CN108366078A - The penetrating method and penetrating system of equipment under different NAT nodes - Google Patents

Abstract

The invention discloses a kind of penetrating methods and penetrating system of the equipment under different NAT nodes.Equipment includes the first equipment being located under the first NAT nodes and the second equipment under the 2nd NAT nodes, penetrating method include：First equipment and the second equipment obtain address and the key seed of data relay server respectively；First equipment further obtains the relay address of the second equipment, and takes relay address and establish data channel to the request of data relay server；First equipment establishes data channel with the second equipment, and generates corresponding secret key according to secret key seed, uses corresponding cipher mode transmission data.Therefore, the present invention can solve the problems, such as reliable data transmission, the transmission of data secret since the communication information of equipment room is transmitted by the cipher mode of agreement, and further very fast establish transmission channel.

Description

The penetration method and penetration system of devices under different NAT nodes

technical field

The invention relates to the technical field of communication, in particular to a penetration method and a penetration system of devices under different NAT nodes.

Background technique

At present, the solutions for traversing NAT (Network Address Translation, Network Address Translation) in network applications are mostly based on STUN (Simple Traversal of UDP Through NATs, simply using UDP to penetrate NAT) and TURN (Traversal Using Relays around NAT, in use Following the traversal of NAT) protocol family. The two clients behind the NAT use the STUN protocol to obtain the public network address of the client, and obtain the relay address of the client's public network through the TURN protocol, and finally exchange the public network address and the relay address of the peer through the signaling server , try P2P (peer-to-peer, point-to-point technology) communication first, and use TURN protocol for data transfer if it fails.

However, most of the current application scenarios for client communication behind two different NATs are real-time streaming media services such as voice and video, among which VoIP service is the most typical. Because this kind of real-time streaming media service experience pays more attention to real-time transmission, and does not pursue reliable data transmission, and because the transmission is multimedia data, the security of data transmission is not particularly demanding. The speed of the channel is also more forgiving.

Contents of the invention

The technical problem mainly solved by the present invention is to provide a penetration method and penetration system for devices under different NAT nodes, which can solve the problems of reliable data transmission, data private transmission, and extremely fast establishment of transmission channels.

In order to solve the above technical problems, a technical solution adopted by the present invention is to provide a penetration method for devices under different NAT nodes, wherein the devices include a first device under the first NAT node and a device under the second NAT node Under the second device, the penetration methods include:

The first device and the second device respectively obtain the address of the data transfer server and the key seed;

The first device further obtains the relay address of the second device, and requests the data transfer server to establish a data channel with the relay address;

The first device establishes a data channel with the second device, generates a corresponding secret key according to the secret key seed, and uses a corresponding encryption method to transmit data.

Wherein, the key seed includes at least one of AES key seed, DES key seed and RSA key seed.

Wherein, the first device obtains the address of the data transfer server and the key seed including:

The first device requests the address of the data transfer server from the first signaling server under the first NAT node, and further receives the address of the data transfer server and the key seed returned by the first signaling server.

Wherein, the second device obtains the address of the data transfer server and the key seed including:

The second device receives the address of the data transfer server and the key seed sent by the second signaling server under the second NAT node.

Among them, the penetration method also includes:

The first device and the second device request resource allocation from the data transfer server.

Wherein, the steps of the first device and the second device requesting resource allocation from the data transfer server further include:

The first device and the second device request resource allocation from the data transfer server through the first signaling server and the second signaling server respectively.

Among them, the penetration method also includes:

The first device accesses the HTTP service of the second device through the data channel.

Among them, the penetration method also includes:

The first device accesses the HTTPS service of the second device through the data channel.

In order to solve the above technical problems, another technical solution adopted by the present invention is to provide a traversal system for devices under different NAT nodes, the traversal system includes the first device under the first NAT node, the second NAT device The second device under the node and the data transfer server, wherein:

The first device and the second device respectively obtain the address of the data transfer server and the key seed;

The first device further obtains the relay address of the second device, and requests the data transfer server to establish a data channel with the relay address;

The first device establishes a data channel with the second device, generates a corresponding secret key according to the secret key seed, and uses a corresponding encryption method to transmit data.

Wherein, the key seed includes at least one of AES key seed, DES key seed and RSA key seed.

Wherein, the penetration system further includes a first signaling server located under the first NAT node;

The first device requests the address of the data transfer server from the first signaling server, and further receives the address of the data transfer server and the key seed returned by the first signaling server.

Wherein, the penetration system further includes a second signaling server located under the second NAT node;

The second device receives the address of the data transfer server and the key seed sent by the second signaling server.

Wherein, the first device and the second device request resource allocation from the data transfer server.

Wherein, the first device and the second device request resource allocation to the data transfer server through the first signaling server and the second signaling server respectively.

