IPsec tunnel data transmission method, device, equipment and storage medium

Abstract

The embodiments of the present disclosure disclose a data transmission method, apparatus, device, and storage medium for an IPsec tunnel. The method comprises: receiving a data access request from a first device, the data access request carrying a source IP address and a destination IP address; determining a first identifier of the IPsec tunnel and a second identifier of the second device that match the source IP address and the destination IP address according to a preset first data forwarding rule; sending the data access request to the second device corresponding to the second identifier through the IPsec tunnel corresponding to the first identifier; receiving target data returned by the second device, and sending the target data to the first device through the IPsec tunnel. This method enables the load balancing device to obtain updated data of the IPsec tunnel in a timely manner, and forward data more intelligently according to the switched IPsec tunnel, thereby reducing the workload of operation and maintenance engineers and improving the stability and efficiency of data transmission.

Description

Technical Field

[0001] The present disclosure relates to the field of computer network technology, and in particular to a data transmission method, apparatus, device, and storage medium for an IPsec tunnel. Background Art

[0002] IPSecVPN is a virtual private network (VPN) technology that uses the Internet Protocol Security (IPSec) to achieve remote access. It provides a secure communication channel between two private networks on the public Internet and ensures the security and stability of user data transmission through an encrypted channel.

[0003] Load balancing, built on existing network structures, can expand the bandwidth of network devices and servers, increase throughput, enhance network data processing capabilities, and improve network flexibility and availability. Related technologies only establish an IPsec tunnel after two IPsec gateways have successfully negotiated. Load balancing can distribute negotiation packets from different branch IPsec gateways to different central IPsec gateways, enabling the normal establishment of IPsec tunnels.

[0004] Related technologies: For traffic that actively accesses branches from a central IPsec gateway, load balancing cannot determine on which central IPsec gateway the IPsec tunnel is established, and the direction of the traffic needs to be manually specified. Moreover, when the IPsec tunnel changes, load balancing cannot obtain the information about the IPsec tunnel change in a timely manner, and manual switching of the IPsec tunnel is required, which increases the labor costs of operation and maintenance engineers and affects the stability and efficiency of data transmission. Summary of the Invention

[0005] In view of this, the embodiments of the present disclosure provide a data transmission method, apparatus, device and storage medium for an IPsec tunnel. When an abnormality occurs in a gateway device or an IPsec tunnel, the load balancing device can promptly detect the abnormal state and perform link switching to a normal IPsec tunnel, thereby reducing the workload of operation and maintenance engineers. The load balancing device can more intelligently forward data from the central device, thereby improving the data transmission stability and transmission efficiency of the IPsec tunnel.

[0006] In a first aspect, an embodiment of the present disclosure provides a method for transmitting data through an IPsec tunnel, which adopts the following technical solution:

[0007] receiving a data access request from a first device, wherein the data access request carries a source IP address and a destination IP address;

[0008] Determine, according to a preset first data forwarding rule, a first identifier of the IPsec tunnel and a second identifier of the second device that match the source IP address and the destination IP address;

[0009] Sending the data access request to the second device corresponding to the second identifier through the IPsec tunnel corresponding to the first identifier;

[0010] Receive target data returned by the second device in response to the data access request, and send the target data to the first device through the IPsec tunnel.

[0011] In some embodiments, the method for generating the preset first data forwarding rule includes:

[0012] Receive a first IPsec tunnel routing table sent by the first device; wherein the first IPsec tunnel routing table includes an IPsec tunnel route generated locally by the second device after the configured IPsec tunnel is successfully established, the IPsec tunnel route including a preset source IP address and a preset destination IP address;

[0013] Obtaining second device identification information and a tunnel identifier;

[0014] Establishing a mapping relationship between the preset source IP address, the preset destination IP address, the second device identification information, and the tunnel identifier;

[0015] A first data forwarding rule between the second device and the first device is generated based on the mapping relationship.

[0016] In some embodiments, the method further comprises:

[0017] receiving a second IPsec tunnel routing table sent by the second device, where the second IPsec tunnel routing table is generated according to the updated information of the IPsec tunnel routing;

[0018] The first data forwarding rule is updated according to the second IPsec tunnel routing table to generate a second data forwarding rule.

