SSLVPN Login and Data Synchronization Method, System, and Electronic Device

Abstract

The present application provides an SSLVPN login and data synchronization method, system, and electronic device, which relate to the field of communications. This method is applied to an SSLVPN server with multiple service boards; the SSLVPN login and data synchronization method includes: receiving an original message and splitting the original message to a target service board so that the target service board obtains a split message; in the target service board, determining a user login authentication message and / or other service messages from the split message; if a user login authentication message is determined, the target service board processes the user login authentication message. Using the SSLVPN login and data synchronization method provided by the embodiments of the present application, it is possible to achieve load balancing of SSLVPN user login authentication services by multiple service boards in a distributed system, and it is possible to solve the problem of inconsistent user information between service boards.

Description

Technical Field

[0001] This application relates to the field of communications, and in particular, to an SSLVPN login and data synchronization method, system, and electronic device. Background Art

[0002] SSLVPN refers to a VPN technology that establishes a remote secure access channel based on the Secure Sockets Layer protocol (SSL). As a VPN technology that has emerged in recent years, its application has developed rapidly with the popularization of the Web and the rise of e-commerce and telecommuting. The SSL protocol mainly consists of the SSL record protocol and the handshake protocol, which jointly provide authentication, encryption, and anti-tampering functions for application access connections. The SSL handshake protocol, compared with the IKE (Internet Key Exchange) protocol in the IPSEC protocol system, is mainly used for mutual authentication between the server and the client, negotiating encryption algorithms and MAC (Message Authentication Code) algorithms, and generating encryption and authentication keys used in the SSL record protocol.

[0003] Currently, in a distributed service system, when a client logs in to an SSLVPN server, the main control service board generally processes user login messages. However, when the network traffic is large and a large number of users go online simultaneously, it will increase the data processing burden on the main control service board, affect the processing efficiency of user login authentication messages, and thus affect the user experience. Summary of the Invention

[0004] The purpose of the embodiments of this application is to provide an SSLVPN login and data synchronization method, system, and electronic device. After receiving the original message by an SSLVPN server with multiple service boards, the original message is shunted, and the original message is shunted to each service board; thus enabling each service board to obtain its own shunted message, and each service board distinguishes and identifies the shunted message it obtains;

[0005] Process the identified user login authentication message. Using the SSLVPN5 login and data synchronization method provided by the embodiments of this application, the SSLVPN user login authentication message can be evenly shunted to each

[0006] service board; it can effectively avoid the over-heavy data processing burden on the main control service board and improve the processing efficiency of user login authentication messages.

[0007] In a first aspect, the embodiments of this application provide an SSLVPN login and data synchronization method, the method

[0008] The method is applied to an SSLVPN server with multiple service boards; the method includes: receiving an original packet, and splitting the original packet to a target service board so that the target service board obtains a split packet; at the target

[0009] service board, determining a user login authentication packet and / or other local service packets from the split packet;

[0010] If a user login authentication packet is determined, the target service board processes the user login authentication packet.

[0011] In the above implementation process, after receiving the original packet, the SSLVPN server with multiple service boards splits the original packet and distributes the original packet to each service board; thus, each service board obtains its own split packet, and each service board distinguishes and identifies the split packet it obtains; and processes the identified user login authentication packet. That is to say, the SSLVPN login and data synchronization method provided by the embodiments of the present application can evenly split the packets to each service board; effectively avoid the overloading of the data processing burden on the main control service board, and improve the processing efficiency of the user login authentication packet.

[0012] Optionally, in the embodiments of the present application, the service board includes a switching board; receiving the original packet and splitting the original packet to a target service board so that the target service board obtains a split packet includes: the switching board receives the original packet and obtains the source IP and destination IP from the original packet; according to the source IP and destination IP, the original packet is split to different target service boards so that different target service boards obtain split packets.

[0013] In the above implementation process, in the embodiments of the present application, after receiving the original packet, the switching board obtains the source IP and destination IP from the original packet; according to the source IP and destination IP, the original packet is split to different target service boards so that different target service boards obtain split packets; wherein, the splitting method may be to split the packets using a hash algorithm. The SSLVPN login and data synchronization method provided by the embodiments of the present application splits the packets after the switching board receives the packets and distributes them to each service board; thus realizing load balancing and avoiding excessive pressure on the main control service board.

