Internet Protocol Security IPSec service detection method and device

Abstract

The disclosed embodiment discloses an Internet Protocol Security (IPSec) service detection method and device. The method includes: detecting whether a negotiation message sent by a first device in a first subnet is received within a preset period, wherein the negotiation message indicates a message sent by the first device through an IPSec service detection switch after the IPSec tunnel negotiation process is started; if a negotiation message is received within the preset period, confirming that the IPSec service is normal, and forwarding the received response message from the second device in the second subnet to the first device; if no negotiation message is received within the preset period, determining that the IPSec service is abnormal, and stopping forwarding the received response message to the first device. This method can also accurately determine whether the IPSec service of the first device is abnormal even when the IPSec tunnel process is abnormal, and can more intelligently forward messages in the IPSec tunnel, thereby improving data transmission stability and efficiency.

Description

Technical Field

[0001] The present disclosure relates to the field of computer network technology, and in particular to an IPSec service detection method and device. Background Art

[0002] IPSec VPN is a virtual private network (VPN) technology that uses Internet Protocol Security (IPSec) to achieve remote access. It provides a secure communication channel between two private networks on the public Internet and ensures the security and stability of user data transmission through encrypted channels.

[0003] Load balancing devices are built on the existing IPSec network structure to expand network equipment, server bandwidth, increase throughput and enhance network data processing capabilities, as well as improve network flexibility and availability.

[0004] In the related technology, when the load balancing device detects whether the status of the IPSec gateway device is abnormal, it usually determines the status of the IPSec gateway device based on the ping command detection or the TCP detection of a certain port. It is not prepared to detect whether the IPSec service of the IPSec gateway device is normal, which will cause the load balancing device to be unable to accurately determine the status of the IPSec gateway device, and mistakenly send the IPSec negotiation message to the gateway device with abnormal IPSec service, affecting the stability of IPSec tunnel data transmission. Summary of the Invention

[0005] In view of this, the embodiments of the present disclosure provide an Internet Protocol security IPSec service detection method and device, which can more accurately detect whether the IPSec tunnel process is normal, and after the IPSec service is restored in the event of an IPSec tunnel abnormality, the load balancing device can promptly detect and promptly change the data forwarding rules of the IPSec gateway device, and forward the IPSec tunnel messages more intelligently, thereby improving the data transmission stability and transmission efficiency of the IPSec tunnel.

[0006] In a first aspect, an embodiment of the present disclosure provides an Internet Protocol Security (IPSec) service detection method, which employs the following technical solutions:

[0007] detecting whether a negotiation message sent by a first device in a first subnet is received within a preset period, where the negotiation message represents a message sent by the first device through a pre-configured IPSec service detection switch after the IPSec tunnel negotiation process is started;

[0008] When the negotiation message is received within a preset period, confirming that the IPSec service of the first device is normal, and forwarding the received response message from the second device in the second subnet to the first device;

[0009] If the negotiation message is not received within a preset period, it is determined that the IPSec service of the first device is abnormal, and forwarding the received response message of the second device to the first device is stopped.

[0010] In some embodiments, the method further comprises:

[0011] When the IPSec service of the first device is abnormal, continue to detect the negotiation message sent by the first device according to the preset detection rule;

[0012] When the negotiation message sent by the first device is detected according to the preset detection rule, forwarding the received response message of the second device to the first device is resumed.

[0013] In a second aspect, the embodiments of the present disclosure further provide an Internet Protocol Security (IPSec) service detection method, which employs the following technical solutions:

[0014] Receive and record configuration information entered by the user;

[0015] When detecting a user triggering operation on an apply button, the first device initiates IPSec tunnel negotiation with the second device according to the configuration information;

[0016] Send negotiation messages to the load balancing device according to the preset period through the pre-configured IPSec service detection switch;

[0017] The load balancing device determines whether the IPSec service is abnormal according to whether the negotiation message is received within a preset period.

[0018] In some embodiments, the method further comprises:

[0019] When the IPSec service is normal, receiving a response message from the second device through the load balancing device;

[0020] In the case of an abnormality of the IPSec service, the negotiation message continues to be sent to the load balancing device through the IPSec service detection switch after a preset time period.

