目标服务器，以使所述目标服务器根据所述会话状态信息，恢复与所述客户端之间的会话，并通过恢复的会话，进行数据传输；若否，向所述目标服务器发送连接请求，以使所述目标服务器根据所述连接请求，创建与所述客户端之间的会话。
本说明书提供了一种计算机可读存储介质，所述存储介质存储有计算机程序，所述计算机程序被处理器执行时实现上述数据传输方法。
本说明书提供了一种电子设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述处理器执行所述程序时实现上述数据传输方法。
本说明书采用的上述至少一个技术方案能够达到以下有益效果：在本说明书提供的数据传输方法，响应于客户端发送的连接请求，判断连接请求中是否携带有会话状态信息，会话状态信息中包含服务器与客户端通过创建的会话进行数据传输所基于的参数，以及会话标识，若是，则根据连接请求中携带的会话状态信息，恢复与客户端之间的会话，并通过恢复的会话，与客户端进行数据传输，若否，则创建与客户端之间的会话，并将针对创建出的会话所生成的会话状态信息发送给客户端，以使客户端进行保存。
从上述方法中可以看出，服务器可以将与客户端的会话的会话状态信息，发送给客户端保存，以使在客户端需要再次使用该会话时，可以将会话状态信息携带在连接请求中发送给服务器，服务器可以根据客户端发送的携带有会话状态信息的连接请求，恢复与客户端之间的会话，从而降低了服务器保存的与各个客户端的会话对服务器内存的占用。
附图说明
此处所说明的附图用来提供对本说明书的进一步理解，构成本说明书的一部分，本说明书的示意性实施例及其说明用于解释本说明书，并不构成对本说明书的不当限定。在附图中：
图1为本说明书中提供的一种数据传输方法的流程示意图；
图2为本说明书中提供的另一种数据传输方法的流程示意图；
图3为本说明书提供的一种数据传输装置的示意图；
图4为本说明书提供的另一种数据传输装置的示意图；
图5为本说明书提供的一种对应于图1的电子设备的示意图。
具体实施方式
为使本说明书的目的、技术方案和优点更加清楚，下面将结合本说明书具体实施例及相应的附图对本说明书技术方案进行清楚、完整地描述。显然，所描述的实施例仅是本说明书一部分实施例，而不是全部的实施例。基于本说明书中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本说明书保护的范围。
目前，当客户端与服务器通过握手协议建立连接后，服务器会创建一个与客户端的会话Session，并将会话的唯一标识信息Session ID发送给客户端，进而可以通过会话与客户端进行数据传输，当客户端结束本次会话后，服务器可以将与客户端的会话状态保存下来，以便于客户端在下次需要进行数据传输时，可以不用再重新通过握手协议建立连接，而是可以根据客户端中保存的Session ID直接恢复会话，并进行数据传输。
但是，由于服务器往往需要同时与大量的客户端并发进行数据传输，这就使得服务器需要保存大量的与不同客户端的会话，从而导致服务器的内存被大量占用。除此之外，在分布式服务器集群(即，单个服务器在使用的过程中，往往由于自身的硬件资源以及其他条件限制，而导致单个服务器的性能不能无限增加，因此，为了对服务器的性能进行进一步地的拓展，就可以使用多个服务器共同提供服务，也就是服务器集群的方式来提供服务)中，客户端每次访问的服务器可能并不是同一个，这就导致新的服务器并不能根据客户端中保存的Session ID恢复客户端与上一个服务器之间的会话，从而就导致 在服务器集群中并不能很好的根据Session ID实现会话复用。
以下结合附图，详细说明本说明书各实施例提供的技术方案。
图1为本说明书中提供的一种软件管理方法的流程示意图，包括以下步骤S100至S104。
S100：响应于客户端发送的连接请求，判断所述连接请求中是否携带有会话状态信息，所述会话状态信息中包含所述服务器与所述客户端通过创建的会话进行数据传输所基于的参数，以及会话标识，若是，则执行步骤S102，若否，则执行步骤S104。