[0019] In some embodiments, the IPsec tunnel route update information includes one or both of tunnel switching information and IP address switching information;

[0020] The tunnel switching information indicates information about switching from an IPsec tunnel with an abnormal tunnel status to an IPsec tunnel with a normal tunnel status;

[0021] The IP address switching information includes preset source IP address switching information and preset destination IP address switching information.

[0022] In some embodiments, the method further comprises:

[0023] The IPsec tunnel routing table sent by the second device is received through the vroute_info interface created on the second device.

[0024] In some embodiments, the method further comprises:

[0025] The first device is a central device, and the second device is a branch device.

[0026] In a second aspect, the embodiments of the present disclosure further provide a data transmission device for an IPsec tunnel, which adopts the following technical solution:

[0027] A first receiving unit is configured to receive a data access request from a first device, wherein the data access request carries a source IP address and a destination IP address;

[0028] A determining unit configured to determine, according to a preset first data forwarding rule, a first identifier of the IPsec tunnel and a second identifier of the second device that match the source IP address and the destination IP address;

[0029] a first sending unit, configured to send the data access request to a second device corresponding to the second identifier through the IPsec tunnel corresponding to the first identifier;

[0030] The second sending unit is configured to receive target data returned by the second device in response to the data access request, and send the target data to the first device.

[0031] In some embodiments, the apparatus further comprises:

[0032] a second receiving unit configured to receive a first IPsec tunnel routing table sent by the first device, wherein the first IPsec tunnel routing table includes an IPsec tunnel route generated locally by the second device after the configured IPsec tunnel is successfully established, the IPsec tunnel route including a preset source IP address and a preset destination IP address;

[0033] an acquiring unit, configured to acquire second device identification information and a tunnel identifier;

[0034] a mapping relationship establishing unit, configured to establish a mapping relationship between the preset source IP address, the preset destination IP address, the second device identification information, and the tunnel identifier;

[0035] The first generating unit is configured to generate a first data forwarding rule between the second device and the first device based on the mapping relationship.

[0036] In some embodiments, the apparatus further comprises:

[0037] a third receiving unit, configured to receive a second IPsec tunnel routing table sent by the second device, where the second IPsec tunnel routing table is generated according to the updated information of the IPsec tunnel routing;

[0038] The second generating unit is configured to update the first data forwarding rule according to the second IPsec tunnel routing table to generate a second data forwarding rule.

[0039] In a third aspect, the present disclosure also provides an electronic device that employs the following technical solution:

[0040] The electronic device comprises:

[0041] at least one processor; and,

[0042] a memory communicatively connected to the at least one processor; wherein,

[0043] The memory stores instructions that can be executed by the at least one processor. The instructions are executed by the at least one processor to enable the at least one processor to perform any of the above-mentioned methods for transmitting data in an IPsec tunnel.

[0044] In a fourth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to execute any of the above-mentioned IPsec tunnel data transmission methods.

[0045] The embodiments of the present disclosure provide a data transmission method, apparatus, device, and storage medium for an IPsec tunnel. The method is applied to a load balancing device in an Internet Protocol security (IPSec) network. After receiving a data access request from a first device, the load balancing device can, according to a pre-established first data forwarding rule, send the data access request to a second device that matches the source IP address and destination IP address in the data access request through an IPsec tunnel that matches the source IP address and destination IP address, receive the target data returned by the second device, and send the target data to the first device. When the state of the IPsec tunnel changes, the load balancing device generates a second data forwarding rule based on the second IPsec tunnel routing table received from the second device. That is, the load balancing device can obtain updated data of the IPsec tunnel in a timely manner and forward data more intelligently based on the switched IPsec tunnel. This can reduce the workload of operation and maintenance engineers and improve the stability and efficiency of data transmission through the IPsec tunnel.

[0046] The above description is only an overview of the technical solution of the present disclosure. In order to more clearly understand the technical means of the present disclosure, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present disclosure more obvious and easy to understand, the following specifically cites preferred embodiments and describes them in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0048] Figure 1 A flowchart of a method for transmitting data in an IPsec tunnel provided in an embodiment of the present disclosure;

[0049] Figure 2 A schematic diagram of the structure of a data transmission device for an IPsec tunnel provided in an embodiment of the present disclosure;

[0050] Figure 3 A block diagram of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0051] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0052] It should be clear that the following embodiments of the present disclosure are described through specific concrete examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other in the absence of conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present disclosure.