[0021] In some embodiments, actively sending a negotiation message to the load balancing device according to a preset period through a pre-configured IPSec service detection switch includes:

[0022] Determine the second device according to the configuration information, where the configuration information includes a first IP address of the first device, a second IP address of the second device, and outbound interface information;

[0023] Sending a first-phase negotiation message to the second device using a first-phase encryption algorithm;

[0024] Confirming that the first phase negotiation of the IPSec tunnel is successful based on the received first phase response message returned by the second device, and sending a second phase negotiation message to the second device using the second phase encryption algorithm;

[0025] According to the received second-phase response message returned by the second device, it is determined that the second-phase negotiation of the IPSec tunnel is successful, and the successfully negotiated IPSec tunnel is obtained.

[0026] In some embodiments, receiving and recording configuration information input by a user includes:

[0027] Receive and record switch configuration information for the IPSec service detection switch input by the user; wherein the switch configuration information includes one or more of the following: IPSec tunnel name, negotiation parameters for message interaction, pre-shared key, first-stage encryption algorithm, second-stage encryption algorithm, local subnet IP address, peer subnet IP address, ISAKMP SA, and IPSec SA;

[0028] The ISAKMP SA is updated according to a first update period, and the IPSec SA is updated according to a second update period; wherein the first update period and the second update period are different.

[0029] In a third aspect, an embodiment of the present disclosure further provides an Internet Protocol Security (IPSec) service detection device, comprising:

[0030] a message detection unit configured to detect whether a negotiation message sent by a first device in a first subnet is received within a preset period, wherein the negotiation message represents a message sent by the first device through a pre-configured IPSec service detection switch after the IPSec tunnel negotiation process is started;

[0031] a message forwarding unit configured to, upon receiving the negotiation message within a preset period, confirm that the IPSec service of the first device is normal, and forward the received response message from the second device in the second subnet to the first device;

[0032] The determining unit is configured to determine that the IPSec service of the first device is abnormal if the negotiation message is not received within a preset period, and stop forwarding the response message received from the second device to the first device.

[0033] In a fourth aspect, an embodiment of the present disclosure further provides an Internet Protocol Security (IPSec) service detection device, comprising:

[0034] a receiving unit, configured to receive and record configuration information input by a user;

[0035] a negotiation unit configured to, when detecting a user triggering an application button, cause the first device to actively initiate IPSec tunnel negotiation with the second device according to the configuration information;

[0036] The sending unit is configured to actively send negotiation messages to the load balancing device according to a preset period through a pre-configured IPSec service detection switch, so that the load balancing device determines whether the IPSec service is abnormal based on whether the negotiation message is received within the preset period.

[0037] In a fifth aspect, the embodiments of the present disclosure further provide an electronic device, which adopts the following technical solution:

[0038] The electronic device comprises:

[0039] at least one processor; and,

[0040] a memory communicatively connected to the at least one processor; wherein,

[0041] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform any of the above-mentioned Internet Protocol Security IPSec service detection methods.

[0042] In a sixth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to execute any of the Internet Protocol Security IPSec service detection methods described above.

[0043] An embodiment of the present disclosure provides an Internet Protocol Security (IPSec) service detection method and apparatus. By configuring an IPSec service detection switch in a first device in an IPSec network, the first device periodically sends negotiation messages by turning on the IPSec service detection switch after the IPSec tunnel negotiation process is started. The load balancing device determines whether the IPSec service of the first device is abnormal by detecting whether the negotiation message is received. If the IPSec service is normal, the load balancing device normally forwards messages between the first device and the second device. If the IPSec service is abnormal, the load balancing device stops forwarding messages between the first device and the second device.

[0044] The embodiment of the present disclosure can accurately determine whether the IPSec service of the first device is abnormal through the IPSec service detection switch even when the IPSec tunnel process is abnormal. After the IPSec service is restored, the load balancing device can promptly detect and change the data forwarding rules of the IPSec gateway device, and forward the messages of the IPSec tunnel more intelligently, thereby improving the data transmission stability and transmission efficiency of the IPSec tunnel.