在本说明书中，服务器在接收到客户端发送的连接请求后，可以响应于客户端发送的连接请求，判断接收到的连接请求中是否携带有会话状态信息，若是，则根据会话状态信息，恢复与客户端之间的会话，并通过恢复的会话，与客户端进行数据传输，若否，则创建与客户端之间的会话，并通过创建的会话，与客户端进行数据传输，其中，会话状态信息中包含服务器与客户端通过会话进行数据传输所基于的参数，例如：客户端和服务器协商的加密协议的版本version、客户端和服务器协商的进行数据通讯时使用的密码套件cipher、客户端和服务器协商的进行数据通讯时使用的密钥master_key、会话状态信息可以被复用的时间timestamp等，以及所述会话的会话标识Session ID。
S102：根据所述连接请求中携带的会话状态信息，恢复与所述客户端之间的会话，并通过恢复的会话，与所述客户端进行数据传输。
服务器若确定客户端发送的连接请求中携带有会话状态信息，则可以根据客户端发送的连接请求中携带的会话状态信息，恢复服务器与客户端之间的会话，并通过恢复的会话，与客户端进行数据传输。
具体地，为了防止加密后的会话状态信息在客户端保存期间被篡改，服务器在将会话状态信息发送给客户端保存之前，可以通过预设的完整性校验算法对加密后的会话状态信息进行完整性加密，其中，预设的完整性校验算法可以是诸如：哈希运算消息认证码(Keyed-Hash Message Authentication Code，HMAC)、消息摘要算法(SM3)等，对应的，在服务器需要根据客户端中携带的会话状态信息，恢复与客户端之间的会话之前，需要先对会话状态信息进行完整性校验，以下以HMAC算法为例，对服务器对会话状态信息进行完整性校验的过程进行详细说明。
服务器在获取到客户端发送的连接请求中携带的会话状态信息后，可以根据会话状态信息的标识，从预设的配置文件中，确定出与该会话状态信息对应的HMAC密钥， 并通过HMAC密钥计算出会话状态信息中的密钥标识key-name，初始化向量iv，以及加密后的会话状态信息对应的HMAC值，并将计算出的密钥标识key-name，初始化向量iv，以及加密后的会话状态信息对应的HMAC值对应的HMAC值与会话状态信息中携带的MAC值进行比对，若一致，则可以确定出会话状态信息完整。
上述内容中的密钥标识key-name是对会话状态信息进行加密时所使用的一套密钥对应的标识，初始化向量iv是用于在对会话状态数据进行进一步加密时使用的初始化向量，即服务器在会话状态信息进行加密后，可以将加密过程中所使用的密钥对应的密钥标识，以及在加密过程中使用的初始化向量保存到会话状态信息中(需要说明的是，这里的加密是指对上述内容中的包含有客户端和服务器协商的加密协议的版本version、客户端和服务器协商的进行数据通讯时使用的密码套件cipher、客户端和服务器协商的进行数据通讯时使用的密钥master_key、会话状态信息可以被复用的时间timestamp等，以及所述会话的会话标识Session ID等信息的会话状态信息进行加密，服务器在确定上述的密钥标识key-name，初始化向量iv，以及加密后的会话状态信息的完整性之后，可以根据上述的密钥标识key-name，初始化向量iv对加密后的会话状态信息进行解密)。
进一步地，在服务器对客户端再次发送的连接请求中携带的会话状态信息进行完整性验证后，可以根据会话状态信息中携带的密钥标识，确定会话状态信息对应的各解密密钥，并通过各解密密钥，对会话状态信息进行解密，得到解密后的会话状态信息，根据解密后的会话状态信息，恢复与客户端之间的会话。
进一步地，当服务器得到解密后的会话状态信息之后，可以确定解密后的会话状态信息中携带的会话状态信息可以被复用的时间timestamp，并判断与客户端进行上次会话的时间，与客户端再次发送连接请求的时间之间的时间间隔，是否超过会话状态信息可以被复用的时间timestamp，若否，则恢复与客户端之间的会话，若是，则服务器需要重新通过预设的握手协议与客户端进行连接。
S104：创建与所述客户端之间的会话，并将针对创建出的会话所生成的会话状态信息发送给所述客户端，以使所述客户端进行保存。
服务器若确定客户端发送的连接请求中未携带有会话状态信息，则可以接收客户端发送的连接请求，并响应于接收到的连接请求，按照预设的握手协议，与客户端互相进行身份验证，并与客户端协商确定在数据传输过程中使用的加密协议的版本version，与客户端协商确定数据传输所使用的密码套件cipher、以及密钥master_key等信息后，创建与客户端之间的会话。
