Data transmission method, distributor, data transmission system and medium

Abstract

The application provides a data transmission method, a distributor, a data transmission system and a medium, relates to the technical field of computers, and the method is applied to a distributor device arranged between a zero-trust server cluster and a switch, and comprises the following steps: receiving a client virtual IP and a target server MAC address sent by a target server after the target server is logged in at a client and is assigned a virtual IP; writing the corresponding relationship into a first ARP table; receiving an access data packet sent by the target server, forwarding the access data packet to a business system through the switch; receiving a response data packet sent by the switch, the response data packet having a client virtual IP as a destination IP; querying the first ARP table according to the destination IP to obtain the target server MAC address, forwarding the response data packet to the target server, and returning the response data packet to the client by the target server. According to the application, the virtual IP and the server MAC are mapped and stored by the distributor, accurate packet forwarding of the cluster is realized, and resource waste caused by multicast of the switch is avoided.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a data transmission method, distributor, data transmission system and medium. Background Technology

[0002] In gateway cluster deployment scenarios, when clients access business systems through gateway servers, the gateway servers assign fixed virtual IPs (Internet Protocol) to the clients. When the business system returns data, because the same virtual IP may correspond to multiple gateway servers, the switch cannot determine the gateway server returning the data. This often results in a mass transmission method, leading to resource waste and low efficiency. Therefore, improving data backhaul efficiency in cluster scenarios has become an urgent technical problem to be solved. Summary of the Invention

[0003] This application provides a data transmission method, distributor, data transmission system, and medium to at least solve the above-mentioned technical problems existing in the prior art.

[0004] According to a first aspect of this application, a data transmission method is provided, applied to a distributor deployed between a zero-trust server cluster and a switch, the method comprising: The system receives registration information sent by the target server in the zero-trust server cluster. The registration information is sent by the target server after the client logs in and is assigned a Virtual Internet Protocol (VIP) address. The registration information includes the client's virtual IP address and the target server's Media Access Control (MAC) address. Write the mapping between the client's virtual IP and the target server's MAC address into the first Address Resolution Protocol (ARP) table; The system receives access data packets sent by the target server and forwards the access data packets to the business system through the switch. The access data packets are generated and sent by the target server when the client sends an access request to the business system through the target server. The access data packets include a first source IP address and a first destination IP address. The first source IP address is the virtual IP address of the client, and the first destination IP address is the IP address of the business system. The system receives a response data packet sent by the switch. The response data packet is sent by the switch after receiving the response data packet returned by the business system. The response data packet includes a second source IP address and a second destination IP address. The second source IP address is the IP address of the business system, and the second destination IP address is the virtual IP address of the client. The first ARP table is queried based on the destination IP of the response data packet to obtain the MAC address of the target server, and the response data packet is forwarded to the target server based on the MAC address of the target server, so that the target server can return the response data packet to the client.

[0005] In one possible implementation, writing the mapping between the client's virtual IP and the target server's MAC address into the first ARP table includes: Check if the first ARP table already contains an entry corresponding to the client's virtual IP; If it does not exist, then directly add the mapping relationship between the client's virtual IP and the target server's MAC address to the first ARP table; If it already exists, then the MAC address in the original entry will be overwritten with the MAC address of the target server.

[0006] In one possible implementation, the response data packet is sent by the switch according to a second ARP table after receiving the response data packet returned by the service system. The second ARP table records the correspondence between the client's virtual IP and the MAC address of the distributor.

[0007] In one possible implementation, the access data packet is an inner IP packet obtained by decapsulating the first tunnel data packet sent by the target server to the client; the outer source IP of the first tunnel data packet is the client's real exit IP, and the outer destination IP is the IP of the target server.

[0008] In one possible implementation, the target server returns the response data packet to the client by: The target server performs tunnel encapsulation on the response data packet to obtain a second tunnel data packet with the outer source IP being the target server's IP and the outer destination IP being the client's real egress IP, and then sends the second tunnel data packet to the client.