[0045] The above description is only an overview of the technical solution of the present disclosure. In order to more clearly understand the technical means of the present disclosure, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present disclosure more obvious and easy to understand, the following specifically cites preferred embodiments and describes them in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0047] Figure 1 A flowchart of an Internet Protocol Security (IPSec) service detection method provided in an embodiment of the present disclosure;

[0048] Figure 2 A flowchart of another Internet Protocol Security (IPSec) service detection method provided by an embodiment of the present disclosure;

[0049] Figure 3 A schematic diagram of the structure of an Internet Protocol security IPSec service detection device provided in an embodiment of the present disclosure;

[0050] Figure 4 A schematic diagram of the structure of another Internet Protocol security IPSec service detection device provided in an embodiment of the present disclosure;

[0051] Figure 5 A block diagram of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0052] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0053] It should be clear that the following embodiments of the present disclosure are described through specific concrete examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other in the absence of conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present disclosure.

[0054] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on this disclosure, it should be understood by those skilled in the art that an aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects described herein can be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein can be used to implement this device and / or practice this method.

[0055] It should also be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present disclosure. The illustrations only show components related to the present disclosure and are not drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component can be changed at will, and the component layout type may also be more complicated.

[0056] Additionally, in the following description, specific details are provided to provide a thorough understanding of the examples. However, one skilled in the art will appreciate that the aspects described can be practiced without these specific details.

[0057] like Figure 1As shown, an embodiment of the present disclosure provides a method for detecting an Internet Protocol security (IPSec) service. The method is applied to a load balancing device in an Internet Protocol security (IPSec) network. The IPSec network further includes a first device and a second device, wherein the first device is a local device and the second device is a peer device. The method includes the following steps:

[0058] S101. The load balancing device detects whether a negotiation message sent by a first device in a first subnet is received within a preset period, where the negotiation message represents a message sent by the first device through a pre-configured IPSec service detection switch after an IPSec tunnel negotiation process is started.

[0059] S102: When a negotiation message is received within a preset period, the load balancing device confirms that the IPSec service of the first device is normal, and forwards the received response message from the second device in the second subnet to the first device;

[0060] S103: When no negotiation message is received within a preset period, the load balancing device determines that the IPSec service of the first device is abnormal, and stops forwarding the response message received from the second device to the first device.

[0061] Optionally, the IPSec network includes multiple gateway devices, and the first device and the second device are one of the multiple gateway devices.

[0062] In some embodiments, the method further comprises:

[0063] When the IPSec service of the first device is abnormal, the load balancing device continues to detect the negotiation message sent by the first device according to the preset detection rule;

[0064] When the negotiation message sent by the first device is detected according to the preset detection rule, the load balancing device resumes forwarding the received response message of the second device to the first device.

[0065] For example, if the IPSec service of the first device is abnormal, the load balancing device can continue to detect whether the first device has sent a negotiation message after an interval of 50 seconds. If the load balancing device receives a negotiation message from the IPSec service detection switch of the first device within five consecutive 30-second intervals, it can resume forwarding messages to the first device.

[0066] like Figure 2 As shown, the embodiment of the present disclosure also provides a method for detecting an Internet Protocol security (IPSec) service. The method is applied to a first device in an Internet Protocol security (IPSec) network, where the first device is a local device. The IPSec network also includes a load balancing device and a second device, where the second device is a peer device. The following technical solution is used:

[0067] S201. The first device receives and records configuration information input by a user;

[0068] S202: When the first device detects a user triggering an application button, the first device proactively initiates IPSec tunnel negotiation with the second device according to the configuration information.

[0069] S203: The first device actively sends a negotiation message to the load balancing device according to a preset period through a pre-configured IPSec service detection switch, so that the load balancing device determines whether the IPSec service is abnormal based on whether the negotiation message is received within the preset period.

[0070] For example, the preset period may be set to 10 seconds. The preset period may be set according to actual needs, and the embodiment of the present disclosure does not limit this.

