Load sharing system

Abstract

The application provides a load sharing system, which comprises an enterprise EIA, a server subscription point and a client subscription point; the enterprise EIA is used for sending IP-SGT information of a user equipment to the server subscription point through an IP-SGT sub-channel established with the server subscription point; the server subscription point is used for receiving the IP-SGT information of the user equipment sent by the enterprise EIA through the IP-SGT sub-channel, and sending the IP-SGT information of the user equipment to the client subscription point through a main IP-SGT sub-channel established with the client subscription point; and the client subscription point is used for receiving the IP-SGT information of the user equipment sent by the server subscription point through the main IP-SGT sub-channel.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a load sharing system. Background Art

[0002] The IP address security group tag (IP-SGT) binds user roles to security groups, decoupling the relationship between users and IP addresses. This allows the same user to obtain the same network access rights after being authenticated in different isolation domains, thereby implementing user role-based policy division and enabling free mobility.

[0003] The iMC EIA (End User Intelligent Access) component is a comprehensive enterprise terminal network access policy management solution. It provides unified network access policies, enabling unified access management for enterprise networks (wired, wireless, and VPNs). It also provides access control for employees, visitors, and device administrators based on role, device type, access time, and access location. This solution meets the unified O&M management needs of diverse network and terminal access, ensuring seamless implementation of terminal security policies across the entire network.

[0004] To implement the free mobility feature, all network devices in the network must synchronize IP-SGT information and use it to forward service packets. Figure 1 As shown, Figure 1 The following is a diagram of the existing IP-SGT synchronization process. Figure 1 Enterprise EIA includes an authentication component and an IP-SGT component. After a user device passes enterprise EIA authentication and goes online, the authentication component uses the user's authentication information to generate IP-SGT information. The authentication component then synchronizes the IP-SGT information with the IP-SGT component.

[0005] The subscription point (also known as the policy enforcement point) establishes a primary channel with the enterprise EIA via a two-way communication protocol (WebSocket). The enterprise EIA sends the IP-SGT sub-consent resource location (URL) (for example, http: / / 162.168.0.1:19443 / ipsgtmgr / ) to the subscription point via the primary channel. The subscription point uses this sub-URL to establish an IP-SGT sub-channel with the enterprise EIA. After obtaining the IP-SGT information, the enterprise EIA synchronizes it with the subscription point via the IP-SGT sub-channel.

[0006] When a user device goes offline, the authentication component automatically deletes the IP-SGT information stored locally for the user device and synchronizes the deletion information with the IP-SGT component. The enterprise EIA notifies the subscription point through the IP-SGT subchannel to delete the IP-SGT information corresponding to the user device.

[0007] In the existing IP-SGT synchronization process, subscription points are uniformly managed by the enterprise EIA, and IP-SGT information is also uniformly synchronized from the enterprise EIA to each subscription point. When the number of subscription points is large, the enterprise EIA is overloaded with IP-SGT information synchronization. Summary of the Invention

[0008] In view of this, the present application provides a load sharing method and apparatus to solve the problem of excessive pressure and severe load on enterprise EIA to synchronize IP-SGT information when there are a large number of subscription points during IP-SGT synchronization.

[0009] In a first aspect, the present application provides a load sharing system, the system comprising an enterprise EIA, a server subscription point, and a client subscription point;

[0010] The enterprise EIA is configured to send the IP-SGT information of the user equipment to the server subscription point through the IP-SGT sub-channel established with the server subscription point;

[0011] The server subscription point is configured to receive the IP-SGT information of the user device sent by the enterprise EIA through the IP-SGT sub-channel; and send the IP-SGT information of the user device to the client subscription point through the main IP-SGT sub-channel established with the client subscription point;

[0012] The client subscription point is used to receive the IP-SPG information of the user equipment sent by the server subscription point through the primary IP-SGT sub-channel.