[0053] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on this disclosure, it should be understood by those skilled in the art that an aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects described herein can be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein can be used to implement this device and / or practice this method.

[0054] It should also be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present disclosure. The illustrations only show components related to the present disclosure and are not drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component can be changed at will, and the component layout type may also be more complicated.

[0055] Additionally, in the following description, specific details are provided to provide a thorough understanding of the examples. However, one skilled in the art will appreciate that the aspects described can be practiced without these specific details.

[0056] like Figure 1 As shown, an embodiment of the present disclosure provides a method for data transmission in an IPsec tunnel. The method is applied to a load balancing device in an Internet Protocol security (IPsec) network. The IPsec network further includes a first device and a second device, wherein the first device is a central device and the second device is a branch device. The method includes the following steps:

[0057] S101: A load balancing device receives a data access request from a first device, where the data access request carries a source IP address and a destination IP address.

[0058] When a first device (central device) accesses data from a second device (branch device), it sends a data access request to a load balancing device. The load balancing device uses the source IP address (the first device's IP address) and destination IP address (the second device's IP address) in the data access request to locate the correct IPsec tunnel and forward the data. For example, the data forwarded by the load balancing device can be encrypted messages.

[0059] S102: The load balancing device determines, according to a preset first data forwarding rule, a first identifier of the IPsec tunnel and a second identifier of the second device that match the source IP address and the destination IP address.

[0060] The IPsec network includes multiple branch devices, and the second device is one of the multiple branch devices. The load balancing device can determine the second identifier of the second device to be accessed by the first device and the first identifier of the IPsec tunnel used to transmit data through a pre-generated first data forwarding rule. The load balancing device can then actively select the correct IPsec tunnel to forward the access request data of the first device to the correct second device.

[0061] S103: The load balancing device sends the data access request to the second device corresponding to the second identifier through the IPsec tunnel corresponding to the first identifier.

[0062] The load balancing device selects a correct IPsec tunnel and a correct second device according to a pre-generated first data forwarding rule, and forwards the data access request to the second device.

[0063] S104: The load balancing device receives the target data returned by the second device in response to the data access request, and sends the target data to the first device through the IPsec tunnel.

[0064] In the embodiment of the present disclosure, when the state of the IPsec tunnel changes, the load balancing device updates the first data forwarding rule according to the updated IPsec tunnel routing table sent by the second device, that is, according to the second IPsec tunnel routing table, and generates a second data forwarding rule. That is, the load balancing device can obtain the updated data of the IPsec tunnel in a timely manner, and forward the data more intelligently according to the switched IPsec tunnel, which can reduce the workload of operation and maintenance engineers and improve the stability and transmission efficiency of IPsec tunnel data transmission.

[0065] In some embodiments, the method for generating the preset first data forwarding rule may include the following steps:

[0066] The load balancing device receives a first IPsec tunnel routing table sent by the second device; wherein the first IPsec tunnel routing table includes an IPsec tunnel route generated locally by the second device after the configured IPsec tunnel is successfully established, and the IPsec tunnel route includes a preset source IP address and a preset destination IP address;

[0067] The load balancing device obtains the second device identification information and the tunnel identification;

[0068] The load balancing device establishes a mapping relationship between a preset source IP address, a preset destination IP address, the second device identification information, and a tunnel identifier;

[0069] The load balancing device generates a first data forwarding rule for the second device and the first device based on the mapping relationship.

[0070] Optionally, after the IPsec tunnel is successfully established, the second device in the IPsec network generates a virtual route locally on the second device, which is the IPsec tunnel route, and adds the IPsec tunnel route to the first IPsec tunnel routing table, wherein the IPsec tunnel routing table includes a preset source IP address, preset source IP address mask information, preset destination IP address, and preset destination IP address mask information.

[0071] Optionally, a vroute_info interface is created on the second device, and the second device sends the locally generated first IPsec tunnel routing table to the load balancing device through the vroute_info interface. The load balancing device records the received first IPsec tunnel routing table.

[0072] In some embodiments, the method further comprises:

[0073] The load balancing device receives an updated IPsec tunnel routing table sent by the second device, that is, a second IPsec tunnel routing table, where the second IPsec tunnel routing table is generated according to the updated information of the IPsec tunnel routing;

[0074] The load balancing device updates the first data forwarding rule according to the second IPsec tunnel routing table to generate a second data forwarding rule.