服务器在创建与客户端之间的会话后，可以针对创建出的会话生成会话状态信息，将会话状态信息发送给客户端，以使客户端在当前会话结束后需要再次发起会话时使用。
进一步地，当服务器需要将会话状态信息发送给客户端时，服务器可以通过预设的加密方法对会话状态信息进行加密，并将加密后的会话状态信息发送给客户端。
上述内容中，服务器对会话状态信息进行加密的方法可以是通过预先确定出的各加密密钥，对会话状态信息进行加密，得到加密后会话状态信息，并将加密后会话状态信息发送给客户端。
具体地，服务器可以按照预先确定出的各加密密钥加密会话状态信息的先后顺序，依次使用各加密密钥对会话状态信息进行加密，得到加密后会话状态信息，其中，针对每个加密密钥，通过该加密密钥，对上一加密密钥加密后得到的会话状态信息进行加密，得到经过该加密密钥加密后的会话状态信息。
其中，服务器通过该加密密钥对上一加密密钥加密后得到的会话状态信息进行加密的方法可以是，服务器可以按照预设的运算方式，确定该加密密钥与上一加密密钥加密后的会话状态信息的运算值，这里的运算方式可以是诸如：异或运算、与运算、求和运算等，相应的若服务器使用的运算方式为异或运算时，上述的运算值即为异或运算值。
进一步地，服务器可以将确定出的该加密密钥与上一加密密钥加密后的会话状态信息的运算值，作为基础加密会话状态，进而可以通过至少一种预设的置换方法，对该基础加密会话状态信息进行置换，得到最终输出的经过该加密密钥加密后的会话状态信息，这里的置换方法包括：非线性置换(例如：对照S盒Sbox进行置换)、线性置换(例如：通过左移运算进行置换)、反序置换(即，将基础加密会话状态信息中的每个值的顺序进行调整，例如：假设反序置换前的值为：(a1、a2、a3、a4)，则进行反序置换后的值就为(a4、a3、a2、a1)中的至少一种。
上述内容中，每轮加密所使用的各加密密钥的确定方法可以是获取初始密钥以及N个密钥参数，这里的N为正整数，根据得到的第N-1个加密密钥以及第N个密钥参数，生成第N个加密密钥，其中，第一个加密密钥是通过初始密钥和第一个密钥参数生成的，这里的密钥参数是预设的一组固定的参数。
具体地，根据得到的第N-1个密钥以及第N个密钥参数，生成第N个密钥的方法可以是服务器可以按照预设的运算方式，确定第N-1个加密密钥以及第N个密钥参数的运算值，这里的运算方式可以是诸如：异或运算、与运算、求和运算等，进一步地，通过 预设的置换算法，对确定出的第N-1个加密密钥以及第N个密钥参数的运算值进行置换，从而得到第N个加密密钥。
除此之外，服务器还可以将需要加密的会话状态信息进行分组(例如：将会话状态信息中的每128位为一组，也就是每16个字节为一组)，然后分别针对每组会话状态信息，通过上述的方法进行加密，得到每组会话状态信息加密后的结果，进而可以针对每组的加密后的会话状态信息，将该组的加密后的会话状态信息与前一组的加密后的会话状态信息按照预设的算法进行运算(例如：进行异或运算)，得到该组加密后的会话状态信息，经过进一步加密后的会话状态信息，其中，第一组加密后的会话状态信息可以与预设的初始值iv进行预算，以得到第一种加密后的会话状态信息，经过进一步加密后的会话状态信息。
进一步地，服务器可以确定上述内容中所使用的各加密密钥对应的一个密钥标识key-name(可以通过随机数生成器等方法确定密钥标识，也可以从配置文件中获取的)，并通过预先确定的HMAC密钥(可以是通过随机数生成器生成的，也可以是从配置文件中获取的)确定该密钥标识、上述内容中使用的初始值iv、最终得到的加密后的会话状态信息的HMAC值，以及与该密钥标识、上述内容中使用的初始值iv、最终得到的加密后的会话状态信息的HMAC值对应的消息验证码MAC值，并将该密钥标识、上述内容中使用的初始值iv、以及最终得到的加密后的会话状态信息的HMAC值，以及上述的MAC值发送给客户端以使客户端进行保存，其中，消息验证码MAC用于校验会话状态信息的完整性。
需要说明的是，服务器使用的对会话状态信息进行加密的加密密钥，可以是通过上述方法生成的，也可以是从预先设置的配置文件(这里的配置文件中保存有由开发人员设置的多套加密密钥，其中，每套加密密钥对应着一个密钥标识，且一个服务器集群中的若干各服务器可以使用同一套配置文件)中获取的各加密密钥，若服务器使用的各加密密钥是从配置文件中获取的，则与该服务器处于同一集群的其他服务器也可以根据客户端发送的连接请求中携带的会话状态信息中的密钥标识，从配置文件中确定出相应的解密密钥，从而通过解密密钥，对会话状态信息进行解密，并恢复与客户端之间的会话，进而可以实现客户端与服务器集群中的任意一个服务器之间会话，在该服务器集群的不同服务器上的复用。
