WO2007036160A1

WO2007036160A1 - An apparatus, system and method for realizing communication between the client and the server

Info

Publication number: WO2007036160A1
Application number: PCT/CN2006/002574
Authority: WO
Inventors: Tao Jiang; Weihua Chen
Original assignee: Tencent Technology (Shenzhen) Company Limited
Priority date: 2005-09-29
Filing date: 2006-09-29
Publication date: 2007-04-05
Also published as: RU2008115139A; BRPI0616627A2; CN1941738A; RU2396716C2; CN100477636C

Abstract

An apparatus for realizing communication between the client and the server which is applied to a communication system including a client, a server and a transmitting device between them. The apparatus includes: a transferring unit which establishes a private channel penetrating through said transmitting unit with the transferring server, and establishes a communication channel between the client and itself, and establishes a logical channel based on the private channel between the client and the server with the transferring server; a transferring server which establishes a private channel penetrating through said transmitting unit with the transferring unit, and establishes a communication link between the server and itself, and establishes a logical channel based on the private channel between the client and the server with the transferring unit. There are a system and a method. It will realize the communication between the client and the server penetrating through the transmitting unit by this invention.

Description

Device, system and method for realizing communication between client and server

Technical field

The present invention relates to network information interaction technologies, and in particular, to an apparatus, system and method for implementing communication between a client and a server. Background of the invention

With the rapid development of the Internet (Internet), various emerging Internet applications are emerging, Internet traffic is growing rapidly, IP address resources are becoming more and more tense, and network security issues are becoming increasingly prominent. In order to solve the problem of the increasingly scarce IP address resources and the security of the enterprise network, many enterprises or metropolitan area networks access the Internet indirectly through the use of forwarding devices. The forwarding devices mainly refer to: Network Address Translation (NAT). Device / Proxy / Firewall.

However, some of today's more complex Internet applications require an end-to-end direct-connection network to complete communications, such as applications for multimedia communication applications such as VoIP, web conferencing, etc. on the Internet that require the main application components of the client terminal and the Internet. The target server on the end performs end-to-end information interaction, and such complex Internet applications usually have one or more of the following characteristics:

The target server dynamically allocates a communication port with the client main application component;

2. The target server and the client main application component dynamically negotiate the communication ports of the two parties;

3. One or more TCP or UDP communication ports between the target server and the client main application component are required during a complete communication process;

4. The communication protocols used are relatively complex. For example, the communication protocols commonly used in these applications are: H.323, Session Initiation Protocol (SIP), Media Gateway Control Protocol (MGCP, Media Gateway Control Protocol; or Complex protocols such as H.248/MeGaCo, Media Gateway Control Protocol), and such complex protocols are generally not supported on forwarding devices, and thus may hinder end-to-end communication between the main application component and the target server. In addition, the interaction method of some complex communication protocols (such as the H.323 protocol) is as follows: The packet sent by the client main application component to the target server, except the source/destination IP address and port carried in the packet header, is reported. The data part of the file also includes the source IP address and port. After receiving the packet, the target server parses the source IP address and port from the data part of the packet, and returns a response packet to the parsed IP address and port. This interaction method requires the client main application component to be directly connected to the target server to communicate normally;

5. Communication from the public network to the private network initiated by the public network;

6. The network environment in which the application is located is diversified, and the network settings are not allowed or difficult to change;

7, the target server is relatively fixed, directly on the Internet;

8. The hardware and software of the target server are difficult to change.

On the Internet, because many private networks and public networks, that is, the Internet, introduce forwarding devices, the information that the client's main application component interacts with the target server cannot penetrate the forwarding device according to the existing communication method, thus hindering these terminals. Normal communication to the end application. The following is a detailed analysis of the reasons why the forwarding device cannot be penetrated based on the characteristics of the above application.

First, assume that: The forwarding device introduced between the private network and the Internet is a firewall, and the firewall restricts the communication port, and generally only opens a limited number of ports. However, in the above complex application, the port is dynamically allocated during the communication between the client main application component and the target server, and the communication port is dynamically changed, and is easily allocated to a port that is not open to the firewall, thus easily causing communication failure; The client main application component and the target server may negotiate multiple communication ports, and the number of ports open by the firewall is only a limited number, and the port configuration of the firewall is difficult to change, so it is difficult to allow the message to pass through the open communication port, the ordinary user It is often difficult or impossible to change the network settings, so it is difficult for these applications to communicate through the firewall. Secondly, assume that: The forwarding device introduced between the private network and the Internet is a NAT/proxy server, and the IP address of the client's main application component is the IP address of the private network. The client main application component and the target server interact with each other using a complex communication protocol (such as H.323, SIP, MGCP, H.248/MeGaCo, etc.) having the above characteristic 4. The packet sent by the client main application component to the target server first arrives at the NAT/proxy server, and the NAT/proxy server converts the source IP address and port in the packet header into the NAT IP address and port and sends the packet to the target server. According to the requirement of the protocol with feature 4, the target server parses the source IP address and port from the packet data part, and returns a response message to the source IP address and port; however, the source IP address and port included in the data part are not public. The IP address and port on the network are the IP addresses and ports on the client's private network. Therefore, the response packets returned are not routed to the correct destination IP address and port, and thus cannot reach the client's main application component, causing communication failure.