[0075] Optionally, when the network status is abnormal due to factors such as network disconnection, the status of the IPsec tunnel successfully established by the second device will become abnormal. For example, two IPsec tunnels including IPsec tunnel A and IPsec tunnel B are configured on the second device. IPsec tunnel A is successfully established and IPsec tunnel B fails to be established. The load balancing device forwards data between the second device and the first device through the successfully established IPsec tunnel A; however, due to the abnormal network status, the status of IPsec tunnel A is abnormal. For example, IPsec tunnel A fails to be established and IPsec tunnel B is successfully established, then the second device switches the tunnel for forwarding data from IPsec tunnel A to IPsec tunnel B, and updates the first IPsec tunnel routing table with the tunnel switching information to obtain a second IPsec tunnel routing table. The IPsec tunnel route contained in the second IPsec tunnel routing table is the virtual route of IPsec tunnel B.

[0076] The load balancing device generates a second data forwarding rule according to the second IPsec tunnel routing table including the virtual route of IPsec tunnel B, ie, forwards data between the first device and the second device through IPsec tunnel B according to the second data forwarding rule.

[0077] Optionally, after receiving the second IPsec tunnel routing table, the load balancing device deletes the historical data forwarding rule (ie, deletes the first data forwarding rule) and generates a new data forwarding rule according to the received second IPsec tunnel routing table, ie, generates a second data forwarding rule.

[0078] For example, the two IPsec tunnels configured by the first device 1 include IPsec tunnel A and IPsec tunnel B. The preset source IP address of the virtual routing configuration of IPsec tunnel A is 192.168.1.0 / 24, and the preset destination IP address of the virtual routing configuration of IPsec tunnel A is 192.168.2.0 / 24; the preset source IP address of the virtual routing configuration of IPsec tunnel B is 192.168.3.0 / 24, and the preset destination IP address of the virtual routing configuration of IPsec tunnel B is 192.168.4.0 / 24. When the current network status is normal, IPsec tunnel A on the first device 1 is successfully established, and IPsec tunnel B fails to be established. The first device 1 sends the first IPsec tunnel routing table containing the virtual routing of IPsec tunnel B to the load balancing device, so that the load balancing device generates a first data forwarding rule through the first IPsec tunnel routing table, and forwards data between the first device and the second device 1 through IPsec tunnel A according to the first data forwarding rule.

[0079] The two IPsec tunnels configured on the second device 2 include IPsec tunnel C and IPsec tunnel D. The preset source IP address of the virtual route configuration of IPsec tunnel C is 192.168.3.0 / 24, and the destination IP address of the virtual route configuration of IPsec tunnel C is 192.168.4.0 / 24. The preset source IP address of the virtual route configuration of IPsec tunnel D is 192.168.1.0 / 24, and the preset destination IP address of the virtual route configuration of IPsec tunnel D is 192.168.2.0 / 24. When the current network status is normal, IPsec tunnel C on the second device 2 is successfully established, and IPsec tunnel D fails to be established. The second device 2 sends the first IPsec tunnel routing table containing the virtual route of IPsec tunnel C to the load balancing device, so that the load balancing device generates a first data forwarding rule through the first IPsec tunnel routing table, and forwards data between the first device and the second device 2 through IPsec tunnel C according to the first data forwarding rule.

[0080] A vroute_info interface is created on both the second device 1 and the second device 2. The second device 1 sends the preset source IP address 192.168.1.0 / 24 and the preset destination IP address 192.168.2.0 / 24 of the IPsec tunnel route generated after the successful establishment of IPsec tunnel A to the load balancing device through the vroute_info interface; similarly, the second device 2 sends the preset source IP address 192.168.3.0 / 24 and the preset destination IP address 192.168.4.0 / 24 of the IPsec tunnel route generated after the successful establishment of IPsec tunnel C to the load balancing device through the vroute_info interface.

[0081] After the load balancing device receives the first IPsec tunnel routing table sent by the second device 1 and the second device 2, it generates a first data forwarding rule. According to the first data forwarding rule, the load balancing device forwards the data sent by the first device with a source IP address of 192.168.1.0 / 24 and a destination IP address of 192.168.2.0 / 24 to the second device 1; according to the first data forwarding rule, the load balancing device forwards the data sent by the first device with a source IP address of 192.168.3.0 / 24 and a destination IP address of 192.168.4.0 / 24 to the second device 2.