[0071] In some embodiments, the method further comprises:

[0072] When the IPSec service is normal, the first device receives the response message from the second device through the load balancing device;

[0073] In the case of an IPSec service exception, after a preset time period, the first device continues to send negotiation messages to the load balancing device through the IPSec service detection switch.

[0074] For example, the preset period for the first device to send a negotiation message can be set to 10 seconds, and the preset time period can be set to 2 consecutive 30 seconds, or can be set to 5 consecutive 30 seconds. The user can set it according to actual needs, and the embodiment of the present disclosure does not limit this.

[0075] In some embodiments, the above step S203, in which the first device actively sends a negotiation message to the load balancing device according to a preset period through a pre-configured IPSec service detection switch, includes:

[0076] The first device determines the second device according to the configuration information, where the configuration information includes the first IP address of the first device, the second IP address of the second device, and the outbound interface information;

[0077] The first device actively sends a first-phase negotiation message to the second device using the first-phase encryption algorithm;

[0078] The first device confirms that the first phase negotiation of the IPSec tunnel is successful based on the first phase response message received from the second device, and sends a second phase negotiation message to the second device using the second phase encryption algorithm;

[0079] The first device determines that the second phase negotiation of the IPSec tunnel is successful based on the second phase response message received from the second device, and obtains the successfully negotiated IPSec tunnel.

[0080] For example, the first IP address may be set to 1.1.1.1; the second IP address may be set to 1.1.1.2; and the outgoing interface information may be set to feth1.

[0081] Optionally, the first IP address of the first device, the second IP address of the second device, and the output interface information need to be manually configured by the user. The first IP address represents the address information of the first device, the second IP address represents the address information of the second device communicating with the first device, and the output interface information represents the input interface information and output interface information for communication between the first device and the second device.

[0082] After the user adds the first IP address, second IP address, and outbound interface information and clicks the Apply button, the first device will initiate IPSec tunnel negotiation with the second device. If the IPSec tunnel negotiation process is normal, the first device will use the IPSec service detection switch to proactively send a negotiation message to the UDP500 port at a preset interval of 10 seconds. The load balancing device will detect the negotiation message. If the load balancing device receives the negotiation message, it can be determined that the IPSec service of the first device is normal. If the load balancing device does not receive the negotiation message within 30 seconds, it is determined that there is an anomaly in the IPSec service of the first device, and the load balancing device will no longer send messages to the first device with the anomaly.

[0083] In the case of an IPSec service anomaly, for example, after an interval of 50 seconds, if the load balancing device re-detects the negotiation message (message of udp500 port) sent by the IPSec service detection switch of the first device, and receives the negotiation message (message of udp500 port) sent by the IPSec service detection switch of the first device within 5 consecutive 30 seconds, the load balancing device determines that the first device whose IPSec service was previously abnormal has returned to normal, and the load balancing device resumes sending messages to the first device, and after receiving the response message sent by the second device, sends the response message to the first device.

[0084] In some embodiments, the above step S201, in which the first device receives and records the configuration information input by the user, includes:

[0085] The first device receives and records switch configuration information for the IPSec service detection switch input by the user, where the switch configuration information includes one or more of the following: the IPSec tunnel name, negotiation parameters for message exchange, a pre-shared key, a first-phase encryption algorithm, a second-phase encryption algorithm, an IP address of the local subnet, an IP address of the peer subnet, an ISAKMP SA, and an IPSec SA;

[0086] The first device updates the ISAKMP SA according to a first update period, and updates the IPSec SA according to a second update period; wherein the first update period and the second update period are different.

[0087] For example, the IPSec tunnel name can be set to search; the negotiation parameters for message exchange can be set to main mode; the pre-shared password can be set to 123456; the first-phase encryption algorithm can use aes-md5-dh1; the second-phase encryption algorithm can use aes-md5; the IP address of the first subnet can be set to 1.1.1.1 / 32; the IP address of the second subnet can be set to 1.1.1.2 / 32; the first update period of the ISAKMP SA can be set to 86400; and the second update period of the IPSec SA can be set to 28800. It should be noted that the switch configuration information can be set according to actual needs and is not limited in this regard in the present embodiment.