[0009] In one possible implementation, the method further includes: The client receives new registration information from a new server in the zero-trust server cluster, excluding the target server. The new registration information is sent by the new server after the client re-logs in to the new server and is assigned the same virtual IP. The new registration information includes the client's virtual IP and the MAC address of the new server. The new registration information overwrites the MAC address corresponding to the client's virtual IP in the first ARP table.

[0010] According to a second aspect of this application, a distributor is provided, comprising: At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method described in this application.

[0011] According to a third aspect of this application, a data transmission system is provided, comprising: switch; Zero-trust server cluster, consisting of multiple servers; The aforementioned distributor is deployed between the zero-trust server cluster and the switch.

[0012] According to a fourth aspect of this application, a non-transitory computer-readable storage medium is provided storing computer instructions for causing the computer to perform the methods described in this application.

[0013] This application discloses a data transmission method, distributor, data transmission system, and medium. It receives the client's virtual IP address and the target server's MAC address from the target server after the client logs in and is assigned a virtual IP address. This mapping is written into a first ARP table. The application receives access data packets from the target server and forwards them to the business system via a switch. It also receives response data packets from the switch, with the destination IP being the client's virtual IP address. Based on this destination IP, the application queries the first ARP table to obtain the target server's MAC address and forwards the response data packet to the target server, which then returns it to the client. This application uses a distributor to store the mapping between virtual IP addresses and server MAC addresses, achieving precise forwarding of cluster response packets and avoiding resource waste caused by switch multicast. By introducing a distributor and storing the mapping table between client virtual IP addresses and target server MAC addresses, precise forwarding of response data packets from the business system to the target server is achieved, thus avoiding resource waste and reduced response packet efficiency caused by the switch multicasting response data packets to all servers in the cluster. Simultaneously, by assigning fixed virtual IP addresses to clients, the application solves the problem of clients having non-fixed physical IP addresses while the business system requires fixed IP addresses for auditing and traceability.

[0014] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this application, nor is it intended to limit the scope of this application. Other features of this application will become readily apparent from the following description. Attached Figure Description

[0015] The above and other objects, features, and advantages of exemplary embodiments of this application will become readily apparent from the following detailed description taken in conjunction with the accompanying drawings. Several embodiments of this application are illustrated in the drawings by way of example and not limitation, in which: In the accompanying drawings, the same or corresponding reference numerals indicate the same or corresponding parts.

[0016] Figure 1 A schematic diagram illustrating the implementation process of the reverse proxy solution is shown. Figure 2 A schematic diagram illustrating the implementation flow of the data transmission method provided in an embodiment of this application is shown; Figure 3 This illustration shows a schematic diagram of the implementation flow of the ARP table construction operation in the data transmission method provided in this application embodiment; Figure 4 The illustration shows a schematic diagram of the implementation process of a specific application example provided in the embodiments of this application; Figure 5 A schematic diagram of the data transmission system provided in an embodiment of this application is shown. Detailed Implementation

[0017] To make the objectives, features, and advantages of this application more apparent and understandable, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0018] First, let's describe the application scenario of this application. Before deploying a gateway device, the business system is directly exposed to the internet, and the actual IP address of the client can be obtained when the client accesses it. However, the direct exposure of the business system to the internet poses a significant security risk. Therefore, the client retreats the business system to its internal network and deploys a gateway at the border for proxy access. At this point, the business system still wants to obtain the client's accessing IP address, and even prefers that the client's accessing IP address be fixed for traceability at the business level. This raises two technical issues that need to be addressed: First, after the data accessed by the client passes through the border gateway product, its source IP address is replaced with the gateway's internal network IP address, and the business system cannot directly obtain the client's original IP address; second, the client itself may be connected to the internet via a community broadband connection or a mobile hotspot, and does not have a fixed physical IP address.