In addition, if the forwarding device is a proxy server, the protocol adopted by the above main application component is a protocol that requires end-to-end communication, and does not support a proxy protocol that interacts through the proxy server, so the client's main application component cannot communicate with the proxy server. It is even more incapable of communicating with the target server through the proxy server.

In addition, the above three forwarding devices block the communication process initiated from the public network to the private network. Summary of the invention

In view of the above, the main purpose of the present invention is to provide a device and a communication system for implementing communication between a client and a server. When a forwarding device is introduced between a client and a server, the interaction information can be transmitted through the device. And normal communication.

Another object of the present invention is to provide a method for implementing communication between a client and a server. When a forwarding device is introduced between the client and the server, the interaction information can be transmitted through the forwarding device for normal communication. In order to achieve the above object, the main technical solution of the present invention is: The present invention discloses a device for implementing communication between a client and a server, and is applied to a communication system including a client, a server, and a forwarding device between the two; The device comprises: a transit component, establishing a dedicated channel between the transit server and the forwarding device, establishing a communication connection between the client and the client, and establishing a dedicated connection between the client and the server with the transit server Logical channel of the channel;

The transit server establishes a dedicated channel that penetrates the forwarding device with the transit component, establishes a communication connection between itself and the server, and establishes a logical channel based on the dedicated channel between the client and the server with the transit component .

The dedicated channel between the transit component and the transit server is a transmission control protocol.

TCP or User Datagram Protocol UDP communication connection, and the port of the dedicated channel uses the open port of the forwarding device.

The transit server includes: a port allocation module, configured to receive a port request from a main application component and allocate a local port, and establish the reverse channel according to the port request and the local port.

The port allocation module includes: an allocation module for allocating a single TCP port, an allocation module for allocating a single UDP port, an allocation module for allocating two consecutive UDP ports; and the allocation module for allocating a single TCP port; An allocation module, an allocation module for allocating a single UDP port, and an allocation module for allocating two consecutive UDP ports receive a port request and assign a corresponding type of local port.

The device further includes: a conversion module for negotiating an address port, configured in the transit component or the relay server, configured to parse the negotiation data packet sent by the client to the server, and negotiate the IP address of the client of the data packet portion And the port translates to the IP address and port of the transit server for the current logical channel.

The invention also discloses a communication system, comprising: a client, a server and both a forwarding device connected between the client, the client includes: a main application component, the server side includes at least one target server; the system further includes: a transit component and a transit server;

a transit component, establishing a dedicated channel that penetrates the forwarding device with the transit server, establishing a communication connection between itself and the main application component, and establishing a dedicated channel between the main application component and the target server with the transit server Logical channel

The transit server establishes a dedicated channel that penetrates the forwarding device with the transit component, establishes a communication connection between itself and the target server, and establishes a logic based on the dedicated channel between the main application component and the target server with the transit component aisle.

The invention further discloses a method for realizing communication between a client and a server, which is applied to a communication system comprising: a client, a server and a forwarding device connected between the two, the method comprises: - a client and a server Establishing a dedicated channel that penetrates the forwarding device; when the main application component of the client communicates with the target server of the server, establishing a logical channel based on the dedicated channel between the main application component and the target server and communicating.

The private channel that penetrates the forwarding device is established between the client and the server, and includes: setting a transit component on the client, setting a relay server on the server; establishing the server by the transit component and the transit server Dedicated channel

The main application component establishes a logical channel based on the dedicated channel with the target server, including: the transit component establishes a communication connection between itself and the main application component, and the transit server establishes a communication connection between itself and the target server; the main application component The transit component, the transit server, and the target server respectively allocate respective communication ports, establish correspondences of the communication ports, and form a logical channel.

The transit component and the relay server establish a dedicated channel-based logical channel between the main application component and the target server, including: The main application component sends a port request carrying the IP address and port of the main application component and the IP address and port of the target server to the transit component;

The transit component encapsulates the port request using an internal protocol, forwards the encapsulated port request to the transit server through the dedicated channel, and locally allocates a forwarding interface for data forwarding; the transit server allocates the local port according to the received port request; The channel number, the IP address and port of the transit server, and the correspondence between the IP address and port of the target server;

The transit server returns the established logical channel number, the IP address and port of the transit server, and the correspondence between the IP address and the port of the target server to the transit component through the dedicated channel, and the transit component establishes the logical channel number and the main application component. The IP address and port, the transit component forwarding interface, the IP address and port of the transit server, and the IP relationship between the IP address and port of the target server;

Corresponding relationship between the IP address and port of the main application component, the forwarding interface of the transit component, the IP address and port of the transit server, and the IP address and port of the target server as the communication between the main application component and the target server aisle.