从上述内容中可以看出，服务器可以在创建与客户端之间的会话后，会话的会话状态信息通过预设的加密算法进行加密，并将加密后的会话状态信息发送给客户端中保存，在客户端需要复用会话时，可以将客户端中保存的会话状态信息携带在连接请求中发送 给服务器，以使服务器能够根据会话状态信息恢复会话，从而减少了服务器保存的与各个客户端的会话对服务器内存的占用，以及能够实现在服务器集群中进行会话的复用。
为了对上述内容进行进一步地的详细说明，本说明书中还提供了一种数据传输的方法，如图2所示。
图2为本说明书中提供的另一种数据传输的方法的流程示意图，包括以下步骤S200至S206。
S200：客户端确定目标服务器，所述目标服务器用于与所述客户端进行数据传输。
S202：判断所述客户端本地是否保存有与所述目标服务器进行会话所基于的会话状态信息，若是，则执行步骤S204，若否，则执行步骤S206。
S204：将携带有所述会话状态信息的连接请求发送给所述目标服务器，以使所述目标服务器根据所述会话状态信息，恢复与所述客户端之间的会话，并通过恢复的会话，进行数据传输。
S206：向所述目标服务器发送连接请求，以使所述目标服务器根据所述连接请求，创建与所述客户端之间的会话。
客户端可以在需要向服务器发送连接请求之前，可以先确定接收连接请求的服务器，作为目标服务器，进而可以判断客户端本地中是否保存有与目标服务器进行会话所基于的会话状态信息，若确定没有，则可以向服务器发送连接请求，并按照预设的握手协议与服务器进行身份验证，以及与服务器协商确定在数据传输过程中使用的加密协议的版本version，与客户端协商确定数据传输所使用的密码套件cipher、以及密钥master_key等信息后，响应于服务器创建的与客户端之间的会话，与服务器进行数据传输，并接收服务器发送的会话状态信息并保存。
若客户端确定本地保存有与目标服务器进行会话所基于的会话状态信息时，客户端可以从本地获取会话状态信息，然后向服务器发送携带有会话状态信息的连接请求，以使服务器根据携带有所述会话状态信息的连接请求，恢复与客户端之间的会话，并通过服务器恢复的与客户端之间的会话，与服务器进行数据传输。
需要说明的是，由于保存在客户端中的会话状态信息是经过服务器加密的，因此，客户端只能保存该会话状态信息，而并不能读取到会话状态信息中的具体内容，也不能对会话状态信息进行修改。
从上述内容中可以看出，客户端可以将服务器发送的加密后的会话状态信息保存起来，并在再次向服务器发送连接请求时，将会话状态信息携带在连接请求中发送给服务器，从而实现了会话的复用，进而减少了服务器保存的与各个客户端的会话对服务器内 存的占用。
以上为本说明书的一个或多个实施例提供的数据传输方法，基于同样的思路，本说明书还提供了相应的数据传输装置，如图3、图4所示。
图3为本说明书提供的一种数据传输装置的示意图，包括：判断模块301，用于响应于客户端发送的连接请求，判断所述连接请求中是否携带有会话状态信息，所述会话状态信息中包含所述服务器与所述客户端通过创建的会话进行数据传输所基于的参数，以及会话标识；恢复模块302，用于在确定所述连接请求中携带有会话状态信息时，根据所述连接请求中携带的会话状态信息，恢复与所述客户端之间的会话，并通过恢复的会话，与所述客户端进行数据传输；创建模块303，用于在确定所述连接请求中未携带有会话状态信息时，创建与所述客户端之间的会话，并将针对创建出的会话所生成的会话状态信息发送给所述客户端，以使所述客户端进行保存。
可选地，所述创建模块303具体用于，通过预先确定出的各加密密钥，对针对创建出的会话所生成的会话状态信息进行加密，得到加密后会话状态信息；将所述加密后会话状态信息发送给所述客户端。
可选地，所述创建模块303具体用于，获取初始密钥以及N个密钥参数，N为正整数；根据得到的第N-1个加密密钥以及第N个密钥参数，生成第N个加密密钥，其中，第一个加密密钥是通过所述初始密钥和第一个密钥参数生成的。