[0019] To address the above requirements, reverse proxy solutions or VPN (Virtual Private Network) solutions are typically used. In reverse proxy solutions, such as... Figure 1 As shown, the reverse proxy server hides the real IP address of the business system from the outside world, but it also hides the client's IP address from the business system. After the client sends a request to the browser, the reverse proxy server writes the client's incoming IP address into the X-Forwarded-For field of the HTTP header, and then forwards the request to the business system. The business system obtains and parses the client's incoming IP address from this field, organizes the response packet, and forwards it to the client through the reverse proxy server. However, this solution requires corresponding modifications to the business system and cannot solve the problem that the client itself does not have a fixed IP address.

[0020] Another solution is the VPN solution. In scenarios where the zero-trust server operates as a single machine or in dual-machine hot standby (essentially still a single machine), it's necessary to meet the requirement of transparently transmitting the client's virtual IP to the business system. This solution typically also requires clients to be assigned a fixed virtual IP address after logging in with a fixed device and account, so that the business system can perform auditing based on the fixed IP address. It also meets the business system's requirement for a fixed IP address for client access when the client does not have a fixed physical IP. At the network layer, the client communicates with the zero-trust server through a tunnel. The server decapsulates the packet and sends the inner IP packet (source IP is the client's virtual IP, destination IP is the business system's IP) to the business system. The business system's response packet is then encapsulated in the tunnel by the zero-trust server and returned to the client.

[0021] However, VPN solutions are only suitable for single-machine or dual-machine hot standby modes. Problems arise in cluster deployments. Specifically, when zero-trust servers are deployed in a cluster (e.g., three servers), the switch cannot handle session-based packet return. This means that the service packet corresponding to the data packet forwarded from one server to the switch needs to be forwarded back to the same server by the switch. To address this, the switch must be configured to forward the same data packet to all servers in the cluster; only the correct server receives it, while the others discard it. However, this causes the remaining servers to consume CPU (Central Processing Unit) resources processing useless packets, and the overall packet volume on the link is doubled. This might be manageable in low-traffic scenarios, but cluster deployments are designed for high-load scenarios, inevitably resulting in higher traffic. With the data volume doubled, the CPU will experience significant idle time, significantly reducing overall processing efficiency. Therefore, reverse proxy solutions cannot simultaneously solve the problems of transparently transmitting client IPs and fixed IPs; only VPN solutions are viable. However, VPN solutions in cluster mode suffer from low packet forwarding efficiency and high resource consumption. Therefore, in order to solve the problems of low packet forwarding efficiency and high loss in the cluster mode based on VPN scheme, this application proposes a data transmission method, distributor, data transmission system, device and storage medium.

[0022] Figure 2 A schematic diagram illustrating the implementation flow of the data transmission method provided in an embodiment of this application is shown.

[0023] refer to Figure 2 This application provides a data transmission method, executed by a distributor deployed between a zero-trust server cluster and a switch, the method comprising: Operation 101: Receive registration information sent by the target server in the zero-trust server cluster. The registration information is sent by the target server after the client logs in and is assigned a Virtual Internet Protocol (VIP) IP address. The registration information includes the client's virtual IP address and the target server's Media Access Control (MAC) address.

[0024] When users need to access internal business systems, such as enterprise OA and financial systems deployed on the intranet, their clients must first connect to a secure access environment built by a zero-trust server. To do this, the client needs to log in to one of the servers (also known as the gateway) in the zero-trust server cluster as the target server to complete authentication and obtain a virtual IP address representing itself within the intranet. However, in a clustered deployment environment, multiple servers will assign virtual IP addresses to different clients, but the switch does not know which server is currently providing service for each virtual IP address.

[0025] Therefore, to ensure the business system can accurately locate the corresponding server, this step is designed so that after the target server logs in and is assigned a virtual IP address by the client, it proactively sends the virtual IP address and its own MAC (Media Access Control) address as registration information to the distributor. The MAC address is the unique physical identifier of the network interface, used for data link layer addressing.