[0088] An embodiment of the present disclosure provides an Internet Protocol Security (IPSec) service detection method, which configures an IPSec service detection switch in a first device in an IPSec network. After the IPSec tunnel negotiation process is started, the first device periodically sends negotiation messages by turning on the IPSec service detection switch. A load balancing device determines whether the IPSec service of the first device is abnormal by detecting whether the negotiation message is received. When the IPSec service is normal, the load balancing device normally forwards messages between the first device and the second device. When the IPSec service is abnormal, the load balancing device stops forwarding messages between the first device and the second device.

[0089] The embodiment of the present disclosure can accurately determine whether the IPSec service of the first device is abnormal through the IPSec service detection switch even when the IPSec tunnel process is abnormal. After the IPSec service is restored, the load balancing device can promptly detect and change the data forwarding rules of the IPSec gateway device, and forward the messages of the IPSec tunnel more intelligently, thereby improving the data transmission stability and transmission efficiency of the IPSec tunnel.

[0090] like Figure 3As shown, the embodiment of the present disclosure further provides an Internet Protocol Security IPSec service detection device, comprising:

[0091] a message detection unit 31 configured to detect whether a negotiation message sent by a first device in a first subnet is received within a preset period, wherein the negotiation message represents a message sent by the first device through a pre-configured IPSec service detection switch after the IPSec tunnel negotiation process is started;

[0092] The message forwarding unit 32 is configured to, when receiving the negotiation message within a preset period, confirm that the IPSec service of the first device is normal, and forward the received response message from the second device in the second subnet to the first device;

[0093] The determining unit 33 is configured to determine that the IPSec service of the first device is abnormal if the negotiation message is not received within a preset period, and stop forwarding the response message received from the second device to the first device.

[0094] like Figure 4 As shown, the embodiment of the present disclosure further provides an Internet Protocol Security IPSec service detection device, comprising:

[0095] The receiving unit 41 is configured to receive and record configuration information input by the user;

[0096] The negotiation unit 42 is configured to, when detecting a user triggering operation on the apply button, initiate IPSec tunnel negotiation with the second device according to the configuration information by the first device;

[0097] The sending unit 43 is configured to actively send negotiation messages to the load balancing device according to a preset period through a pre-configured IPSec service detection switch, so that the load balancing device determines whether the IPSec service is abnormal based on whether the negotiation message is received within the preset period.

[0098] An electronic device according to an embodiment of the present disclosure includes a memory and a processor. The memory is used to store non-transitory computer-readable instructions. Specifically, the memory may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may, for example, include random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory may, for example, include a read-only memory (ROM), a hard disk, a flash memory, etc.

[0099] The processor may be a central processing unit (CPU) or other form of processing unit with data processing capability and / or instruction execution capability, and may control other components in the electronic device to perform desired functions. In one embodiment of the present disclosure, the processor is configured to execute the computer-readable instructions stored in the memory, causing the electronic device to perform all or part of the steps of an Internet Protocol security (IPSec) service detection described in each embodiment of the present disclosure.

[0100] Those skilled in the art should understand that in order to solve the technical problem of how to obtain a good user experience, this embodiment may also include well-known structures such as a communication bus and an interface, and these well-known structures should also be included in the scope of protection of this disclosure.

[0101] like Figure 5 The present invention provides a schematic structural diagram of an electronic device according to an embodiment of the present invention, which is suitable for implementing the electronic device according to an embodiment of the present invention. Figure 5 The electronic device shown is only an example and should not limit the functions and scope of use of the embodiments of the present disclosure.

[0102] like Figure 5 As shown, the electronic device may include a processing device (such as a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) or a program loaded from a storage device into a random access memory (RAM). In the RAM, various programs and data required for the operation of the electronic device are also stored. The processing device, ROM, and RAM are connected to each other via a bus. An input / output (I / O) interface is also connected to the bus.