可选地，所述创建模块303具体用于，按照各加密密钥加密所述会话状态信息的先后顺序，依次使用各加密密钥对所述会话状态信息进行加密，得到加密后会话状态信息；其中针对每个加密密钥，通过该加密密钥，对上一加密密钥加密后得到的会话状态信息进行加密，得到经过该加密密钥加密后的会话状态信息。
可选地，所述创建模块303具体用于，通过该加密密钥，对上一加密密钥加密后得到的会话状态信息进行加密，得到基础加密会话状态信息；通过至少一种预设的置换方法，对所述基础加密会话状态信息进行置换，得到经过该加密密钥加密后的会话状态信息，所述置换方法包括：非线性置换、线性置换、反序置换中的至少一种。
可选地，所述恢复模块302具体用于，根据预设的完整性校验算法，对所述连接请求中携带的会话状态信息进行完整性验证；若确定所述会话状态信息完整后，根据所述会话状态信息，恢复与所述客户端之间的会话。
可选地，所述恢复模块302具体用于，根据所述会话状态信息中携带的密钥标识，确定所述会话状态信息对应的各解密密钥；通过所述各解密密钥，对所述会话状态信息进行解密，得到解密后的会话状态信息；根据所述解密后的会话状态信息，恢复与所述 客户端之间的会话。
图4为本说明书提供的另一种数据传输装置的示意图，包括：确定模块401，用于确定目标服务器，所述目标服务器用于与所述客户端进行数据传输；判断并执行模块402，用于判断所述客户端本地是否保存有与所述目标服务器进行会话所基于的会话状态信息；若是，将携带有所述会话状态信息的连接请求发送给所述目标服务器，以使所述目标服务器根据所述会话状态信息，恢复与所述客户端之间的会话，并通过恢复的会话，进行数据传输；若否，向所述目标服务器发送连接请求，以使所述目标服务器根据所述连接请求，创建与所述客户端之间的会话。
本说明书还提供了一种计算机可读存储介质，该存储介质存储有计算机程序，计算机程序可用于执行上述图1提供的一种数据传输方法。
本说明书还提供了图5所示的一种对应于图1的电子设备的示意结构图。如图5，在硬件层面，该电子设备包括处理器、内部总线、网络接口、内存以及非易失性存储器，当然还可能包括其他业务所需要的硬件。处理器从非易失性存储器中读取对应的计算机程序到内存中然后运行，以实现上述图1的数据传输方法。当然，除了软件实现方式之外，本说明书并不排除其他实现方式，比如逻辑器件抑或软硬件结合的方式等等，也就是说以下处理流程的执行主体并不限定于各个逻辑单元，也可以是硬件或逻辑器件。
在20世纪90年代，对于一个技术的改进可以很明显地区分是硬件上的改进(例如，对二极管、晶体管、开关等电路结构的改进)还是软件上的改进(对于方法流程的改进)。然而，随着技术的发展，当今的很多方法流程的改进已经可以视为硬件电路结构的直接改进。设计人员几乎都通过将改进的方法流程编程到硬件电路中来得到相应的硬件电路结构。因此，不能说一个方法流程的改进就不能用硬件实体模块来实现。例如，可编程逻辑器件(Programmable Logic Device,PLD)(例如现场可编程门阵列(Field Programmable Gate Array，FPGA))就是这样一种集成电路，其逻辑功能由用户对器件编程来确定。由设计人员自行编程来把一个数字系统“集成”在一片PLD上，而不需要请芯片制造厂商来设计和制作专用的集成电路芯片。而且，如今，取代手工地制作集成电路芯片，这种编程也多半改用“逻辑编译器(logic compiler)”软件来实现，它与程序开发撰写时所用的软件编译器相类似，而要编译之前的原始代码也得用特定的编程语言来撰写，此称之为硬件描述语言(Hardware Description Language，HDL)，而HDL也并非仅有一种，而是有许多种，如ABEL(Advanced Boolean Expression Language)、AHDL(Altera Hardware Description Language)、Confluence、CUPL(Cornell University Programming Language)、HDCal、JHDL(Java Hardware Description Language)、Lava、 Lola、MyHDL、PALASM、RHDL(Ruby Hardware Description Language)等，目前最普遍使用的是VHDL(Very-High-Speed Integrated Circuit Hardware Description Language)与Verilog。本领域技术人员也应该清楚，只需要将方法流程用上述几种硬件描述语言稍作逻辑编程并编程到集成电路中，就可以很容易得到实现该逻辑方法流程的硬件电路。