[0014] Optionally, in the embodiments of the present application, determining a user login authentication packet and / or other local service packets from the split packet at the target service board includes: obtaining the packet characteristics of the split packet; and identifying the user login authentication packet and other local service packets according to the packet characteristics of the split packet.

[0015] In the above implementation process, in the embodiments of the present application, the service board will identify and distinguish the shunted packets; and then distinguish the local packets and non-local packets, as well as the user login authentication packets and other local service packets in the local packets. Thus, the SSLVPN user login authentication packets can be accurately distinguished from the local packets, which is beneficial to the subsequent processing of the SSLVPN user login authentication packets.

[0016] Optionally, in the embodiments of the present application, the service board further includes a main control service board; after determining the user login authentication packets and / or other local service packets from the shunted packets on the target service board, the method further includes: if other local service packets are determined, determining whether the target service board is the main control service board; if it is determined that the target service board is the main control service board, then the target service board processes the other local service packets.

[0017] In the above implementation process, when other local service packets are determined in the shunted packets; further, determining whether the target service board is the main control service board, if it is the main control service board, then directly let the target service board process the above-mentioned other local service packets. That is to say, whether it is the main control service board or other service boards, they can directly process the user login packets, while other local service packets need to be processed by the main control service board, so as to disperse the user login packets to each service board and avoid the service congestion of the main control service board.

[0018] Optionally, in the embodiments of the present application, the method further includes: if it is determined that the target service board is not the main control service board, then forwarding the other local service packets from the target service board to the main control service board; and the main control service board processes the other local service packets.

[0019] In the above implementation process, when other local service packets are determined in the shunted packets; further, determining whether the target service board is the main control service board, if it is a non-main control service board, then forwarding the other local service packets from the target service board to the main control service board; and the main control service board processes the other local service packets. That is to say, when there are other local service packets in the packets received by the non-main control service board, the other local service packets need to be processed by the main control service board.

[0020] Optionally, in the embodiments of the present application, after the target service board processes the user login authentication packets, the method further includes: monitoring and obtaining the user real-time update data; determining whether the target service board is the control service board; if the target service board is the control service board, then the control service board synchronizes the user real-time update data to each service board.

[0021] In the above implementation process, the online SSLVPN users generate real-time user information data based on the current service board. If the current service board is the control board, the data is directly synchronized to other service boards. Otherwise, it is first notified to the main control service board, and the main control service board synchronizes it to other service boards except the source board through the inter-board message synchronization method, ensuring the consistency of the SSLVPN online user information of each service board.

[0022] Optionally, in the embodiment of the present application, the method further includes: if the target service board is not the control service board, the target service board sends the user real-time update data to the main control service board; the main control service board synchronizes the user real-time update data to each service board.

[0023] In the above implementation process, after each service board processes the user login authentication message, the

[0024] service board detects and obtains the real-time update data of the user. If the target service board is not the control service board, the target service board sends the user real-time update data to the main control service board; the main control service board synchronizes the user real-time update data to each service board. That is to say, the SSLVPN login and data synchronization method provided by the embodiment of the present application can synchronize the SSLVPN online user information between boards, ensuring the consistency of the SSLVPN user information of each service board.

[0025] In a second aspect, the embodiment of the present application provides an SSLVPN login and data synchronization system, which includes: a message shunting module, a message parsing module, and a login message processing module; the message shunting module is used to receive the original message and shunt the original message to the target service board so that the target service board obtains the shunted message; the message parsing module is used to determine the user login authentication message and / or other local service messages from the shunted message on the target service board; and the login message processing module is further used to process the user login authentication message by the target service board when the user login authentication message is determined.

[0026] In a third aspect, the embodiment of the present application provides an electronic device, which includes a memory and a processor. When the processor reads and runs the program instructions stored in the memory, it executes the steps in any of the above implementation manners.

[0027] In a fourth aspect, the embodiment of the present application further provides a computer-readable storage medium, in which computer program instructions are stored. When the computer program instructions are read and run by a processor, they execute the steps in any of the above implementation manners. Description of the Drawings

[0028] To more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the accompanying drawings required for the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as limiting the scope. For those of ordinary skill in the art, without creative efforts, other related drawings can also be obtained based on these drawings.