[0013] In combination with the first aspect, in a first implementation, the server subscription point is further used to establish a primary channel with the enterprise EIA via the WebSocket protocol;

[0014] The enterprise EIA is further configured to send the first sub-URL to the server subscription point through the main channel.

[0015] In combination with the first implementation of the first aspect, in a second implementation, the server subscription point is further configured to establish the IP-SGT sub-channel with the enterprise EIA according to the first sub-URL.

[0016] In combination with the first aspect, in a third implementation, the client subscription point is further used to establish a primary channel with the enterprise EIA via the WebSocket protocol;

[0017] The enterprise EIA is further configured to send a second sub-URL and a third sub-URL to the client subscription point through the primary channel.

[0018] In combination with the third implementation of the first aspect, in a fourth implementation, the client subscription point is further used to establish the primary IP-SGT sub-channel with the server subscription point according to the second sub-URL.

[0019] In combination with the third implementation of the first aspect, in a fifth implementation, the server subscription point is further configured to, when the primary IP-SGT subchannel fails, suspend sending the IP-SGT information of the user equipment to the client subscription point through the primary IP-SGT subchannel;

[0020] The client subscription point is further configured to establish a backup IP-SGT sub-channel with the enterprise EIA according to the third sub-URL when the primary IP-SGT sub-channel fails.

[0021] In combination with the fifth implementation of the first aspect, in a sixth implementation, the enterprise EIA is further configured to send the IP-SGT information of the user equipment to the client subscription point through the backup IP-SGT subchannel;

[0022] The client subscription point is further configured to receive the IP-SPG information of the user equipment sent by the enterprise EIA through the backup IP-SGT sub-channel.

[0023] In combination with the fifth implementation method of the first aspect, in the seventh implementation method, the server subscription point is also used to send the IP-SGT information of the user device to the client subscription point through the main IP-SGT sub-channel when the main IP-SGT sub-channel failure is recovered.

[0024] In combination with the eighth implementation of the first aspect, in the sixth implementation, the client subscription point is further used to periodically detect whether the primary IP-SGT subchannel has recovered from a fault;

[0025] When the primary IP-SGT sub-channel recovers from the fault, the IP-SPG information of the user equipment sent by the server subscription point is received through the primary IP-SGT sub-channel.

[0026] In combination with the sixth implementation of the first aspect, in a ninth implementation, the client subscription point is further configured to send a notification message to the enterprise EIA when the primary IP-SGT subchannel recovers from a failure;

[0027] The enterprise EIA is further configured to receive the notification message and suspend sending the IP-SGT information of the user equipment to the client subscription point through the backup IP-SGT sub-channel.

[0028] Therefore, the load sharing system provided by the present application is applied, which includes an enterprise EIA, a server subscription point and a client subscription point; the enterprise EIA is used to send the IP-SGT information of the user device to the server subscription point through the IP-SGT sub-channel established with the server subscription point; the server subscription point is used to receive the IP-SPG information of the user device sent by the enterprise EIA through the IP-SGT sub-channel; the IP-SGT information of the user device is sent to the client subscription point through the main IP-SGT sub-channel established with the client subscription point; the client subscription point is used to receive the IP-SPG information of the user device sent by the server subscription point through the main IP-SGT sub-channel.

[0029] This way, when there are a large number of subscription points, the server subscription points offload the task of sending user device IP-SGT information to the enterprise EIA. This solves the problem of excessive pressure and heavy load on the enterprise EIA during IP-SGT synchronization when there are a large number of subscription points. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 This is a schematic diagram of the existing IP-SGT synchronization process;

[0031] Figure 2 A schematic diagram of a load sharing system provided in an embodiment of the present application;

[0032] Figure 3 A schematic diagram of another load sharing system provided in an embodiment of the present application;

[0033] Figure 4 A schematic diagram of another load sharing system provided in an embodiment of the present application;

[0034] Figure 5 The network device hardware structure provided in the embodiment of the present application. DETAILED DESCRIPTION

[0035] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0036] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. As used in this application and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the corresponding listed items.