控制器可以按任何适当的方式实现，例如，控制器可以采取例如微处理器或处理器以及存储可由该(微)处理器执行的计算机可读程序代码(例如软件或固件)的计算机可读介质、逻辑门、开关、专用集成电路(Application Specific Integrated Circuit，ASIC)、可编程逻辑控制器和嵌入微控制器的形式，控制器的例子包括但不限于以下微控制器：ARC 625D、Atmel AT91SAM、Microchip PIC18F26K20以及Silicone Labs C8051F320，存储器控制器还可以被实现为存储器的控制逻辑的一部分。本领域技术人员也知道，除了以纯计算机可读程序代码方式实现控制器以外，完全可以通过将方法步骤进行逻辑编程来使得控制器以逻辑门、开关、专用集成电路、可编程逻辑控制器和嵌入微控制器等的形式来实现相同功能。因此这种控制器可以被认为是一种硬件部件，而对其内包括的用于实现各种功能的装置也可以视为硬件部件内的结构。或者甚至，可以将用于实现各种功能的装置视为既可以是实现方法的软件模块又可以是硬件部件内的结构。
上述实施例阐明的系统、装置、模块或单元，具体可以由计算机芯片或实体实现，或者由具有某种功能的产品来实现。一种典型的实现设备为计算机。具体的，计算机例如可以为个人计算机、膝上型计算机、蜂窝电话、相机电话、智能电话、个人数字助理、媒体播放器、导航设备、电子邮件设备、游戏控制台、平板计算机、可穿戴设备或者这些设备中的任何设备的组合。
为了描述的方便，描述以上装置时以功能分为各种单元分别描述。当然，在实施本说明书时可以把各单元的功能在同一个或多个软件和/或硬件中实现。
本领域内的技术人员应明白，本说明书的实施例可提供为方法、系统、或计算机程序产品。因此，本说明书可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本说明书可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本说明书是参照根据本说明书实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理 设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
在一个典型的配置中，计算设备包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、商品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、商品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括要素的过程、方法、商品或者设备中还存在另外的相同要素。
本领域技术人员应明白，本说明书的实施例可提供为方法、系统或计算机程序产品。 因此，本说明书可采用完全硬件实施例、完全软件实施例或结合软件和硬件方面的实施例的形式。而且，本说明书可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本说明书可以在由计算机执行的计算机可执行指令的一般上下文中描述，例如程序模块。一般地，程序模块包括执行特定任务或实现特定抽象数据类型的例程、程序、对象、组件、数据结构等等。也可以在分布式计算环境中实践本说明书，在这些分布式计算环境中，由通过通信网络而被连接的远程处理设备来执行任务。在分布式计算环境中，程序模块可以位于包括存储设备在内的本地和远程计算机存储介质中。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于系统实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
以上仅为本说明书的实施例而已，并不用于限制本说明书。对于本领域技术人员来说，本说明书可以有各种更改和变化。凡在本说明书的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在本说明书的权利要求范围之内。