The transit component and the relay server establish a dedicated channel-based logical channel between the main application component and the target server, including:

The main application component sends a port request to the transit component that carries the IP address and port of the main application component;

The transit component encapsulates the port request by using an internal protocol, forwards the encapsulated port request to the transit server through the dedicated channel, and locally allocates a forwarding interface for data forwarding; the transit server allocates the local port according to the received port request;

The main application component sends the IP address and port of the target server to the transit component and the transit server through communication data or notification;

The transit server establishes the logical channel number, the IP address and port of the transit server, and the destination Correspondence between the IP address and port of the target server;

The transit server returns the established logical channel number, the IP address and port of the transit server, and the correspondence between the IP address and the port of the target server to the transit component, and the transit component establishes the logical channel number, the IP address of the main application component, and Port, transit component forwarding interface, IP address and port of the relay server, and the correspondence between the IP address and port of the target server;

Corresponding relationship between the IP address and port of the main application component, the transit component forwarding interface, the IP address and port of the transit server, and the IP address and port of the target server as the communication between the main application component and the target server aisle.

The method further includes: when the main application component performs port negotiation with the target server, the relay server parses the negotiation data packet sent by the main application component to the target server, and converts the negotiated IP address and port of the main application component in the data portion of the negotiation data packet. The IP address and port of the transit server of the logical channel are sent to the target server by the converted negotiation packet.

When the forwarding device introduced between the private network and the Internet is a firewall, the logical channel corresponding to the dynamically allocated port or the dynamically negotiated port uses a dedicated channel to traverse the firewall, regardless of the number of ports allocated or negotiated. The corresponding logical channel uses the dedicated channel to traverse the firewall, and the dedicated channel is a single Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) connection, and the port to which the application is applied is a port open by the firewall, which can be implemented. The information between the main application component and the target server successfully penetrates the firewall.

Since the communication between the transit component and the transit server is a simple communication conforming to the characteristics of the forwarding device, the interaction protocol used is only a simple internal protocol, and is generally not hindered by the forwarding device, so that successful penetration can be achieved. The forwarding device communicates. In addition, if the forwarding device is a NAT/proxy server, due to the transition between the transit component and the transit server The interaction protocol is just a simple internal protocol. It does not need to return a response according to the source IP address and port included in the packet data part, such as the Η.323 and SIP complex protocols, but according to the source IP address in the packet header. And the port returns a response, and the IP address and port in the header are converted by the NAT/proxy server, so the returned response can successfully penetrate the NAT/proxy server, enabling smooth communication between the main application component and the target server.

When the forwarding device introduced between the private network and the Internet is a proxy server (for example, a proxy server such as HTTP/SOCKS4/SOCKS5), the function of the proxy protocol is relatively easy to implement on the client's transit component, so even if the main application component does not support the proxy. In the case of the protocol, the interactive information can also successfully penetrate the proxy server.

The invention does not need to make any changes to the hardware and software of the target server; in the case that the transit component or the relay server supports the same protocol as the main application component, the hardware and software of the main application component need not be changed; and, there is no need to upgrade or replace the NAT/ The hardware and software of the proxy server/firewall generally do not need to change the settings of the NAT/proxy server/firewall. Therefore, while successfully traversing the NAT/proxy server/firewall, the existing hardware and software resources can be retained to the greatest extent, and the implementation cost is low.

The solution adopted by the present invention has nothing to do with the communication protocol adopted by the main application component and the target server itself, and does not need to consider the complexity of the communication protocol, and is simple to implement. Previously, the port request has traversed the forwarding device for communication, including "out" communication and "in" communication, so when the communication is initiated from the public network to the private network, since the forwarding device has recorded the private network to The process of "outbound" communication of the public network, and the logical channel has been established, so the forwarding device does not hinder the communication from the public network to the private network through the logical channel. BRIEF DESCRIPTION OF THE DRAWINGS

1 is a schematic structural view of an embodiment of the device according to the present invention; 2 is a flow chart of an embodiment of the method of the present invention. Mode for carrying out the invention

The present invention will be further described in detail below by way of specific embodiments and the accompanying drawings.

The core technical solution of the present invention is: setting a relay device on the client and the server respectively, and the two transit devices communicate through a dedicated channel, and all information exchanged between the client and the server is forwarded through the two transfer devices to other side.