[0026] Operation 102: Write the mapping between the client's virtual IP and the target server's MAC address into the first Address Resolution Protocol (ARP) table.

[0027] As the number of registration information received by the distributor from different servers increases, in order to efficiently and uniquely query the corresponding server's MAC address during the return transmission, this step centrally stores the obtained virtual IP and MAC address mapping in a specially maintained address table. In this embodiment, this table is referred to as the first ARP (Address Resolution Protocol) table. The ARP table is originally used to resolve IP addresses to MAC addresses; here, leveraging its fast lookup feature, the virtual IP is used as the index, and the server's MAC address is stored as the result. After being written, the distributor has a dynamically updated mapping database, preparing for subsequent accurate forwarding.

[0028] Operation 103: Receive the access data packet sent by the target server and forward the access data packet to the business system through the switch; The access data packet is generated and sent by the target server when the client sends an access request to the business system through the target server. The access data packet includes a first source IP address and a first destination IP address. The first source IP address is the client's virtual IP address, and the first destination IP address is the IP address of the business system.

[0029] In one embodiment of this application, the access data packet is the inner IP packet obtained by decapsulating the first tunnel data packet sent by the target server to the client; the outer source IP of the first tunnel data packet is the client's real exit IP, and the outer destination IP is the target server's IP.

[0030] After the client successfully logs into the target server and is assigned a fixed virtual IP, when a user needs to access an internal business system, the client needs to send a request. To prevent the source IP from being modified by devices along the public network during transmission, while ensuring the business system can recognize the client's fixed virtual IP, the client does not directly send the raw IP packet. Instead, it first encapsulates the original request into a first tunnel data packet using tunnel encapsulation. This first tunnel data packet has a two-layer structure: Outer Layer: Enter the client's actual outgoing IP address for the source IP, such as the public IP address of a mobile hotspot. Enter the target server's IP address for the destination IP. The purpose of this layer is to ensure that data packets can be correctly routed to the target server over the public internet. Since the outer source IP is a real physical address, the target server will only replace the outer source IP when necessary, without affecting the inner layer.

[0031] Inner layer: The actual access data packet, with its source IP being the client's virtual IP and its destination IP being the business system's IP. This layer contains the request content that the business system ultimately sees.

[0032] The client sends the first tunnel data packet to the target server. Upon receiving it, the target server removes the outer tunnel header, decapsulates it, and reconstructs the inner access data packet. Then, the target server sends this access data packet to the distributor. The distributor receives it and forwards it to the switch, which then delivers the access data packet to the business system via normal routing. Thus, in the request received by the business system, the source IP appears to be the client's fixed virtual IP, rather than the client's real physical IP. This satisfies the business system's need for auditing and tracing fixed IPs, and also successfully completes the forwarding of the access request, creating conditions for the subsequent generation and return of response data packets by the business system.

[0033] Operation 104: Receive response data packets sent by the switch. The response data packets are sent by the switch after receiving the response data packets returned by the business system. The response data packets include a second source IP address and a second destination IP address. The second source IP address is the IP of the business system, and the second destination IP address is the virtual IP of the client.

[0034] After the business system processes the request, it generates a response data packet and forwards the response data packet to the switch. The source IP address of the response data packet is the destination IP address of the access data packet, which is the IP address of the business system. The destination IP address is the source IP address of the access data packet, which is the virtual IP address of the client.

[0035] Operation 105: Query the first ARP table based on the destination IP of the response packet to obtain the MAC address of the target server, and forward the response packet to the target server based on the MAC address of the target server, so that the target server can return the response packet to the client.

[0036] In one embodiment of this application, the target server returns a response data packet to the client through the following operation: the target server performs tunnel encapsulation on the response data packet to obtain a second tunnel data packet with the outer source IP being the target server's IP and the outer destination IP being the client's real exit IP, and sends the second tunnel data packet to the client.