Claims (12)

  1. 一种数据传输方法，所述方法应用于服务器，包括：
    响应于客户端发送的连接请求，判断所述连接请求中是否携带有会话状态信息，所述会话状态信息中包含所述服务器与所述客户端通过创建的会话进行数据传输所基于的参数，以及会话标识；
    若是，则根据所述连接请求中携带的会话状态信息，恢复与所述客户端之间的会话，并通过恢复的会话，与所述客户端进行数据传输；
    若否，则创建与所述客户端之间的会话，并将针对创建出的会话所生成的会话状态信息发送给所述客户端，以使所述客户端进行保存。
  2. 如权利要求1所述的方法，将针对创建出的会话所生成的会话状态信息发送给所述客户端，包括：
    通过预先确定出的各加密密钥，对针对创建出的会话所生成的会话状态信息进行加密，得到加密后会话状态信息；
    将所述加密后会话状态信息发送给所述客户端。
  3. 如权利要求2所述的方法，确定各加密密钥，包括：
    获取初始密钥以及N个密钥参数，N为正整数；
    根据得到的第N-1个加密密钥以及第N个密钥参数，生成第N个加密密钥，其中，第一个加密密钥是通过所述初始密钥和第一个密钥参数生成的。
  4. 如权利要求2所述的方法，通过预先确定出的各加密密钥，对针对创建出的会话所生成的会话状态信息进行加密，得到加密后会话状态信息，包括：
    按照各加密密钥加密所述会话状态信息的先后顺序，依次使用各加密密钥对所述会话状态信息进行加密，得到加密后会话状态信息；其中
    针对每个加密密钥，通过该加密密钥，对上一加密密钥加密后得到的会话状态信息进行加密，得到经过该加密密钥加密后的会话状态信息。
  5. 如权利要求4所述的方法，通过该加密密钥，对上一加密密钥加密后得到的会话状态信息进行加密，得到经过该加密密钥加密后的会话状态信息，包括：
    通过该加密密钥，对上一加密密钥加密后得到的会话状态信息进行加密，得到基础加密会话状态信息；
    通过至少一种预设的置换方法，对所述基础加密会话状态信息进行置换，得到经过该加密密钥加密后的会话状态信息，所述置换方法包括：非线性置换、线性置换、反序置换中的至少一种。
  6. 如权利要求1所述的方法，根据所述连接请求中携带的会话状态信息，恢复与所述客户端之间的会话，包括：
    根据预设的完整性校验算法，对所述连接请求中携带的会话状态信息进行完整性验证；
    若确定所述会话状态信息完整后，根据所述会话状态信息，恢复与所述客户端之间的会话。
  7. 如权利要求2所述的方法，恢复与所述客户端之间的会话，包括：
    根据所述会话状态信息中携带的密钥标识，确定所述会话状态信息对应的各解密密钥；
    通过所述各解密密钥，对所述会话状态信息进行解密，得到解密后的会话状态信息；
    根据所述解密后的会话状态信息，恢复与所述客户端之间的会话。
  8. 一种数据传输方法，所述方法应用于客户端，包括：
    客户端确定目标服务器，所述目标服务器用于与所述客户端进行数据传输；
    判断所述客户端本地是否保存有与所述目标服务器进行会话所基于的会话状态信息；
    若是，将携带有所述会话状态信息的连接请求发送给所述目标服务器，以使所述目标服务器根据所述会话状态信息，恢复与所述客户端之间的会话，并通过恢复的会话，进行数据传输；
    若否，向所述目标服务器发送连接请求，以使所述目标服务器根据所述连接请求，创建与所述客户端之间的会话。
  9. 一种数据传输装置，包括：
    判断模块，用于响应于客户端发送的连接请求，判断所述连接请求中是否携带有会话状态信息，所述会话状态信息中包含服务器与所述客户端通过创建的会话进行数据传输所基于的参数，以及会话标识；
    恢复模块，用于在确定所述连接请求中携带有会话状态信息时，根据所述连接请求中携带的会话状态信息，恢复与所述客户端之间的会话，并通过恢复的会话，与所述客户端进行数据传输；
    创建模块，用于在确定所述连接请求中未携带有会话状态信息时，创建与所述客户端之间的会话，并将针对创建出的会话所生成的会话状态信息发送给所述客户端，以使所述客户端进行保存。
  10. 一种数据传输装置，包括：
    确定模块，用于确定目标服务器，所述目标服务器用于与客户端进行数据传输；
    判断并执行模块，用于判断所述客户端本地是否保存有与所述目标服务器进行会话所基于的会话状态信息；若是，将携带有所述会话状态信息的连接请求发送给所述目标服务器，以使所述目标服务器根据所述会话状态信息，恢复与所述客户端之间的会话，并通过恢复的会话，进行数据传输；若否，向所述目标服务器发送连接请求，以使所述目标服务器根据所述连接请求，创建与所述客户端之间的会话。
  11. 一种计算机可读存储介质，所述存储介质存储有计算机程序，所述计算机程序被处理器执行时实现上述权利要求1～8任一项所述的方法。
  12. 一种电子设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述处理器执行所述程序时实现上述权利要求1～8任一项所述的方法。
PCT/CN2023/109887 2022-08-04 2023-07-28 一种数据传输方法、装置、存储介质及电子设备 WO2024027598A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210934730.3A CN115484301A (zh) 2022-08-04 2022-08-04 一种数据传输方法、装置、存储介质及电子设备
CN202210934730.3 2022-08-04