First, an embodiment of the apparatus of the present invention will be described. BRIEF DESCRIPTION OF THE DRAWINGS Figure 1 is a block diagram showing an embodiment of the apparatus of the present invention. Referring to Figure 1, the entire Internet application is divided into two major physical parts: A large entity part is the part of the local area network (LAN) located in the forwarding device (ie NAT/proxy/firewall), this entity part is the client; the other entity part is located The part of the Internet that is outside the forwarding device (that is, NAT/Proxy/Firewall). This entity part is the server side. The client includes: The main application component 11 is mainly used to complete the actual functions of the client part of the entire Internet application, such as the VoIP application component and the network conference application component. The server side mainly includes: The target server 14, such as a network telephone server and a web conference server, is the actual destination for completing the entire communication with the client. The apparatus of the present invention includes a relay unit 12 at the client and a relay server 13 at the server end. The relay unit 12 and the relay server 13 communicate by establishing a dedicated channel 15, which is a single TCP/UDP connection, and the port used for the dedicated channel is a port opened by a forwarding device such as a firewall. The relay component 12 and the relay server 13 are configured to establish a logical channel between the main application component and the target server, the logical channel is established on a dedicated channel between the transit component and the transit server; the main application component and the target server pass the transit component Communicates with the logical channel established in the relay server.

Specific embodiments of the method of the present invention are described below.

2 is a flow chart of an embodiment of the method of the present invention. Referring to Figure 2, the process includes: Step 201: When the client starts, a dedicated channel is established between the client relay component and the transit server.

The dedicated channel can be a single TCP UDP communication connection, established using an open port of a forwarding device such as a firewall. If the establishment of the dedicated channel is unsuccessful at a time, the open port of the forwarding device can be detected by two or more heuristics, thereby establishing the dedicated channel on the open port. After the dedicated channel is established, all communication data between the client transit component and the transit server is transmitted through the dedicated channel, so that the main application component and the target server need to be dynamically allocated and negotiated one or more ends to The TCP UDP communication port of the terminal performs communication through the forwarding device to convert the communication to the forwarding device by a single dedicated channel, so as to maintain the original security of the network as much as possible, and at most, a fixed communication port needs to be opened on the forwarding device to complete the entire The communication process makes it very easy to penetrate the firewall.

Since the port of the main application component communicates with the port of the target server through the transit component and the relay server, when the main application component port is to communicate with the target server port, the type and number of communication ports need to be established in the transit component and the transit server. Corresponding logical channel, the communication data between the main application component port and the target server port is transmitted in the transit component and the transit server through the logical channel corresponding to the port, and finally sent to the other party. The port of the target server may be an open port configured by the main application component and configured on the main application component, or may be a port allocated by the target server as a main application component (the allocated port information may be sent to the open port through the foregoing open port) The main application component) can also be a dynamically negotiated port between the main application component and the target server.

The process of establishing a logical channel on the transit component and the relay server is the following steps 202 to 207.

Step 202: The client main application component first sends a port request to the transit component before sending data to the target server. The port request can be requested in the form of a message (such as a TCP/IP socket message and a message in the form of a Windows message), or can be requested by calling a function. Generally, the subsequent data forwarding process corresponds to the port request, and may also use the message form or the call function mode. However, if the data is sent in the form of a port message, the data is returned in the form of a port message; , when returning data, it can be returned as a port message, or it can be returned by a callback function.

In this embodiment, the port request is performed in the form of a message. The port request here carries the type and number of ports to be requested, and the IP address and port number of the target server to which the main application component will communicate, where the port numbers are 140 and 141. The type and number of ports to be requested correspond to the type and number of ports that the main application component will communicate with. The port type can be a TCP port or a UDP port. For example: The target server port to be communicated is two consecutive UDP ports 140 and 141. The port request also carries the IP address of the main application component and the port information to be communicated with the target server port. Here, it is assumed that the port is two consecutive UDP ports 110 and 111, and the transit component needs to record the main application component. IP address and port number and the IP address and port number of the target server. Here, the port request may not carry the IP address and port number of the target server, but in subsequent data communication, the IP address and port number of the target server are carried in the data packet.

Step 203: After receiving the port request message, the transit component encapsulates the port request message through the internal protocol between the transit component and the transit server, and then sends the message to the relay server through the dedicated channel. At the same time, the transit component allocates the local port according to the type and number of ports requested in the port request message, that is, allocates two consecutive local UDP ports, which are assumed to be port 120 and port 121, for subsequent packet forwarding. This local port is called the forwarding interface of the transit unit.

The internal protocol is a communication protocol with simple encapsulation and decapsulation processing, and the protocol only responds according to the IP address and port number in the packet header, but not to the data portion.

II The content is processed. Based on this feature, the protocol packet can successfully penetrate the forwarding device in both directions when traversing a forwarding device such as NAT that translates the IP address and port number of the header. For an internal protocol having the above functions, those skilled in the art can implement the same according to the prior art, and the internal protocol will not be further described herein.

Step 204: After receiving the port request message sent by the client transit component, the transit server allocates the local port according to information such as the type and quantity of the communication port included in the request message, that is, allocates two consecutive local UP ports, The port is assumed to be port 130 and port 131; then the logical channel number, the transit server IP address and port number, the destination server IP address and the port number are established, that is, the correspondence between the following Table 1 is established, and the IP address of the transit server is assumed to be C, the IP address of the target server is D:

The relay server also maintains information such as the auxiliary port information data and communication status in Table 1 in the subsequent process.