[0029] Figure 1 The SSLVPN login flowchart provided for the embodiments of the present application;

[0030] <O000065>The flowchart of message shunting provided for the embodiments of the present application;

[0031] Figure 3 The message parsing flowchart provided for the embodiments of the present application;

[0032] Figure 4 The flowchart of other local service message processing provided for the embodiments of the present application;

[0033] Figure 5 The data synchronization flowchart provided for the embodiments of the present application;

[0034] Figure 6 The flowchart of SSLVPN login and data synchronization provided for the embodiments of the present application;

[0035] Figure 7 The schematic diagram of user login authentication processing in the SSLVPN usage scenario provided for the embodiments of the present application;

[0036] Figure 8 The module schematic diagram of the SSLVPN login and data synchronization system provided for the embodiments of the present application;

[0037] Figure 9 The structural schematic diagram of the electronic device provided for the embodiments of the present application. Detailed implementation manners

[0038] It should be noted that there is a misspelling in the original text. "<O000065>" should be " Figure 2 ". This has been corrected in the translation.The technical solutions in the embodiments of the present application will be described below with reference to the accompanying drawings in the embodiments of the present application. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions, and operations of systems, methods, and computer program products according to multiple embodiments of the present invention. In this regard, each block in the flowchart or block diagram may represent a module, a program segment, or a part of code, and the module, program segment, or part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than marked in the accompanying drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, as well as the combination of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system that performs the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions. In addition, the functional modules in the various embodiments of the present invention may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0039] During the research process, the applicant found that in a distributed system, when processing the client's login to the SSLVPN, the client logs in to the SSLVPN server, and the source IP of the user login authentication message is the local actual network card IP, and the destination IP is the SSLVPN server IP; for the network security device, the SSLVPN user login authentication request message is a message to the local machine and belongs to a special type of message, which is processed by the main control service board. When the network traffic is large and a large number of users go online simultaneously, it will inevitably increase the data processing burden on the main control service board, affect the processing efficiency of the user login authentication message, and thus affect the user experience; therefore, in a distributed system, the network security device needs to implement multiple service boards to provide the SSLVPN user login authentication service simultaneously.

[0040] On the other hand, when a client successfully logs in to the SSLVPN server, online user logout, account information modification, and other operations are based on the current business board to generate real-time user information data. Network security equipment provides SSLVPN user login authentication services on multiple business boards at the same time. If the user information of each business board is inconsistent, there may be problems such as the same user being online simultaneously on different business boards, or inconsistent user account information. Therefore, in a distributed system, SSLVPN online user information must be synchronized between each business board to ensure the consistency of SSLVPN user information. However, due to the particularity of distributed device management, management information cannot be directly synchronized between ordinary business boards. Therefore, in a distributed system, to achieve load balancing for SSLVPN user login authentication services on multiple business boards, it is necessary to simultaneously solve the problem of SSLVPN online user information synchronization between boards.

[0041] Based on this, this solution proposes an SSLVPN login and data synchronization method. In a distributed system, an SSLVPN user logs in to the SSLVPN server through a client. The user login authentication request message first reaches the switch board, which diverts the message to the designated business board for processing based on the source and destination IP hash. The business board identifies the message as a local message from the destination IP to the local machine, and then determines whether it is an SSLVPN user login authentication request message. By processing the SSLVPN user login authentication request local message based on the current business board, multiple business boards can load share the SSLVPN user login authentication processing business.

[0042] Before introducing the specifics of this application, let's first briefly discuss distributed architecture. In a distributed system, devices typically utilize multiple switch boards and service boards to provide data forwarding and processing functions. Service boards are divided into control service boards and standard service boards. Control boards are divided into primary and backup. To meet the needs of device management and distributed device integration, the primary control service board not only provides normal data message processing but also handles management tasks such as device configuration and special message processing.

[0043] Next, we'll introduce SSLVPN, which allows remote users to securely and efficiently access internal corporate network resources over the Internet. A client logs in to an SSLVPN server. After authentication, the client establishes an SSLVPN tunnel with the server. A virtual network adapter (NIC) is automatically created locally on the client. Through message exchange with the SSLVPN server, the client allocates the NIC address and learns routes for accessing internal network resources. The client can then access internal network resources using the private network address of the NIC and the SSLVPN tunnel.