[0037] It should be understood that although the terms first, second, third, etc. may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0038] The load sharing system provided in the embodiment of the present application is described in detail below. Figure 2-Figure 4 , Figure 2 A schematic diagram of a load sharing system provided in an embodiment of the present application. Figure 3 A schematic diagram of another load sharing system provided in an embodiment of the present application. Figure 4 A schematic diagram of another load sharing system provided in an embodiment of the present application.

[0039] exist Figure 2 In the example, the load sharing system includes an enterprise EIA 210, a server subscription point 220, and a client subscription point 230. The number of the server subscription point 220 and the client subscription point 230 can be multiple. Figure 3 Only one server subscription point 220 and one client subscription point 230 are shown as an example. The steps performed by other server subscription points 220 and client subscription points 230 are the same as those performed by the server subscription point 220 and client subscription point 230 shown in the figure.

[0040] The enterprise EIA 210 is configured to send the IP-SGT information of the user device to the server subscription point 220 via the IP-SGT sub-channel established with the server subscription point 220;

[0041] The server subscription point 220 is configured to receive the IP-SGT information of the user device sent by the enterprise EIA 210 through the IP-SGT sub-channel; and to send the IP-SGT information of the user device to the client subscription point 230 through the main IP-SGT sub-channel established with the client subscription point 230;

[0042] The client subscription point 230 is configured to receive the IP-SPG information of the user equipment sent by the server subscription point 220 through the primary IP-SGT sub-channel.

[0043] Among them, enterprise EIA is a collection of authentication, policy, and controller functions. In actual networking, it is usually implemented by a server.

[0044] The above IP-SGT information may specifically include the IP address of the user device, the name of the VPN to which it belongs, etc.

[0045]

[0046] Optionally, the server subscription point 220 is further used to establish a primary channel with the enterprise EIA 210 via the WebSocket protocol;

[0047] The enterprise EIA 210 is further configured to send the first sub-URL (eg, http: / / 172.168.0.1:19443 / ipsgtmgr / ) to the server subscription point 220 via the primary channel.

[0048] Optionally, the server subscription point 220 is further configured to establish an IP-SGT sub-channel with the enterprise EIA 210 according to the first sub-URL.

[0049] Optionally, the client subscription point 230 is further used to establish a main channel with the enterprise EIA 210 via the WebSocket protocol;

[0050] The enterprise EIA 210 is further configured to send the second sub-URL (eg, http: / / 182.168.0.1:19443 / ipsgtmgr / ) and the third sub-URL (eg, http: / / 192.168.0.1:19443 / ipsgtmgr / ) to the client subscription point 230 through the primary channel.

[0051] Optionally, the client subscription point 230 is further configured to establish a primary IP-SGT sub-channel with the server subscription point 220 according to the second sub-URL.

[0052] Optionally, the server subscription point 220 is further configured to suspend sending the IP-SGT information of the user equipment to the client subscription point 230 through the main IP-SGT subchannel when the main IP-SGT subchannel fails.

[0053] The client subscription point 230 is further configured to establish a backup IP-SGT subchannel with the enterprise EIA 210 according to a third sub-URL when the main IP-SGT subchannel fails.

[0054] Optionally, the enterprise EIA 210 is further configured to send the IP-SGT information of the user equipment to the client subscription point 230 through the backup IP-SGT subchannel.

[0055] The client subscription point 230 is further configured to receive the IP-SGT information of the user equipment sent by the enterprise EIA 210 through the backup IP-SGT subchannel.

[0056] Optionally, the server subscription point 230 is further configured to send the IP-SGT information of the user equipment to the client subscription point 220 through the main IP-SGT subchannel when the main IP-SGT subchannel recovers.

[0057] Optionally, the client subscription point 230 is further configured to periodically detect whether the main IP-SGT subchannel recovers.