[0037] Specifically, after receiving the response packet from the switch, the distributor needs to identify the target server in order to forward the response packet only to the target server that actually handles the client session and finally return it securely to the client.

[0038] Because the target server has already registered the client's virtual IP and its own MAC address in the distributor's first ARP table during operations 101 and 102, the distributor only needs to extract the destination IP of the response packet (i.e., the client's virtual IP) and query the first ARP table to uniquely obtain the target server's MAC address. Then, the distributor directly sends the response packet as a data link layer frame to the target server corresponding to that MAC address. In this way, only this one target server in the cluster will receive the response packet; other servers will not receive irrelevant data, thus avoiding the resource waste caused by the switch multicasting the response packet to all servers in traditional solutions.

[0039] After receiving the response data packet forwarded by the distributor, the target server needs to return it to the client. Since the client is located on the public network, its real physical IP address (i.e., the client's real egress IP address) may change dynamically, and the client's virtual IP address is only valid within the internal network and cannot be directly routed on the public network. To enable the response data packet to traverse the public network and reach the client while maintaining the integrity of the inner response data packet, the target server uses the reverse method of encapsulating the first tunnel data packet in operation 103 to perform tunnel encapsulation on the response data packet. Specifically, the target server uses the received response data packet as the inner payload to construct an outer tunnel packet, called the second tunnel data packet. The outer source IP address of this second tunnel data packet is filled with the target server's own IP address, and the outer destination IP address is filled with the client's real egress IP address. After encapsulation, the target server sends the second tunnel data packet to the public network. This data packet is routed through the public network and eventually reaches the network interface corresponding to the client's real egress IP address. Upon receiving it, the client strips off the outer tunnel header, reconstructs the inner response data packet, and thus obtains the response content from the business system.

[0040] Thus, this embodiment of the application introduces a distributor to store a mapping table between client virtual IPs and target server MAC addresses, achieving precise forwarding of response data packets from the business system to the target server. This avoids the resource waste and reduced return packet efficiency caused by the switch multicasting response data packets to all servers in the cluster. Simultaneously, by assigning fixed virtual IPs to clients, the problem of client physical IPs being variable while the business system requires fixed IPs for auditing and traceability is solved.

[0041] Figure 3 This illustration shows a schematic diagram of the implementation process of the ARP table construction operation in the data transmission method provided in this application embodiment.

[0042] In one embodiment of this application, the mapping relationship between the client's virtual IP and the target server's MAC address is written into the first ARP table, including: Operation 201: Check if the first ARP table already contains an entry corresponding to the client's virtual IP. Operation 202: If it does not exist, directly add the mapping relationship between the client's virtual IP and the target server's MAC address to the first ARP table. Operation 203: If the MAC address already exists, replace the existing MAC address in the table with the MAC address of the target server.

[0043] Specifically, in a clustered deployment environment, clients may log in to different target servers multiple times due to network fluctuations, server failures, or active reconnection, but each time they log in, they are assigned the same virtual IP, for example, the account is bound to the virtual IP. In this case, if the dispatcher simply appends the new mapping relationship to the first ARP table each time it is registered, it will result in the same virtual IP corresponding to multiple different server MAC addresses, causing confusion during packet forwarding and making it impossible to determine a unique target server.

[0044] Therefore, when the distributor performs a write operation on the first ARP table, it first checks whether a corresponding entry already exists for the virtual IP. If it does not exist, a new mapping record is added directly; if it already exists, it means that the virtual IP has been previously registered with another server, for example, if the client previously logged into another server. In this case, the distributor uses the MAC address of the target server to overwrite the original MAC address. In this way, each virtual IP in the first ARP table always corresponds to only one latest and valid server MAC address.