[0082] When the network status changes, for example, when the network is open, IPsec tunnel A on the second device 1 fails to be established, IPsec tunnel B is successfully established, and IPsec tunnel C on the second device 2 fails to be established, IPsec tunnel D is successfully established, then the source IP address of the virtual route in the first IPsec tunnel routing table sent by the second device 1 to the load balancing device is updated to 192.168.3.0 / 24, and the destination IP address is updated to 192.168.4.0 / 24; the source IP address of the virtual route in the first IPsec tunnel routing table sent by the second device 2 to the load balancing device is updated to 192.168.1.0 / 24, and the destination IP address is updated to 192.168.2.0 / 24.

[0083] The load balancing device regenerates the second data forwarding rules for the second device 1 and the first device based on the second IPsec tunnel routing table sent by the second device 1. The load balancing device forwards the data sent by the first device with a source IP address of 192.168.3.0 / 24 and a destination IP address of 192.168.4.0 / 24 to the second device 1 according to the new second data forwarding rules.

[0084] The load balancing device regenerates the second data forwarding rules for the second device 2 and the first device based on the second IPsec tunnel routing table sent by the second device 2. The load balancing device forwards the data sent by the first device with a source IP address of 192.168.1.0 / 24 and a destination IP address of 192.168.2.0 / 24 to the second device 2 according to the second data forwarding rules.

[0085] In some embodiments, the update information of the IPsec tunnel routing includes one or both of tunnel switching information and IP address switching information; the tunnel switching information represents information about switching from an IPsec tunnel with an abnormal tunnel status to an IPsec tunnel with a normal tunnel status; the IP address switching information includes preset source IP address switching information and preset destination IP address switching information.

[0086] In some embodiments, the method further comprises:

[0087] The load balancing device receives the IPsec tunnel routing table sent by the second device through the vroute_info interface created on the second device.

[0088] The disclosed embodiment solves the problem of data forwarding when actively accessing branch devices from a central device. When an abnormality occurs in a branch device or an IPsec tunnel, the load balancing device can promptly detect the abnormal information and perform IPsec tunnel switching. The data between the central device and the branch device is forwarded according to the new IPsec tunnel after switching, which can reduce the workload of operation and maintenance engineers and improve the stability and efficiency of data transmission.

[0089] like Figure 2 As shown, an embodiment of the present disclosure further provides an IPsec tunnel data transmission device, which is provided in a load balancing device in an Internet Protocol security IPSec network. The IPSec network also includes a first device and a second device, wherein the first device is a central device and the second device is a branch device. The device includes:

[0090] The first receiving unit 21 is configured to receive a data access request from a first device, wherein the data access request carries a source IP address and a destination IP address;

[0091] The determining unit 22 is configured to determine a first identifier of the IPsec tunnel and a second identifier of the second device that match the source IP address and the destination IP address according to a preset first data forwarding rule;

[0092] The first sending unit 23 is configured to send the data access request to the second device corresponding to the second identifier through the IPsec tunnel corresponding to the first identifier;

[0093] The second sending unit 24 is configured to receive target data returned by the second device in response to the data access request, and send the target data to the first device.

[0094] In some embodiments, the apparatus further comprises:

[0095] A second receiving unit is configured to receive a first IPsec tunnel routing table sent by the first device, wherein the first IPsec tunnel routing table includes an IPsec tunnel route generated locally by the second device after the configured IPsec tunnel is successfully established, the IPsec tunnel route including a preset source IP address and a preset destination IP address;

[0096] an acquiring unit, configured to acquire second device identification information and a tunnel identifier;

[0097] A mapping relationship establishing unit, configured to establish a mapping relationship between a preset source IP address, a preset destination IP address, the second device identification information, and a tunnel identifier;

[0098] The first generating unit is configured to generate a first data forwarding rule between the second device and the first device based on the mapping relationship.

[0099] In some embodiments, the apparatus further comprises:

[0100] a third receiving unit, configured to receive a second IPsec tunnel routing table sent by the second device, where the second IPsec tunnel routing table is generated according to the updated information of the IPsec tunnel routing;

[0101] The second generating unit is configured to update the first data forwarding rule according to the second IPsec tunnel routing table to generate a second data forwarding rule.