Wherein, the first device accesses the HTTP service of the second device through the data channel.

Wherein, the first device accesses the HTTPS service of the second device through the data channel.

The beneficial effects of the present invention are: different from the situation in the prior art, the present invention provides a penetration method and penetration system for devices under different NAT nodes, wherein the devices include the first device located under the first NAT node and the second device under the second NAT node, the penetration method includes: first, the first device and the second device respectively obtain the address of the data transfer server and the key seed, and then the first device further obtains the relay address of the second device , and bring the relay address to the data transfer server to request to establish a data channel, and finally the first device establishes a data channel with the second device, and generates a corresponding secret key according to the secret key seed, and uses the corresponding encryption method to transmit data. Therefore, the present invention can solve the problems of reliable data transmission and data private transmission because the communication information between devices is transmitted through an agreed encryption method, and can further establish a transmission channel extremely quickly.

Description of drawings

FIG. 1 is a schematic flowchart of a device penetration method under different NAT nodes provided by an embodiment of the present invention;

FIG. 2 is a schematic diagram of a network architecture corresponding to the penetration method shown in FIG. 1;

FIG. 3 is a schematic structural diagram of a penetration system for devices under different NAT nodes provided by an embodiment of the invention;

FIG. 4 is a schematic diagram of a message format of the Remote module.

Detailed ways

Please refer to Figure 1 and Figure 2, Figure 1 is a schematic flow chart of a penetration method for devices under different NAT nodes provided by an embodiment of the present invention, and Figure 2 is a schematic diagram of the network architecture corresponding to the penetration method shown in Figure 1 . Wherein, the device includes a first device located under the first NAT node and a second device located under the second NAT node.

When some hosts in the private network have been assigned local IP addresses (that is, private addresses used only in this private network), but now want to communicate with hosts on the Internet (no encryption is required), NAT can be used method.

This method requires NAT software to be installed on the router that connects the private network to the Internet. A router equipped with NAT software is called a NAT router, and it has at least one valid external global IP address. In this way, when all hosts using local addresses communicate with the outside world, their local addresses must be converted into global IP addresses on the NAT router in order to connect to the Internet.

As shown in Figure 1 and Figure 2, the penetration method of this embodiment includes the following steps:

Step S10: the first device and the second device respectively obtain the address of the data transfer server and the key seed.

In this step, the first device specifically requests the address of the data transfer server TS from the first signaling server IS located under the first NAT node, and further receives the address and password of the data transfer server TS returned by the first signaling server IS. key seed.

Specifically, the first device obtains the address of the data transfer server TS from the first signaling server IS through the HTTPS (Hyper Text Transfer Protocol over SecureSocket Layer) protocol.

The HTTPS protocol is an HTTP channel with security as its goal. Simply speaking, it is a secure version of HTTP. That is, the SSL layer is added under HTTP, and the security basis of HTTPS is SSL, so the detailed content of encryption requires SSL. It is a URI scheme (abstract identifier system), the syntax is similar to the http: system. For secure HTTP data transfer. The https: URL indicates that it uses HTTP, but HTTPS has a default port different from HTTP and an encryption/authentication layer (between HTTP and TCP). The system was initially developed by Netscape and built into its browser, Netscape Navigator, providing authentication and encrypted communication methods. It is now widely used for security-sensitive communications on the World Wide Web, such as transaction payments.

It can be understood that the first device may also obtain the address of the data transfer server TS from the first signaling server IS through other protocols, such as the HTTP protocol.

Specifically, the second device receives the address and key seed of the data transfer server TS sent by the second signaling server CS under the second NAT node.

It should be noted that while the first device receives the address and key seed of the data transfer server TS returned by the first signaling server IS, the second device also receives the data transfer server TS from the second signaling server CS. address and key seed. Therefore, the timeliness of information transmission can be guaranteed, so that the establishment of subsequent data channels can also be timely and fast.

In this embodiment, the key seeds include AES (Advanced Encryption Standard, Advanced Encryption Standard) key seeds, DES (DES full name is Data Encryption Standard, i.e. Data Encryption Standard) key seeds and RSA (Ron Rivest, Adi Shamir, Leonard At least one of the key seeds of the asymmetric encryption algorithm proposed by Adleman.

For example, only one of AES key seed, DES key seed or RSA key seed may be used. That is to say, only one of the encryption methods of AES, DES or RSA is used.

Two or three of AES key seeds, DES key seeds or RSA key seeds may also be used. That is to say, the encryption method of two or three combinations of AES, DES or RSA is adopted.

Since each encryption method has its own advantages and disadvantages, the combination of encryption methods can better integrate the advantages and avoid the disadvantages. For example, the combination of DES and RSA is used to make the advantages and disadvantages of DES and RSA complement each other. That is, DES has a fast encryption speed and is suitable for encrypting long messages, and can be used to encrypt plaintext; Encryption applied to DES keys can solve the problem of DES key distribution.