If the requested port type is a TCP port, the transit server also establishes a communication connection between the local port 130 and the port 140 corresponding to the target server, and the local port 131 and the port 141 corresponding to the target server, so as to reach the target server. Transmitting the communication data sent by the client and receiving the communication data sent back to the client by the target server.

If the port request does not carry the IP address and port of the target server, the transit server may first allocate the port locally, and wait until the packet carrying the IP address and port number of the target server is received, or is known in the main application component. After the IP address and port of the target server have not been sent, the relay server notifies the relay server, and then establishes the correspondence described in Table 1. Step 205: The relay server then returns a response message encapsulated by the internal protocol to the transit component through the dedicated channel 15, including information on whether the port request is successful, and if successful, the IP address of the transit server and the allocated port information, that is, The local port numbers 130 and 131 assigned by the transit server.

Step 206: After receiving the response message, the transit component establishes the logical channel number, the IP address and port number of the main application component, the IP address and port number of the transit component, the IP address and port number of the transit server, and the IP address and port of the target server. The correspondence between the numbers, as shown in Table 2, is that the BP address of the main application component is A, and the IP address of the transit component is B:

Table 2

The relay component returns a response message to the main application component, including the contents of Table 2 above. If the port request does not carry the IP address and port of the target server, the transit component here waits until receiving the data packet carrying the IP address and port number of the target server or receiving the notification of the main application component. Establish the correspondence described in Table 2.

After receiving the response message, the main application component can establish a local communication connection between the port 110 to be communicated locally and the port 120 of the transit component, and also establish a client local between the port 111 and the port 121 of the transit component. Communication connection; the main application component can send and receive data through port 110 and port 111.

Step 207: Correspond to the type and number of ports requested by the main application component, the IP address and port of the main application component, the forwarding interface of the transit component, the IP address and port of the transit server, and the IP address and port of the target server. The relationship acts as a logical channel for the port-to-port communication. That is, according to the correspondence between Table 1 and Table 2 above, from the main application component The communication port is the starting port, and the logical channel that can traverse the forwarding device is established through the transit component and the transit server to the communication port of the target server, that is, the IP address and port through which the logical channel 0 passes are: A/port 110 - B/ 120 - Dedicated Channel 15 - C/Port 130 - D/Port 140, The IP address and port through which Logical Channel 1 passes are: A/Port 111 - B/121 - Dedicated Channel 15 - C/Port 131-D/141. The transit component and the transit server forward the packets sent by the port of the main application component to the corresponding port of the target server through the logical channels recorded in Tables 1 and 2.

After the logical channels of different ports are established, the main application component and the target server can communicate using these channels.

Step 208: The data sent by the main application component from the port 110 is finally sent to the target server through the logical channel 0, and the data sent from the port 111 is finally sent to the target server through the logical channel 1. The following describes the data transmission process from the main application component to the target server by taking logical channel 0 as an example:

The main application component 11 transmits the data packet transmitted from the port 110 to the port 120 of the relay component 12 according to the logical channel content in Table 2; the relay component 12 determines the logic for transmitting the data packet according to the correspondence relationship in the port 110 lookup table 2 The channel is 0, and the IP address and port of the corresponding transit server are C and 130; then the internal protocol encapsulation is performed on the data to be sent, and the logical channel information corresponding to the data is encapsulated into the data packet, where the logical channel information is The logical channel number 0; the relay unit 12 forwards the encapsulated data packet to the relay server 13 through the dedicated channel 15 between the relay server 13 and the relay server 13 after receiving the encapsulated data packet. The protocol is decapsulated, and the logical channel information, that is, the logical channel number 0, is obtained, and the IP address D and the port 140 of the port 130 and the target server are further obtained through the query table 1. Then, the decapsulated data packet is sent to the target through the local port 130. Port 140 of server 14, such that port 140 of target server 14 receives the actual data to be sent by the client. 2574 Similarly, packets sent from port 111 are sent through logical channel 1 to port 141 of the target server.

Step 209: When the target server 14 wants to return the data packet to the main application component 11, the data packet returned from the port 140 is finally sent to the port 110 of the main application component 11 through the logical channel 0; the data packet returned from the port 141 passes the logic Channel 1 is ultimately sent to port 111 of main application component 11. The following describes the data transmission process from the target server to the main application component by taking logical channel 0 as an example.