[0045] For example, when terminal device X logs into server A for the first time, the distributor establishes a mapping between the virtual IP and the MAC address of server A. When terminal device X logs into server B again due to a failure and obtains the same virtual IP, the distributor overwrites the original record with the MAC address of server B, ensuring that subsequent response packets are forwarded to server B. Through this one-to-one overwrite writing strategy, the distributor always maintains a unique and accurate mapping between the virtual IP and the server currently serving the client, providing a reliable basis for the accurate forwarding of subsequent response packets.

[0046] In one embodiment of this application, the distributor also receives new registration information sent by a new server other than the target server in the zero-trust server cluster; the new registration information is sent by the new server after the client re-logs in to the new server and is assigned the same virtual IP; the new registration information includes the client's virtual IP and the MAC address of the new server; the new registration information overwrites the MAC address corresponding to the client's virtual IP in the first ARP table.

[0047] Figure 4 The diagram illustrates the implementation flow of a specific application example provided in this application embodiment.

[0048] To further illustrate the technical solution of this application, a specific application example is provided below.

[0049] refer to Figure 4 In this specific application example, a data transmission method, also known as a method for improving the efficiency of transparent client virtual IP return packets in a security gateway cluster deployment, and the client, also known as a zero-trust client, are included in this specific application example: Step 1: User login.

[0050] The client initiates a login request, authenticates its identity through one of the servers in the zero-trust server cluster, and establishes a tunnel connection. After successful login, the target server assigns the client a fixed virtual IP address.

[0051] Step 2: Register the MAC address on the server.

[0052] After the target server receives client login and is assigned a virtual IP address, it proactively sends the client's virtual IP address and its own MAC address (the MAC address of the server's network interface card) as registration information to the distributor. The distributor receives and stores this mapping in its local ARP table. If the virtual IP address already exists in the ARP table, the newly received MAC address overwrites the existing record. Upon successful writing, the distributor informs the target server that the write was successful. At this point, the tunnel between the target server and the zero-trust client is successfully established, and subsequent communication will be based on this tunnel.

[0053] Step 3: User accesses the business system. The client sends a tunnel data packet (i.e., the first tunnel data packet) to the target server. The encapsulation structure of this tunnel data packet is as follows: Outer source IP: The client's actual outgoing IP (client's outgoing IP); Outer destination IP: IP of the target server (zero trust service IP). Inner source IP: Client virtual IP; Inner layer destination IP: Business system IP.

[0054] Step 4: Target server unpacks the data packet. After receiving the first tunnel data packet, the target server strips off the outer tunnel header and decapsulates it to obtain the inner access data packet. The source IP of this access data packet is the client's virtual IP, and the destination IP is the IP of the business system (i.e., the internal network IP).

[0055] Step 5: The access packet is forwarded to the distributor. The target server sends the decapsulated access packet to the distributor's IP address. The distributor receives the access packet.

[0056] Step 6: Distributor forwards to switch. The distributor forwards the access packets to the switch.

[0057] Step 7: The switch forwards the request to the business system. Following standard routing rules, the switch sends the access data packet to the business system. Upon receiving the request, the business system displays the source IP as the client's virtual IP.

[0058] Step 8: The business system returns a response packet (i.e., a response data packet). After processing the request, the business system generates a response data packet. The source IP of this response data packet is the business system's IP, and the destination IP is the client's virtual IP. The business system then sends the response packet to the switch.

[0059] Step 9: The switch forwards the response packet to the distributor based on its ARP table. The switch's ARP table contains a mapping between the client's virtual IP address and the distributor's MAC address. Therefore, the switch forwards the response packet to the distributor instead of sending it directly to the zero-trust server cluster.

[0060] Step 10: The distributor queries the mapping table and forwards the packet to the corresponding server. After receiving the response packet, the distributor queries its own first ARP table (which records the mapping between virtual IPs and target server MAC addresses through registration information) using the destination IP (i.e., the client's virtual IP) to obtain the target server's MAC address. Based on this, the distributor accurately forwards the response packet to the corresponding target server.