[0103] Typically, the following devices can be connected to the I / O interface: input devices such as sensors or visual information acquisition devices; output devices such as display screens; storage devices such as tapes and hard disks; and communication devices. The communication device allows the electronic device to communicate with other devices (such as edge computing devices) wirelessly or by wire to exchange data. Figure 5 The electronic device is shown with various devices, but it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed instead.

[0104] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processing device, all or part of the steps of an Internet Protocol Security IPSec service detection method of an embodiment of the present disclosure are executed.

[0105] For detailed description of this embodiment, please refer to the corresponding description in the aforementioned embodiments, which will not be repeated here.

[0106] According to an embodiment of the present disclosure, a computer-readable storage medium stores non-transitory computer-readable instructions. When the non-transitory computer-readable instructions are executed by a processor, all or part of the steps of an Internet Protocol Security (IPSec) service detection method described in each embodiment of the present disclosure are executed.

[0107] The above-mentioned computer-readable storage media include, but are not limited to, optical storage media (e.g., CD-ROMs and DVDs), magneto-optical storage media (e.g., MOs), magnetic storage media (e.g., magnetic tapes or mobile hard disks), media with built-in rewritable non-volatile memory (e.g., memory cards), and media with built-in ROM (e.g., ROM cartridges).

[0108] For detailed description of this embodiment, please refer to the corresponding description in the aforementioned embodiments, which will not be repeated here.

[0109] The basic principles of the present disclosure have been described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, and effects mentioned in this disclosure are merely illustrative and not restrictive, and should not be construed as necessarily possessed by each embodiment of the present disclosure. Furthermore, the specific details disclosed above are provided for illustrative purposes and to facilitate understanding, rather than as limitations. These details do not limit the present disclosure to necessarily being implemented using these specific details.

[0110] In the present disclosure, relational terms such as first and second, etc. are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. The block diagrams of the devices, devices, equipment, and systems involved in the present disclosure are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, devices, equipment, and systems can be connected, arranged, or configured in any manner. Words such as "including," "comprising," "having," and the like are open-ended words, meaning "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or" and can be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and can be used interchangeably therewith.

[0111] Additionally, as used herein, "or" used in a list of items beginning with "at least one" indicates a separate list, so that, for example, a list of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not mean that the example described is preferred or better than other examples.

[0112] It should also be noted that in the system and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0113] Various changes, substitutions, and modifications may be made to the technology described herein without departing from the teachings defined by the appended claims. Moreover, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of things, means, methods, and actions described above. Currently existing or later developed processes, machines, manufactures, compositions of things, means, methods, or actions that perform substantially the same function or achieve substantially the same results as the corresponding aspects described herein may be utilized. Accordingly, the appended claims include within their scope such processes, machines, manufactures, compositions of things, means, methods, or actions.

[0114] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0115] The above description has been provided for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although a number of example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations thereof.

Claims

1. A method for detecting an Internet Protocol security (IPSec) service, characterized in that: The method comprises: detecting whether a negotiation message sent by a first device in a first subnet is received within a preset period, where the negotiation message represents a message sent by the first device through a pre-configured IPSec service detection switch after the IPSec tunnel negotiation process is started; The switch configuration information of the IPSec service detection switch includes one or more of the following: IPSec tunnel name, negotiation parameters for message interaction, pre-shared key, first-stage encryption algorithm, second-stage encryption algorithm, local subnet IP address, peer subnet IP address, ISAKMP SA, and IPSec SA; When the negotiation message is received within a preset period, confirming that the IPSec service of the first device is normal, and forwarding the received response message from the second device in the second subnet to the first device; If the negotiation message is not received within a preset period, it is determined that the IPSec service of the first device is abnormal, and forwarding the received response message of the second device to the first device is stopped.

2. The Internet Protocol Security (IPSec) service detection method according to claim 1, wherein: The method further comprises: When the IPSec service of the first device is abnormal, continue to detect the negotiation message sent by the first device according to the preset detection rule; When the negotiation message sent by the first device is detected according to the preset detection rule, forwarding the received response message of the second device to the first device is resumed.