The target server returns a data packet from the port 140, and the data packet is returned to the port 130 of the transit server 13; the transit server looks up the correspondence in Table 1, and determines that the logical channel of the data is 0; then, the data packet to be sent The internal channel protocol encapsulation, the logical channel information corresponding to the data packet is encapsulated into the data packet, where the logical channel information is the logical channel number 0; the transit server forwards the encapsulated data packet to the transit component 12 through the dedicated channel 15 After receiving the encapsulated data packet, the transit component 12 performs internal protocol decapsulation to obtain logical channel information, that is, a logical channel number, and the query table 2 obtains the IP address A and the port number 110 of the local port 120 and the main application component. The decapsulated data packet is then sent through the local port 120 to port 110 of the main application component 11, such that the port of the main application component receives the actual data returned by the target server.

Similarly, the packets returned from port 141 (destination IP address and port number A and port 111) are finally sent to port 111 of the main application unit via logical channel 1.

In another embodiment of the method of the present invention, the main application component initiates a port request to the transit component using a function call mode and transmits the data in a function call. The function call for the port request includes the requested port type and number, as well as the port parameters, which are used to indicate the port number of the main application component that sent the data, such as port 110 and port 111.

This embodiment is basically similar to the various implementation steps of the previous embodiment, so only the differences compared with the previous embodiment will be described below: In step 203, after receiving the port request message, the transit component encapsulates the port request message through the internal protocol between the transit component and the transit server, and then sends the message to the transit server through the dedicated channel. At the same time, the transit component allocates the local port according to the type and number of ports requested in the port request message, that is, allocates two consecutive local UDP ports, which are assumed to be port 120 and port 121, for subsequent packet forwarding. Or set the callback function, and forward the subsequent data packet through the callback function; the callback function can be two, which are respectively used to return the data to the port 110 and the port 111; or, the callback function can be one, but needs to be in the callback function The port parameter indicates the port number 110 or 111 returned by the data. The port or callback function assigned by the relay component may be collectively referred to as a forwarding interface used by the relay component to forward data. There are two forwarding interfaces here, which are set to forwarding interface 0 and forwarding interface 1. The forwarding interface 0 is a callback function of the port 120, or the callback function 0, or the port parameter is the port 110; the forwarding interface 1 is the port 121, or the callback function 1, or the port parameter is the callback function of the port 111.

In step 206, after receiving the response message, the transit component establishes the logical channel number, the IP address and port number of the main application component, the IP address and forwarding interface number of the transit component, the IP address and port number of the transit server, and the IP address of the target server. Correspondence with the port number, as shown in Table 3, the IP address of the main application component is A, and the IP address of the transit component is B:

The relay component returns a response message to the main application component, including the contents of Table 3 above. In this embodiment, for the type and number of ports requested by the main application component, according to the correspondence between Table 1 and Table 3, the communication port of the main application component is used as the starting port, and The transit component and the transit server reach the communication port of the target server, and establish a logical channel that can traverse the forwarding device, that is, the IP address and port through which the logical channel 0 passes are: A/port 110 - B/forward interface 0 - dedicated channel 15 - C /port 130 - D/port 140, the IP address and port through which logical channel 1 passes are: A/port 111 - B/forward interface 1 - dedicated channel 15 - C/port 131-D/14L transit part and transit server pass table The logical channels recorded in 1 and Table 2 forward the packets sent by the main application component port to the corresponding ports of the target server.

In step 208, the data sent by the main application component from the port 110 is sent to the relay component 12 by the calling function, and the relay component 12 finally sends the data packet to the port 140 of the target server 14 through the logical channel 0; similarly, the data sent from the port 111 It is finally sent to the port 141 of the target server 14 through the logical channel 1. When the target server wants to return the data packet to the main application component, the data packet sent from the port 140 is finally sent to the port 110 of the main application component 11 through the logical channel 0, and when the transit component forwards the data, it can be forwarded through the port 120, It can be forwarded by callback function 0, and can also be forwarded by its port parameter indicating the callback function targeted to port 110; similarly, the packet sent from port 141 is finally sent to port 111 of main application component 11 via logical channel 1.

In general, the port requested by the main application component is divided into multiple situations. There are typically three cases: 1) requesting a single TCP port; 2) requesting a single UDP port; 3) requesting two consecutive UDP ports. Therefore, a special standardized processing module can be made on the relay server for the above situation. For example, module 1 is dedicated to assigning a single TCP port, module 2 is dedicated to assigning a single UDP port, and module 3 is dedicated to allocating two consecutive UDP ports; when performing port allocation, directly calling the above processing module can make the process More integrated and improved processing efficiency. If multiple TCP UDP communication ports are required to complete the entire communication process between the main application component and the target server, the method of step 202 to step 207 may be repeatedly executed and the standard processing module is called to allocate ports, and multiple ports are respectively established. The logical channel corresponding to the TCP/UDP communication port to complete the entire communication requirement. For example, the whole pass The signaling process requires three ports, one of which is a TCP port and the other two are consecutive UDP ports. Then, step 202 to step 207 are performed first, and module 1 is used to complete the allocation of a TCP port, and a TCP logical channel is established. Then, in general step 202 to step 207, the allocation of two consecutive UDP ports is completed by using module 3, and two UDP logical channels are established correspondingly. In addition, since the requested port is divided into a plurality of cases, it is not limited to the above three types, and may be extended according to actual application changes. On the relay server, a dedicated standardized processing module may be configured for each case to perform port allocation. Make the process more integrated and improve processing efficiency.