Publications (1)

Publication Number Publication Date
WO2024027598A1 true WO2024027598A1 (zh) 2024-02-08

Family

ID=84422241

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/109887 WO2024027598A1 (zh) 2022-08-04 2023-07-28 一种数据传输方法、装置、存储介质及电子设备

Country Status (2)

Country Link
CN (1) CN115484301A (zh)
WO (1) WO2024027598A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115484301A (zh) * 2022-08-04 2022-12-16 支付宝(杭州)信息技术有限公司 一种数据传输方法、装置、存储介质及电子设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1863061A (zh) * 2005-09-28 2006-11-15 华为技术有限公司 移动终端在联网游戏中断时自动恢复的方法及其系统
US20090181775A1 (en) * 2006-05-12 2009-07-16 Jens Nilsson Gaming system with failover and takeover capability
CN109246172A (zh) * 2017-07-11 2019-01-18 华为技术有限公司 一种恢复会话的方法、装置及计算机存储介质
CN111416874A (zh) * 2020-04-02 2020-07-14 腾讯科技（深圳）有限公司 用于会话重建或共享的方法、装置及系统
CN115484301A (zh) * 2022-08-04 2022-12-16 支付宝(杭州)信息技术有限公司 一种数据传输方法、装置、存储介质及电子设备

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1863061A (zh) * 2005-09-28 2006-11-15 华为技术有限公司 移动终端在联网游戏中断时自动恢复的方法及其系统
US20090181775A1 (en) * 2006-05-12 2009-07-16 Jens Nilsson Gaming system with failover and takeover capability
CN109246172A (zh) * 2017-07-11 2019-01-18 华为技术有限公司 一种恢复会话的方法、装置及计算机存储介质
CN111416874A (zh) * 2020-04-02 2020-07-14 腾讯科技（深圳）有限公司 用于会话重建或共享的方法、装置及系统
CN115484301A (zh) * 2022-08-04 2022-12-16 支付宝(杭州)信息技术有限公司 一种数据传输方法、装置、存储介质及电子设备

Also Published As

Publication number Publication date
CN115484301A (zh) 2022-12-16

Similar Documents

Publication Publication Date Title
WO2021184975A1 (zh) 链上数据的链下隐私计算方法及装置
EP3937046A1 (en) Trusted startup methods and apparatuses of dedicated blockchain node device
CN110008735B (zh) 区块链中实现合约调用的方法及节点、存储介质
US11616636B2 (en) Hash updating methods and apparatuses of blockchain integrated station
EP3962021A1 (en) Service processing methods, apparatuses, devices and systems
CN109450620B (zh) 一种移动终端中共享安全应用的方法及移动终端
US11949775B2 (en) Network bound encryption for recovery of trusted execution environments
CN113329030A (zh) 区块链一体机及其密码加速卡、密钥管理方法和装置
WO2024027598A1 (zh) 一种数据传输方法、装置、存储介质及电子设备
WO2014164516A1 (en) System and method for enabling a scalable public-key infrastructure on a smart grid network
CN116491098A (zh) 使用后量子密码学的基于证书的安全性
WO2021228230A1 (zh) 一种基于安全执行环境的数据验证方法及装置
US20230222230A1 (en) Key distribution system in a secure enclave
US11671412B2 (en) Network bound encryption for orchestrating workloads with sensitive data
WO2024001022A1 (zh) 跨子网调用
CN112073433A (zh) 一种ssl证书更新方法、装置、电子设备及存储介质
US8903096B2 (en) Security key distribution in a cluster
US8751819B1 (en) Systems and methods for encoding data
CN111310206A (zh) 一种数据加密方法、节点设备及存储介质
WO2018054144A1 (zh) 对称密钥动态生成方法、装置、设备及系统
WO2018028359A1 (zh) 业务处理方法、装置、存储介质及电子装置
CN115174188A (zh) 一种消息传输方法、装置、电子设备和存储介质
CN114357482A (zh) 将区块链网络中的历史明文交易转为隐私交易的方法
CN114338629A (zh) 数据处理方法、装置、设备及介质
KR20220000537A (ko) 차량 네트워크 기반의 데이터 송수신 시스템 및 그 방법

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23849306

Country of ref document: EP

Kind code of ref document: A1