At present, the combination of RSA and DES has become the EMAIL security communication standard.

Step S11: The first device further obtains the relay address of the second device, and requests the data transfer server to establish a data channel with the relay address.

Wherein, before this step, both the first device and the second device request allocation (resource allocation) to the data transfer server TS. The data transfer server TS in this embodiment may be a TURN server supporting the RFC6062 protocol. Therefore, the first device and the second device specifically request allocation from the data transfer server TS in accordance with the RFC6062 protocol.

Further, the first device and the second device may request resource allocation to the data transfer server TS through the first signaling server IS and the second signaling server CS respectively.

In this step, specifically, the first device requests the first signaling server IS to obtain the relay address of the second device. It should be understood that at this time, the first signaling server IS requests the data transfer server TS to obtain the relay address of the second device, the data transfer server TS requests the second device to obtain the relay address of the second device, and the second device Report its own relay address to the data transfer server TS. The data transfer server TS returns the relay address of the second device to the first signaling server IS, and the first signaling server IS returns the relay address of the second device to the first device.

Further, the first device requests the data transfer server TS to establish a data channel, and then the second device and the data transfer server TS complete the connection binding, and at the same time, the first device and the data transfer server TS also complete the connection binding.

Step S12: The first device establishes a data channel with the second device, generates a corresponding key according to the key seed, and transmits data using a corresponding encryption method.

It should be understood that what kind of key seed is obtained in the previous step S10, and which encryption method is used for data transmission in this step.

If the AES key seed is obtained in step S10, then this step generates an AES key, and uses AES encryption to transmit data.

Therefore, the present invention can solve the problems of reliable data transmission and data private transmission, and further establish a transmission channel extremely quickly. In this embodiment, the first device may be a software application of the client, and the second device may be a cloud disk that can provide HTTP services to the first device. Wherein, the first device accesses the HTTP service of the second device through the data channel.

The first device can also be a software application of the client, and the second device can also be a cloud disk that can provide HTTPS services to the first device. Wherein, the first device accesses the HTTPS service of the second device through the data channel.

Please refer to FIG. 3 . FIG. 3 is a schematic structural diagram of a traversal system for devices under different NAT nodes provided by an embodiment of the invention. As shown in FIG. 3 , the traversal system 10 of this embodiment includes a first device 11 located under a first NAT node, a second device 12 located under a second NAT node, and a data transfer server 13 .

Wherein, the first device 11 and the second device 12 respectively obtain the address of the data transfer server 13 and the key seed.

Specifically, the penetration system 10 further includes a first signaling server 14 located under the first NAT node. The first device 11 requests the address of the data transfer server 13 from the first signaling server 14, and further receives the address of the data transfer server 13 and the key seed returned by the first signaling server 14. Specifically, the first device 11 obtains the address of the data transfer server 13 from the first signaling server 14 through the HTTPS protocol.

It can be understood that the first device 11 may also obtain the address of the data transfer server 13 from the first signaling server 14 through the HTTP protocol.

The difference between HTTPS and HTTP is mainly in the following four points:

1. The https protocol needs to go to CA to apply for a certificate. Generally, there are few free certificates and a fee is required.

2. http is a hypertext transfer protocol, information is transmitted in plain text, and https is a secure ssl encrypted transfer protocol.

3. http and https use completely different connection methods, and the ports used are also different. The former is 80, and the latter is 443.

4. The http connection is very simple and stateless; the HTTPS protocol is a network protocol constructed by the SSL+HTTP protocol that can perform encrypted transmission and identity authentication, which is safer than the http protocol.

Therefore, the protocol can be selected as desired.

The traversal system 10 also includes a second signaling server 15 located under the second NAT node. The second device 12 receives the address of the data transfer server 13 and the key seed sent by the second signaling server 15 .

It should be noted that while the first device 11 receives the address and key seed of the data transfer server 13 returned by the first signaling server 14, the second device 12 also receives the data transfer server 13 sent by the second signaling server 15. The address of the server 13 and the key seed. Therefore, the timeliness of information transmission can be guaranteed, so that the establishment of subsequent data channels can also be timely and fast.

In this embodiment, the key seeds include AES (Advanced Encryption Standard, Advanced Encryption Standard) key seeds, DES (DES full name is Data Encryption Standard, i.e. Data Encryption Standard) key seeds and RSA (Ron Rivest, Adi Shamir, Leonard At least one of the key seeds of the asymmetric encryption algorithm proposed by Adleman.

For example, only one of AES key seed, DES key seed or RSA key seed may be used. That is to say, only one of the encryption methods of AES, DES or RSA is used.