[0061] Step 11: The target server encapsulates the response packet. After receiving the response data packet, the target server performs tunnel encapsulation on it to obtain the second tunnel data packet. The encapsulation structure is as follows: Outer source IP: IP of the target server (zero-trust service IP); Outer destination IP: The client's actual outgoing IP (client's outgoing IP); Inner source IP: Business system IP; Inner destination IP: Client virtual IP.

[0062] Step 12: Send to Client. The target server sends the second tunnel data packet to the public network, and this packet eventually reaches the client via routing. After the client peels back the outer tunnel, it obtains the inner response data packet, completing a full business access.

[0063] Based on the above data transmission method, this application also provides a distributor, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the data transmission method of this application.

[0064] Based on the above data transmission method, this application also provides a data transmission system, which includes: a switch; a zero-trust server cluster including multiple servers; and a distributor deployed between the zero-trust server cluster and the switch.

[0065] To further illustrate the structure and principles of the system in this application, a specific application example is provided below.

[0066] Figure 5 A schematic diagram of the data transmission system provided in an embodiment of this application is shown.

[0067] refer to Figure 5 The interaction flow of the data transmission system in this specific application example is as follows: The local IP of the zero-trust client is 192.168.1.8, the egress IP, which is the client's real egress IP, is 223.78.32.5, and the virtual IP assigned after login is 10.22.43.66.

[0068] 1. After the tunnel is established, the incoming data flow is as follows: Source IP: 223.78.32.5, Destination IP: 103.25.42.15, Inner Source IP: 10.22.43.66, Inner Destination IP: 172.16.5.2.

[0069] The incoming data stream, or first tunnel data packet, is sent to a zero-trust server in the zero-trust server cluster. Examples of zero-trust server clusters include a zero-trust server with an external IP address of 103.25.42.15 and internal IP addresses of 172.16.33.55, 172.16.33.56, and 172.16.33.57. The outer source IP is the client's real outgoing IP address (223.78.32.5), the outer destination IP is the target server's IP address (103.25.42.15), the inner source IP is the client's virtual IP address (10.22.43.66), and the inner destination IP is the business system's IP address (172.16.5.2).

[0070] 2. Inbound data flow: Source IP: 10.22.43.66, Destination IP: 172.16.5.2, forwarded by the zero-trust server 172.16.33.56.

[0071] Taking the zero-trust server 172.16.33.56 as the target server for illustration, after receiving the first tunnel data packet, it decapsulates it to obtain the inner access data packet (the source IP is the virtual IP and the destination IP is the business system IP), and sends the access data packet to the distributor.

[0072] 3. Inbound data stream: Source IP: 10.22.43.66, Destination IP: 172.16.5.2.

[0073] After receiving the access packet, the distributor forwards it to the switch.

[0074] 4. Inbound data flow: Source IP: 10.22.43.66, Destination IP: 172.16.5.2.

[0075] The switch sends access data packets to the business system, also known as the business server.

[0076] 5. Response data stream: Source IP: 172.16.5.2, Destination IP: 10.22.43.66.

[0077] After the business system processes the request, it generates a response data stream, which is a response data packet. Its source IP is the business system's IP (172.16.5.2), and its destination IP is the client's virtual IP (10.22.43.66), and it is sent to the switch.

[0078] 6. Response data stream: Source IP: 172.16.5.2, Destination IP: 10.22.43.66.

[0079] After receiving the response packet, the switch forwards the response packet to the distributor according to its own ARP table.

[0080] 7. Response data stream: Source IP: 172.16.5.2, Destination IP: 10.22.43.66, forwarded by the distributor to server 172.16.33.56.

[0081] After receiving the response packet, the distributor extracts its destination IP (client virtual IP), queries the local first ARP table to obtain the MAC address of the target server (IP 172.16.33.56), and then forwards the response packet to the target server.