3. A method for detecting an Internet Protocol security (IPSec) service, the method comprising: receiving and recording configuration information input by a user, wherein the configuration information is switch configuration information for the IPSec service detection switch; The switch configuration information includes one or more of the following: IPSec tunnel name, negotiation parameters for message interaction, pre-shared key, first-stage encryption algorithm, second-stage encryption algorithm, local subnet IP address, peer subnet IP address, ISAKMP SA, and IPSec SA; When detecting a user triggering operation on an apply button, the first device initiates IPSec tunnel negotiation with the second device according to the configuration information; Send negotiation messages to the load balancing device according to the preset period through the pre-configured IPSec service detection switch; The load balancing device determines whether the IPSec service is abnormal according to whether the negotiation message is received within a preset period.

4. The Internet Protocol Security (IPSec) service detection method according to claim 3, wherein: The method further comprises: When the IPSec service is normal, receiving a response message from the second device through the load balancing device; In the case of an abnormality of the IPSec service, the negotiation message continues to be sent to the load balancing device through the IPSec service detection switch after a preset time period.

5. The Internet Protocol Security (IPSec) service detection method according to claim 3, wherein: Sending a negotiation message to the load balancing device according to a preset period through a pre-configured IPSec service detection switch includes: Determine the second device according to the configuration information, where the configuration information includes a first IP address of the first device, a second IP address of the second device, and outbound interface information; Sending a first-phase negotiation message to the second device using a first-phase encryption algorithm; Confirming, based on the received first-phase response message returned by the second device, that the first-phase negotiation of the IPSec tunnel is successful, and sending a second-phase negotiation message to the second device using the second-phase encryption algorithm; According to the received second-phase response message returned by the second device, it is determined that the second-phase negotiation of the IPSec tunnel is successful, and the successfully negotiated IPSec tunnel is obtained.

6. The Internet Protocol Security (IPSec) service detection method according to claim 3, wherein: Receive and record configuration information entered by the user, including: Receive and record switch configuration information for the IPSec service detection switch input by the user; The ISAKMP SA is updated according to a first update period, and the IPSec SA is updated according to a second update period; wherein the first update period and the second update period are different.

7. An Internet Protocol Security IPSec service detection device, characterized in that: include: a message detection unit configured to detect whether a negotiation message sent by a first device in a first subnet is received within a preset period, wherein the negotiation message represents a message sent by the first device through a pre-configured IPSec service detection switch after the IPSec tunnel negotiation process is started; The switch configuration information of the IPSec service detection switch includes one or more of the following: IPSec tunnel name, negotiation parameters for message interaction, pre-shared key, first-stage encryption algorithm, second-stage encryption algorithm, local subnet IP address, peer subnet IP address, ISAKMP SA, and IPSec SA; a message forwarding unit configured to, upon receiving the negotiation message within a preset period, confirm that the IPSec service of the first device is normal, and forward the received response message from the second device in the second subnet to the first device; The determining unit is configured to determine that the IPSec service of the first device is abnormal if the negotiation message is not received within a preset period, and stop forwarding the response message received from the second device to the first device.

8. An Internet Protocol Security IPSec service detection device, characterized in that: include: a receiving unit configured to receive and record configuration information input by a user, wherein the configuration information is switch configuration information for the IPSec service detection switch; The switch configuration information includes one or more of the following: IPSec tunnel name, negotiation parameters for message interaction, pre-shared key, first-stage encryption algorithm, second-stage encryption algorithm, local subnet IP address, peer subnet IP address, ISAKMP SA, and IPSec SA; a negotiation unit configured to, when detecting a user triggering an application button, cause the first device to actively initiate IPSec tunnel negotiation with the second device according to the configuration information; The sending unit is configured to actively send negotiation messages to the load balancing device according to a preset period through a pre-configured IPSec service detection switch, so that the load balancing device determines whether the IPSec service is abnormal based on whether the negotiation message is received within the preset period.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the Internet Protocol Security IPSec service detection method described in any one of claims 1 to 2, or 3 to 6.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, which are used to enable a computer to execute the Internet Protocol Security IPSec service detection method described in any one of claims 1 to 2, or 3 to 6.

Images