Two or three of AES key seeds, DES key seeds or RSA key seeds may also be used. That is to say, the encryption method of two or three combinations of AES, DES or RSA is adopted.

Since each encryption method has its own advantages and disadvantages, the combination of encryption methods can better integrate the advantages and avoid the disadvantages. For example, the combination of DES and RSA is used to make the advantages and disadvantages of DES and RSA complement each other. That is, DES has a fast encryption speed and is suitable for encrypting long messages, and can be used to encrypt plaintext; Encryption applied to DES keys can solve the problem of DES key distribution.

At present, the combination of RSA and DES has become the EMAIL security communication standard.

Both the first device 11 and the second device 12 request allocation (resource allocation) from the data transfer server 13 . The data transfer server 13 in this embodiment may be a TURN server supporting the RFC6062 protocol. Therefore, the first device 11 and the second device 12 specifically request allocation from the data transfer server 13 in accordance with the RFC6062 protocol.

Further, the first device and the second device may request resource allocation to the data transfer server TS through the first signaling server IS and the second signaling server CS respectively.

The first device 11 further obtains the relay address of the second device 12, and requests the data transfer server 13 to establish a data channel with the relay address. The specific process is as described above, and will not be repeated here.

The first device 11 establishes a data channel with the second device 12, generates a corresponding key according to the key seed, and transmits data using a corresponding encryption method.

It should be understood that what kind of key seed is obtained above, that is, which encryption method is used for data transmission.

If the AES key seed is obtained above, generate an AES key and use AES encryption to transmit data.

Therefore, the present invention can solve the problems of reliable data transmission and data private transmission, and further establish a transmission channel extremely quickly. In this embodiment, the first device 11 may be a software application of the client, and the second device 12 may be a cloud disk that can provide HTTP services to the first device. Wherein, the first device accesses the HTTP service of the second device through the data channel.

Wherein, both the first device 11 and the second device 12 are integrated with a Remote (remote) module. It communicates with the data transfer server 13 through the Remote module. Specifically as shown in 3 , the first device 11 includes an Http client 111 and a Remote module 112 , and the second device 12 includes an Http server 121 , an NGINX server 122 and a Remote module 123 .

When the first device 11 and the second device 12 are respectively behind the NAT nodes, the first device 11 will realize fast and secure access to the second device 12 through the Remote module 112 . The Remote module completes reliable data transmission, encrypted transmission, and rapid establishment of transmission channels. Its message format is shown in Figure 4.

The above is only an embodiment of the present invention, and does not limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made by using the description of the present invention and the contents of the accompanying drawings, or directly or indirectly used in other related technologies fields, all of which are equally included in the scope of patent protection of the present invention.

Claims (10)

1. A penetration method for devices under different NAT nodes, wherein the device includes a first device under a first NAT node and a second device under a second NAT node, wherein the Penetration methods include: The first device and the second device respectively obtain the address of the data transfer server and the key seed; The first device further obtains the relay address of the second device, and requests the data transfer server to establish a data channel with the relay address; The first device establishes a data channel with the second device, generates a corresponding secret key according to the secret key seed, and transmits data using a corresponding encryption method. 2. The penetration method according to claim 1, wherein the acquisition by the first device of the address of the data transfer server and the key seed comprises: The first device requests the address of the data transfer server from the first signaling server under the first NAT node, and further receives the address of the data transfer server and the address of the data transfer server returned by the first signaling server. The above key seed. 3. The penetration method according to claim 1, wherein the acquisition of the address and key seed of the data transfer server by the second device comprises: The second device receives the address of the data transfer server and the key seed sent by the second signaling server under the second NAT node. 4. The penetration method according to claim 1, further comprising: The first device and the second device request resource allocation from the data transfer server. 5. The penetration method according to claim 1, further comprising: The first device accesses the HTTP service of the second device through the data channel. 6. A traversal system for devices under different NAT nodes, characterized in that the traversal system includes a first device under a first NAT node, a second device under a second NAT node, and a data transfer server, where: The first device and the second device respectively obtain the address and key seed of the data transfer server; The first device further obtains the relay address of the second device, and requests the data transfer server to establish a data channel with the relay address; The first device establishes a data channel with the second device, generates a corresponding secret key according to the secret key seed, and transmits data using a corresponding encryption method. 7. The penetration system according to claim 6, further comprising a first signaling server located under the first NAT node; The first device requests the address of the data transfer server from the first signaling server, and further receives the address of the data transfer server and the key seed returned by the first signaling server. 8. The penetration system according to claim 6, further comprising a second signaling server located under the second NAT node; The second device receives the address of the data transfer server and the key seed sent by the second signaling server. 9. The traversal system according to claim 6, wherein the first device and the second device request resource allocation from the data transfer server. 10. The penetration system according to claim 6, wherein the first device accesses the HTTP service of the second device through the data channel.