[0102] In some embodiments, the apparatus further comprises:

[0103] The fourth receiving unit is configured to receive the first IPsec tunnel routing table sent by the second device through the vroute_info interface created on the second device.

[0104] In some embodiments, the update information of the IPsec tunnel routing includes one or both of tunnel switching information and IP address switching information. The tunnel switching information indicates information about switching from an IPsec tunnel with an abnormal tunnel status to an IPsec tunnel with a normal tunnel status; the IP address switching information includes preset source IP address switching information and preset destination IP address switching information.

[0105] An electronic device according to an embodiment of the present disclosure includes a memory and a processor. The memory is used to store non-transitory computer-readable instructions. Specifically, the memory may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may, for example, include random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory may, for example, include a read-only memory (ROM), a hard disk, a flash memory, etc.

[0106] The processor can be a central processing unit (CPU) or other form of processing unit with data processing capabilities and / or instruction execution capabilities, and can control other components in the electronic device to perform desired functions. In one embodiment of the present disclosure, the processor is used to execute the computer-readable instructions stored in the memory, causing the electronic device to perform all or part of the steps of the IPsec tunnel data transmission method described in each embodiment of the present disclosure.

[0107] Those skilled in the art should understand that in order to solve the technical problem of how to obtain a good user experience, this embodiment may also include well-known structures such as a communication bus and an interface, and these well-known structures should also be included in the scope of protection of this disclosure.

[0108] like Figure 3 The present invention provides a schematic structural diagram of an electronic device according to an embodiment of the present invention, which is suitable for implementing the electronic device according to an embodiment of the present invention. Figure 3 The electronic device shown is only an example and should not limit the functions and scope of use of the embodiments of the present disclosure.

[0109] like Figure 3 As shown, the electronic device may include a processing device (such as a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) or a program loaded from a storage device into a random access memory (RAM). In the RAM, various programs and data required for the operation of the electronic device are also stored. The processing device, ROM, and RAM are connected to each other via a bus. An input / output (I / O) interface is also connected to the bus.

[0110] Typically, the following devices can be connected to the I / O interface: input devices such as sensors or visual information acquisition devices; output devices such as display screens; storage devices such as tapes and hard disks; and communication devices. The communication device allows the electronic device to communicate with other devices (such as edge computing devices) wirelessly or by wire to exchange data. Figure 3The electronic device is shown with various devices, but it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed instead.

[0111] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processing device, all or part of the steps of the data transmission method of the IPsec tunnel of the embodiment of the present disclosure are performed.

[0112] For detailed description of this embodiment, please refer to the corresponding description in the aforementioned embodiments, which will not be repeated here.

[0113] According to an embodiment of the present disclosure, a computer-readable storage medium stores non-transitory computer-readable instructions, which, when executed by a processor, execute all or part of the steps of the aforementioned IPsec tunnel data transmission method of each embodiment of the present disclosure.

[0114] The above-mentioned computer-readable storage media include, but are not limited to, optical storage media (e.g., CD-ROMs and DVDs), magneto-optical storage media (e.g., MOs), magnetic storage media (e.g., magnetic tapes or mobile hard disks), media with built-in rewritable non-volatile memory (e.g., memory cards), and media with built-in ROM (e.g., ROM cartridges).

[0115] For detailed description of this embodiment, please refer to the corresponding description in the aforementioned embodiments, which will not be repeated here.

[0116] The basic principles of the present disclosure have been described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, and effects mentioned in this disclosure are merely illustrative and not restrictive, and should not be construed as necessarily possessed by each embodiment of the present disclosure. Furthermore, the specific details disclosed above are provided for illustrative purposes and to facilitate understanding, rather than as limitations. These details do not limit the present disclosure to necessarily being implemented using these specific details.

[0117] In the present disclosure, relational terms such as first and second, etc. are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. The block diagrams of the devices, devices, equipment, and systems involved in the present disclosure are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, devices, equipment, and systems can be connected, arranged, or configured in any manner. Words such as "including," "comprising," "having," and the like are open-ended words, meaning "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or" and can be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and can be used interchangeably therewith.

[0118] Additionally, as used herein, "or" used in a list of items beginning with "at least one" indicates a separate list, so that, for example, a list of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not mean that the example described is preferred or better than other examples.