The client main application component can also use the port number assigned by the received relay server to complete the communication port through the corresponding complex communication protocol of the main application component (for example, H.323, SIP, MGCP, H.248/MeGaCo, etc.). Negotiation process. There are two situations in which the negotiation process is implemented:

The first case: The transit component and the transit server do not support the complex protocols that the main application component has to transmit data by parsing the contents of the packet (for example, protocols such as H.323, SIP, MGCP, H.248/MeGaCo). At this time, a conversion module is further disposed in the main application component, and is configured to convert the negotiated IP address and port of the main application component carried in the data part of the data packet of the complex protocol into the IP address and port of the corresponding transit server. For example, if the negotiation port number of the main application component is 110, the IP address and port 110 of the main application component are replaced with the IP address and port number 130 of the transit server, and the data packet is sent to the target server through the corresponding reverse channel 0. The target server obtains the IP address and port 130 of the transit server from the data portion of the data packet, returns the negotiation response to the port 130 of the transit server, and returns to the main application component through the logical channel 0, and ends the negotiation process.

The second case: The relay component or the relay server supports the complex protocol of the main application component to transmit data by parsing the data packet content. At this point, the transformation module is placed in a transit component or a relay server that supports the complex protocol for parsing the components from the main application. The data portion of the data packet used for negotiation, which will be negotiated between the main application components carried

The IP address and port are converted into the IP address and port of the corresponding transit server; and the converted data packet is sent to the target server, and the target server processes the same communication protocol as the main application component, and obtains the transit server from the data portion of the data packet. The IP address and port return the negotiation response to the port of the transit server, and then return to the main application component through the corresponding logical channel, and the negotiation process ends.

Finally, when the client is closed, the client first sends a revocation port message to the transit server, requests to close the connection of the logical channel, and then dismantles the dedicated channel 15 established between the retransmission server and releases all related resources; similarly, in When the server is closed, the transit server sends a revocation port message to the client, requests to close the connection of the logical channel, and then removes the dedicated channel 15 established between the transit component and releases all related resources.

With the solution of the present invention, the information exchanged between the main application component and the target server can successfully penetrate the forwarding device introduced between the private network and the public network. The reason is as follows.

If the forwarding device is a firewall, the logical channel of the port-to-port communicates by using a dedicated channel 15 when the firewall traverses the firewall, and the dedicated channel is a single TCP or UDP connection, and the port uses the open port of the firewall, The information between the main application component and the target server is successfully penetrated the firewall.

Since the communication between the transit component and the transit server is a simple communication conforming to the characteristics of the forwarding device, the interaction protocol used is only a simple internal protocol, and is generally not hindered by the forwarding device, so that successful penetration can be achieved. The forwarding device communicates.

In addition, if the forwarding device is a NAT/proxy server, since the interaction protocol between the transit component and the transit server is only a simple internal protocol, it does not need to be based on packet data like complex protocols (such as H.323 and SIP protocols). Some of the included source IP addresses and ports return responses, but instead return responses based on the source IP address and port in the packet header. The IP address and port in the header are translated by the NAT/proxy server, so the returned response can successfully penetrate the NAT/proxy server, enabling smooth communication between the main application component and the target server.

When the forwarding device is a proxy server, such as a proxy server such as HTTP/SOCKS4/SOCKS5, the function of the proxy protocol is relatively easy to implement on the relay component of the client, so even if the main application component does not support the proxy protocol, the proxy device can be used. The interactive information successfully penetrates the proxy server.

The above is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical scope of the present invention. All should be covered by the scope of the present invention.

Claims

Claim

A device for implementing communication between a client and a server, applied to a communication system including a client, a server, and a forwarding device therebetween; wherein the device comprises:

a transit component, establishing a dedicated channel that penetrates the forwarding device with the transit server, establishing a communication connection between the client and the client, and establishing a logical channel based on the dedicated channel between the client and the server with the transit server ;

2. The device according to claim 1, wherein the dedicated channel between the transit component and the relay server is a communication connection of a Transmission Control Protocol TCP or a User Datagram Protocol UDP, and the port of the dedicated channel is forwarded. The open port of the device.

3. The system according to claim 1, wherein the relay server comprises: a port assignment module, configured to receive a port request from a main application component and allocate a local port, and establish the port according to the port request and the local port. Logical channel.

4. The apparatus according to claim 3, wherein the port assignment module comprises: an allocation module for allocating a single TCP port, an allocation module for allocating a single UDP port, and for allocating two consecutive UDP ports. Distribution module;

The allocation module for allocating a single TCP port, the allocation module for allocating a single UDP port, and the allocation module for allocating two consecutive UDP ports receive a port request and assign a corresponding type of local port.