[0058] The client subscription point 230 is further configured to receive the IP-SGT information of the user equipment sent by the server subscription point 220 through the main IP-SGT subchannel when the main IP-SGT subchannel recovers.

[0059] Optionally, the client subscription point 230 is further configured to send a notification message to the enterprise EIA 210 when the main IP-SGT subchannel recovers.

[0060] The enterprise EIA 210 is further configured to receive the notification message and suspend sending the IP-SGT information of the user equipment to the client subscription point 230 through the backup IP-SGT subchannel.

[0061] Therefore, the load sharing system provided in the present application includes an enterprise EIA, a server subscription point and a client subscription point. The enterprise EIA is configured to send the IP-SGT information of the user equipment to the server subscription point through an IP-SGT subchannel established with the server subscription point. The server subscription point is configured to receive the IP-SGT information of the user equipment sent by the enterprise EIA through the IP-SGT subchannel, send the IP-SGT information of the user equipment to the client subscription point through a main IP-SGT subchannel established with the client subscription point, and receive the IP-SGT information of the user equipment sent by the server subscription point through the main IP-SGT subchannel. The client subscription point is configured to receive the IP-SGT information of the user equipment sent by the server subscription point through the main IP-SGT subchannel.

[0062] This way, when there are a large number of subscription points, the server subscription points offload the task of sending user device IP-SGT information to the enterprise EIA. This solves the problem of excessive pressure and heavy load on the enterprise EIA during IP-SGT synchronization when there are a large number of subscription points.

[0063] The load sharing system provided by the embodiment of the present application is described in detail below. Figure 2 In the , the administrator specifies the business role of each subscription point according to the current network requirements, for example, server subscription point and client subscription point. The subscription points are uniformly managed by the enterprise EIA210. At the same time, the administrator can also specify whether the server subscription point is used as an execution point according to the current network requirements. Figure 4 As shown in the figure, the server subscription point 220 on the right can function as a server subscription point or, as an administrator, can be designated as an execution point, effectively implementing the functionality of a client subscription point. After obtaining the IP-SGT information of the user device, the execution point implements the free mobility policy based on the IP-SGT information of the user device.

[0064] It is understood that a subscription point with a service role of server can be used to help the enterprise EIA 210 distribute the IP-SGT information of user devices. A subscription point with a service role of client receives the IP-SGT information of user devices from the enterprise EIA 210 or the server subscription point 220 according to the current networking situation.

[0065] First, the server subscription point 220 and the client subscription point 230 respectively establish a first main channel and a second main channel (such as Figure 2 (shown by the dashed line).

[0066] The enterprise EIA 210 sends the first sub-URL to the server subscription point 220 through the first main channel. After receiving the first sub-URL, the server subscription point 220 establishes an IP-SGT sub-channel (such as Figure 2 (shown by the solid line).

[0067] At the same time, the enterprise EIA 210 sends the second sub-URL and the third sub-URL to the client subscription point 230 through the second main channel. After receiving the second sub-URL and the third sub-URL, the client subscription point 230 establishes a main IP-SGT sub-channel (such as Figure 2 midpoint dashed line).

[0068] It should be noted that the second sub-URL and the third sub-URL are primary and backup sub-URLs. The client subscription point 230 preferentially uses the primary sub-URL to establish a primary IP-SGT sub-channel with the server subscription point 220 via the WebSocket protocol.

[0069] After the server subscription point 220 establishes an IP-SGT sub-channel with the enterprise EIA 210, the enterprise EIA 210 sends the user device's IP-SGT information to the server subscription point 220 via the IP-SGT sub-channel. After receiving the user device's IP-SGT information, the server subscription point 220 sends the user device's IP-SGT information to the client subscription point 230 via the primary IP-SGT sub-channel. After receiving the user device's IP-SGT information, the client subscription point 230 implements the free mobility policy.