[0119] It should also be noted that in the system and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0120] Various changes, substitutions, and modifications may be made to the technology described herein without departing from the teachings defined by the appended claims. Moreover, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of things, means, methods, and actions described above. Currently existing or later developed processes, machines, manufactures, compositions of things, means, methods, or actions that perform substantially the same function or achieve substantially the same results as the corresponding aspects described herein may be utilized. Accordingly, the appended claims include within their scope such processes, machines, manufactures, compositions of things, means, methods, or actions.

[0121] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0122] The above description has been provided for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although a number of example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations thereof.

Claims

1. A data transmission method for an IPsec tunnel, characterized in that: The method comprises: receiving a data access request from a first device, wherein the data access request carries a source IP address and a destination IP address; Determine, according to a preset first data forwarding rule, a first identifier of the IPsec tunnel and a second identifier of the second device that match the source IP address and the destination IP address; Sending the data access request to the second device corresponding to the second identifier through the IPsec tunnel corresponding to the first identifier; receiving target data returned by the second device in response to the data access request, and sending the target data to the first device through the IPsec tunnel; The method for generating the preset first data forwarding rule includes: Receive a first IPsec tunnel routing table sent by the second device; wherein the first IPsec tunnel routing table includes an IPsec tunnel route generated locally by the second device after the configured IPsec tunnel is successfully established, the IPsec tunnel route including a preset source IP address and a preset destination IP address; Obtaining second device identification information and a tunnel identifier; Establishing a mapping relationship between the preset source IP address, the preset destination IP address, the second device identification information, and the tunnel identifier; A first data forwarding rule between the second device and the first device is generated based on the mapping relationship.

2. The data transmission method of the IPsec tunnel according to claim 1, characterized in that: The method further comprises: receiving a second IPsec tunnel routing table sent by the second device, where the second IPsec tunnel routing table is generated according to the updated information of the IPsec tunnel routing; The first data forwarding rule is updated according to the second IPsec tunnel routing table to generate a second data forwarding rule.

3. The data transmission method of the IPsec tunnel according to claim 2, characterized in that: The IPsec tunnel route update information includes one or both of tunnel switching information and IP address switching information; The tunnel switching information indicates information about switching from an IPsec tunnel with an abnormal tunnel status to an IPsec tunnel with a normal tunnel status; The IP address switching information includes preset source IP address switching information and preset destination IP address switching information.

4. The data transmission method of the IPsec tunnel according to claim 1, characterized in that: The method further comprises: The second device sends the locally generated first IPsec tunnel routing table to the load balancing device through the vroute_info interface.

5. The data transmission method of the IPsec tunnel according to claim 1, characterized in that: The method further comprises: The first device is a central device, and the second device is a branch device.

6. A data transmission device for an IPsec tunnel, characterized in that: include: A first receiving unit is configured to receive a data access request from a first device, wherein the data access request carries a source IP address and a destination IP address; A determining unit configured to determine, according to a preset first data forwarding rule, a first identifier of the IPsec tunnel and a second identifier of the second device that match the source IP address and the destination IP address; a first sending unit, configured to send the data access request to a second device corresponding to the second identifier through the IPsec tunnel corresponding to the first identifier; a second sending unit, configured to receive target data returned by the second device in response to the data access request, and send the target data to the first device; Wherein, the device further comprises: a second receiving unit configured to receive a first IPsec tunnel routing table sent by the second device; wherein the first IPsec tunnel routing table includes an IPsec tunnel route generated locally by the second device after the configured IPsec tunnel is successfully established, the IPsec tunnel route including a preset source IP address and a preset destination IP address; an acquiring unit, configured to acquire second device identification information and a tunnel identifier; a mapping relationship establishing unit, configured to establish a mapping relationship between the preset source IP address, the preset destination IP address, the second device identification information, and the tunnel identifier; The first generating unit is configured to generate a first data forwarding rule between the second device and the first device based on the mapping relationship.

7. The data transmission device of the IPsec tunnel according to claim 6, characterized in that: The device further comprises: a third receiving unit, configured to receive a second IPsec tunnel routing table sent by the second device, where the second IPsec tunnel routing table is generated according to the updated information of the IPsec tunnel routing; The second generating unit is configured to update the first data forwarding rule according to the second IPsec tunnel routing table to generate a second data forwarding rule.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the data transmission method for the IPsec tunnel according to any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the data transmission method of the IPsec tunnel according to any one of claims 1 to 5.

Images