[0082] 8. Response data stream: Source IP: 103.25.42.15, Destination IP: 233.78.32.5, Inner source IP: 172.16.5.2, Inner destination IP: 10.22.43.66.

[0083] The target server encapsulates the response data packet through a tunnel to obtain a second tunnel data packet: source IP: 103.25.42.15, destination IP: 233.78.32.5, inner source IP: 172.16.5.2, inner destination IP: 10.22.43.66, and then sends this second tunnel data packet to the client.

[0084] Based on the above data transmission method, this application also provides a non-transitory computer-readable storage medium storing computer instructions, which are used to cause a computer to execute the above data transmission method.

[0085] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this application can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this application can be achieved, and this is not limited herein.

[0086] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "a plurality of" means two or more, unless otherwise explicitly specified.

[0087] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A data transmission method, characterized in that, Applied to a distributor deployed between a zero-trust server cluster and a switch, the method includes: The system receives registration information sent by the target server in the zero-trust server cluster. The registration information is sent by the target server after the client logs in and is assigned a Virtual Internet Protocol (VIP) address. The registration information includes the client's virtual IP address and the target server's Media Access Control (MAC) address. Write the mapping between the client's virtual IP and the target server's MAC address into the first Address Resolution Protocol (ARP) table; The system receives access data packets sent by the target server and forwards the access data packets to the business system through the switch. The access data packets are generated and sent by the target server when the client sends an access request to the business system through the target server. The access data packets include a first source IP address and a first destination IP address. The first source IP address is the virtual IP address of the client, and the first destination IP address is the IP address of the business system. The system receives a response data packet sent by the switch. The response data packet is sent by the switch after receiving the response data packet returned by the business system. The response data packet includes a second source IP address and a second destination IP address. The second source IP address is the IP address of the business system, and the second destination IP address is the virtual IP address of the client. The first ARP table is queried based on the destination IP of the response data packet to obtain the MAC address of the target server, and the response data packet is forwarded to the target server based on the MAC address of the target server, so that the target server can return the response data packet to the client.

2. The method according to claim 1, characterized in that, The step of writing the mapping between the client's virtual IP and the target server's MAC address into the first ARP table includes: Check if the first ARP table already contains an entry corresponding to the client's virtual IP; If it does not exist, then directly add the mapping relationship between the client's virtual IP and the target server's MAC address to the first ARP table; If it already exists, then the MAC address in the original entry will be overwritten with the MAC address of the target server.

3. The method according to claim 1, characterized in that, The response data packet is sent by the switch according to the second ARP table after receiving the response data packet returned by the business system. The second ARP table records the correspondence between the client's virtual IP and the MAC address of the distributor.

4. The method according to claim 1, characterized in that, The access data packet is the inner IP packet obtained by decapsulating the first tunnel data packet sent by the target server to the client; the outer source IP of the first tunnel data packet is the client's real exit IP, and the outer destination IP is the IP of the target server.

5. The method according to claim 4, characterized in that, The target server returns the response data packet to the client through the following operations: The target server performs tunnel encapsulation on the response data packet to obtain a second tunnel data packet with the outer source IP being the target server's IP and the outer destination IP being the client's real egress IP, and then sends the second tunnel data packet to the client.

6. The method according to claim 1, characterized in that, The method further includes: The client receives new registration information from a new server in the zero-trust server cluster, excluding the target server. The new registration information is sent by the new server after the client re-logs in to the new server and is assigned the same virtual IP. The new registration information includes the client's virtual IP and the MAC address of the new server. The new registration information overwrites the MAC address corresponding to the client's virtual IP in the first ARP table.

7. A distributor, characterized in that, include: At least one processor; And a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-6.

8. A data transmission system, characterized in that, include: switch; Zero-trust server cluster, consisting of multiple servers; The distributor of claim 7 is deployed between the zero-trust server cluster and the switch.

9. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-6.

Images