[0070] In this embodiment of the present application, both the server subscription point 220 and the client subscription point can detect the status of the primary IP-SGT subchannel by sending keepalive messages. For example, the local end periodically sends keepalive messages to the remote end. If the local end receives a keepalive response message from the remote end within a preset time, the primary IP-SGT subchannel is determined to be normal. If the local end does not receive a keepalive response message from the remote end within the preset time, the primary IP-SGT subchannel is determined to be faulty.

[0071] If the server subscription point 220 determines that the primary IP-SGT subchannel fails, the server subscription point 220 stops sending the IP-SGT information of the user equipment to the client subscription point 230 through the primary IP-SGT subchannel.

[0072] Similarly, if the client subscription point 230 determines that the primary IP-SGT sub-channel fails, the client subscription point 230 establishes a backup IP-SGT sub-channel (such as Figure 2 midpoint dashed line).

[0073] After the backup IP-SGT subchannel is established, the enterprise EIA 210 sends the user device's IP-SGT information to the client subscription point 230 through the backup IP-SGT subchannel. The client subscription point 230 receives the user device's IP-SGT information from the enterprise EIA 210, ensuring uninterrupted synchronization of the user device's IP-SGT information.

[0074] The client subscription point 230 can periodically detect whether the primary IP-SGT subchannel has recovered from the failure. For example, the client subscription point 230 can again detect whether the primary IP-SGT subchannel has recovered from the failure by sending a keepalive message. If the client subscription point 230 receives a keepalive response message sent by the server subscription point 220, the client subscription point 230 determines that the primary IP-SGT subchannel has recovered from the failure.

[0075] When the primary IP-SGT sub-channel is recovered, the server subscription point 220 sends the IP-SGT information of the user equipment to the client subscription point 230 again through the primary IP-SGT sub-channel. The client subscription point 230 receives the IP-SGT information of the user equipment from the server subscription point 220 again, and the server subscription point 220 shares the task of sending the IP-SGT information of the user equipment for the enterprise EIA 210.

[0076] The client subscription point 230 generates and sends a notification message to the enterprise EIA 210 to inform the enterprise EIA 210 to suspend sending the IP-SGT information of the user equipment through the backup IP-SGT sub-channel. After receiving the notification message, the enterprise EIA 210 stops sending the IP-SGT information of the user equipment to the client subscription point through the backup IP-SGT sub-channel.

[0077] It should be noted that if the server subscription point 220 is also designated as an execution point in the notification of the server subscription point, a primary IP-SGT sub-channel also needs to be established between the two server subscription points. As shown in Figure 4

[0078] If the primary IP-SGT sub-channel established between the server subscription points fails, the right server subscription point 220 can refer to the execution process of the client subscription point 230 described above to receive the IP-SGT information of the user equipment through the IP-SGT sub-channel established with the enterprise EIA 210. The right server subscription point 220 also periodically detects whether the primary IP-SGT sub-channel is recovered. When the primary IP-SGT sub-channel is recovered, the right server subscription point 220 receives the IP-SGT information of the user equipment sent by the left server subscription point 220 through the primary IP-SGT sub-channel again.

[0079] Based on the same inventive concept, the embodiments of the present application also provide a network device, as shown in Figure 5 The network device includes a processor 510, a transceiver 520, and a machine readable storage medium 530. The machine readable storage medium 530 stores machine executable instructions that can be executed by the processor 510. The processor 510 is prompted by the machine executable instructions to perform the function steps implemented by any function entity included in the load sharing system provided by the embodiments of the present application. The foregoing Figure 2-Figure 4 The enterprise EIA 210, the server subscription point 220, and the client subscription point 230 included in the load sharing system can be implemented by using the network device hardware structure as shown in Figure 5

[0080] ​​The computer readable storage medium 530 can include a random access memory (RAM) and can also include a non-volatile memory (NVM), such as at least one disk storage. Optionally, the computer readable storage medium 530 can also be at least one storage located remotely from the processor 510.

[0081] The processor 510 can be a general processor, including a central processing unit (CPU), a network processor (NP), etc. The processor 510 can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic, discrete hardware components.