The device according to claim 1, wherein the device further comprises: a conversion module for negotiating an address port, configured in a transit component or a relay server The method is used to parse the negotiation data packet sent by the client to the server, and convert the negotiated IP address and port of the client in the data portion of the data packet into the IP address and port of the transit server of the current logical channel.

A communication system, comprising: a client, a server, and a forwarding device connected between the two, the client includes: a main application component, the server end includes at least one target server; The system further includes: a transit component and a relay server; a transit component, establishing a dedicated channel that penetrates the forwarding device with the transit server, establishing a communication connection between itself and the main application component, and establishing a main application with the transit server a logical channel based on the dedicated channel between the component and the target server;

The system according to claim 6, wherein the dedicated channel between the relay component and the relay server is a TCP or UDP communication connection, and the port of the dedicated channel adopts an open port of the forwarding device.

The system according to claim 6, wherein the relay server comprises: a port assignment module, configured to receive a port request from a main application component and allocate a local port, and establish the port according to the port request and the local port Logical channel.

9. The system according to claim 8, wherein the port allocation module comprises: an allocation module for allocating a single TCP port, an allocation module for allocating a single UDP port, and for allocating two consecutive UDP ports. Distribution module;

Any one of the allocation module for allocating a single TCP port, the allocation module for allocating a single UDP port, and the allocation module for allocating two consecutive UDP ports for receiving a port request and allocating a corresponding type of local port .

10. The system of claim 6 wherein the system further comprises: The conversion module for negotiating the address port is set in the main application component, the transit component supporting the communication protocol of the main application component, or the transit server supporting the communication protocol of the main application component, and is used for parsing the negotiation sent by the main application component to the target server The data packet, which translates the negotiated IP address and port of the main application component of the data portion of the packet into the IP address and port of the transit server of the current logical channel.

The system according to any one of claims 6 to 10, wherein the forwarding device is a network address translation device, a proxy server, or a firewall.

A method for implementing communication between a client and a server, which is applied to a communication system including: a client, a server, and a forwarding device connected between the two, wherein the method includes:

Establishing a dedicated channel between the client and the server to penetrate the forwarding device; when the primary application component of the client communicates with the target server at the server, establishing a dedicated channel between the primary application component and the target server Logical channels and communicate.

The method according to claim 12, wherein the client and the server establish a dedicated channel that penetrates the forwarding device, including: setting a relay component on the client, and setting a relay on the server end a server; the dedicated channel is established by the transit component and the relay server;

14. The method according to claim 13, wherein the relay component and the relay server establish a dedicated channel-based logic between the main application component and the target server. Channel, including:

The main application component sends a port request carrying the IP address and port of the main application component and the IP address and port of the target server to the transit component;

The transit server returns the established logical channel number, the IP address and port of the transit server, and the correspondence between the IP address and the port of the target server to the transit component through the dedicated channel, and the transit component establishes the logical channel number and the main application component. The correspondence between the IP address and port, the transit component forwarding interface, the IP address and port of the transit server, and the IP address and port of the target server;

The method according to claim 13, wherein the relay component and the relay server establish a dedicated channel-based logical channel between the main application component and the target server, including:

The main application component sends a port request carrying the IP address and port of the main application component to the transit component;

The main application component sends the IP address and port of the target server through communication data or notification. For transit parts and transit servers;

The transit server establishes a logical channel number, an IP address and port of the transit server, and a correspondence between the IP address and the port of the target server;

The transit server returns the established logical channel number, the IP address and port of the transit server, and the correspondence between the BP address and the port of the target server to the transit component, and the transit component establishes the logical channel number, the IP address of the main application component, and Port, transit component forwarding interface, IP address and port of the transit server, and the correspondence between the IP address and port of the target server;

The method according to claim 14 or 15, wherein the port request carries the requested port type and the number of ports, and the transit server allocates the corresponding type and number of local ports according to the port request.

The method according to claim 16, wherein the requested port type and number comprise one or any combination of the following three: a single TCP port, a single UDP port, or two consecutive UDP ports.

The method according to claim 14 or 15, wherein the main application component sends a port request to the relay component in the form of a request message; the forwarding interface allocated by the relay component is a local port.

The method according to claim 14 or 15, wherein the main application component sends a port request to the relay component in the form of a call function; the forwarding interface allocated by the relay component is a local port.

The method according to claim 14 or 15, wherein the main application component sends a port request to the relay component in the form of a call function; The send interface is a callback function.

The method according to claim 12, wherein the method further comprises: when the main application component performs port negotiation with the target server, the relay server parses the negotiation data packet sent by the main application component to the target server, and The negotiated IP address and port of the main application component in the negotiation data packet part are converted into the IP address and port of the logical channel transit server, and the converted negotiation data packet is sent to the target server.

The method according to claim 12, wherein the forwarding device is a network address translation device, a proxy server or a firewall.