[0082] In the embodiments of the present application, the processor 510 is enabled to implement the functional steps of any functional entity included in the load sharing system described in the foregoing embodiments of the present application by reading the machine executable instructions stored in the machine readable storage medium 530 and being prompted by the machine executable instructions to implement the functional steps of the processor 510 itself and to call the transceiver 520.

[0083] In addition, the embodiments of the present application provide a machine readable storage medium 530, which stores machine executable instructions. When called and executed by the processor 510, the machine executable instructions prompt the processor 510 itself and the transceiver 520 to implement the functional steps of any functional entity included in the load sharing system described in the foregoing embodiments of the present application.

[0084] For the device embodiments, since they basically correspond to the method embodiments, the related parts can be referred to the part of the system embodiments. The device embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, i.e. they can be located in one place or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the present application according to actual needs. Those skilled in the art can understand and implement it without creative labor.

[0085] As for the machine-readable storage medium embodiment, since the method content involved is basically similar to the aforementioned system embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0086] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A load sharing system, characterized in that: The system includes an enterprise EIA, a server subscription point, and a client subscription point; The enterprise EIA is configured to send the IP-SGT information of the user equipment to the server subscription point through the IP-SGT sub-channel established with the server subscription point; The server subscription point is configured to receive the IP-SGT information of the user device sent by the enterprise EIA through the IP-SGT sub-channel; and send the IP-SGT information of the user device to the client subscription point through the main IP-SGT sub-channel established with the client subscription point; The client subscription point is used to receive the IP-SGT information of the user equipment sent by the server subscription point through the primary IP-SGT sub-channel.

2. The system according to claim 1, wherein: The server subscription point is also used to establish a main channel with the enterprise EIA via the WebSocket protocol; The enterprise EIA is further configured to send the first sub-URL to the server subscription point via the main channel.

3. The system according to claim 2, characterized in that The server subscription point is further configured to establish the IP-SGT sub-channel with the enterprise EIA according to the first sub-URL.

4. The system according to claim 1, wherein: The client subscription point is also used to establish a main channel with the enterprise EIA via the WebSocket protocol; The enterprise EIA is further configured to send a second sub-URL and a third sub-URL to the client subscription point through the primary channel.

5. The system according to claim 4, characterized in that The client subscription point is further configured to establish the primary IP-SGT sub-channel with the server subscription point according to the second sub-URL.

6. The system according to claim 4, characterized in that The server subscription point is further configured to, when the primary IP-SGT subchannel fails, suspend sending the IP-SGT information of the user equipment to the client subscription point through the primary IP-SGT subchannel; The client subscription point is further configured to establish a backup IP-SGT sub-channel with the enterprise EIA according to the third sub-URL when the primary IP-SGT sub-channel fails.

7. The system according to claim 6, characterized in that The enterprise EIA is further configured to send the IP-SGT information of the user equipment to the client subscription point through the backup IP-SGT subchannel; The client subscription point is further configured to receive the IP-SGT information of the user equipment sent by the enterprise EIA through the backup IP-SGT sub-channel.

8. The system according to claim 6, wherein: The server subscription point is further configured to send the IP-SGT information of the user equipment to the client subscription point through the primary IP-SGT subchannel after the primary IP-SGT subchannel recovers from a failure.

9. The system according to claim 6, wherein: The client subscription point is further used to periodically detect whether the primary IP-SGT subchannel has recovered from a fault; When the primary IP-SGT sub-channel recovers from the fault, the IP-SGT information of the user equipment sent by the server subscription point is received through the primary IP-SGT sub-channel.

10. The system according to claim 7, wherein: The client subscription point is further used to send a notification message to the enterprise EIA when the primary IP-SGT subchannel fails and recovers; The enterprise EIA is further configured to receive the notification message and suspend sending the IP-SGT information of the user equipment to the client subscription point through the backup IP-SGT sub-channel.

Images