[0044] Please see Figure 1 , Figure 1The flowchart of SSLVPN login provided by the embodiments of this application; this method is applied to an SSLVPN server with multiple service boards, and this method includes the following steps:

[0045] Step S100: Receive the original packet and split the original packet to the target service board so that the target service board obtains the split packet.

[0046] In the above step S100, the SSLVPN server receives the original packet and splits the original packet to the target service board, so that the target service board obtains the split packet. It should be noted that at this time, the types and natures of the packets are not distinguished, and the SSLVPN server directly splits all the obtained packets and distributes them to each service board.

[0047] Step S101: On the target service board, determine the user login authentication packet and / or other local service packets from the split packets.

[0048] In the above step S101, after the packets are split to each service board, further; determine the user login authentication packet and / or other local service packets on each service board. It can be understood that among the packets split to each service board, there may be user login authentication packets and other local service packets, only user login authentication packets, or only other local service packets; and the SSLVPN login and data synchronization method provided by the embodiments of this application only processes user login authentication packets, so it is necessary to distinguish between user login authentication packets and other local service packets.

[0049] Step S102: If a user login authentication packet is determined, the target service board processes the user login authentication packet.

[0050] In the above step S102, if a user login authentication packet is determined from the split packets, then the current service board processes the user login authentication packet. That is to say, in the split packets of each service board in the SSLVPN login and data synchronization method provided by the embodiments of this application, as long as a user login authentication packet is detected, the user login authentication packet is processed by the current service board.

[0051] Through Figure 1It can be known that after receiving the original packet, the SSLVPN server with multiple service boards shunts the original packet and shunts it to each service board; thus, each service board obtains its own shunted packet, and each service board distinguishes and identifies the shunted packet it obtains; and processes the identified user login authentication packet. That is to say, the SSLVPN login and data synchronization method provided by the embodiments of the present application can evenly shunt the packets to each service board; effectively avoid the over-heavy data processing burden on the main control service board, and improve the processing efficiency of the user login authentication packet.

[0052] Please view Figure 2 , Figure 2 is the flowchart of packet shunting provided by the embodiments of the present application; the service boards of the SSLVPN server include switching boards. Briefly speaking, the main purpose of the switching board is to shunt the original packet to other service boards. In an alternative implementation of the embodiments of the present application, receiving the original packet and shunting the original packet to the target service board so that the target service board obtains the shunted packet includes:

[0053] Step S200: The switching board receives the original packet and obtains the source IP and destination IP from the original packet.

[0054] In the above step S200, following the previous text, after the switching board of the SSLVPN server receives the original packet, it shunts the original packet; it is necessary to obtain the source IP and destination IP from the original packet, and then the packet can be shunted. Among them, the source IP is the user's local network card IP, and the destination IP is the SSLVPN server entry IP.

[0055] Step S201: According to the source IP and destination IP, shunt the original packet to different target service boards so that different target service boards obtain the shunted packet.

[0056] In the above step S201, the SSLVPN server receives the packet. When the packet arrives at the switching board, the switching board shunts and hashes the packet to different service boards for processing based on the source and destination IPs. It should be understood that using the hash function for shunting can balance the load.

[0057] Through Figure 2 It can be known that in the embodiments of the present application, after the switching board receives the original packet, it obtains the source IP and destination IP from the original packet; according to the source IP and destination IP, shunts the original packet to different target service boards so that different target service boards obtain the shunted packet; among them, the shunting method can be to use the hash algorithm to shunt the packet. The SSLVPN login and data synchronization method provided by the embodiments of the present application shunts the packet after the switching board receives the packet and reaches each service board; thus realizing load balancing and avoiding excessive pressure on the main control service board.

[0058] Please refer to Figure 3 , Figure 3 which is the message parsing flowchart provided by the embodiments of the present application; in an alternative embodiment of the embodiments of the present application, on the target service board, to determine the user login authentication message and / or other local service messages from the shunted messages, the following steps may be implemented:

[0059] Step S300: Obtain the message characteristics of the shunted message.

[0060] In the above step S300, in order to identify the user login message and / or other local service messages, that is to say, it is necessary to parse the message; to parse the message, it is necessary to obtain the message characteristics of the shunted message. Those skilled in the art can understand that the message characteristics are the characteristics that can distinguish the types of messages, and different types of messages should have different message characteristics.

[0061] Step S301: Identify the user login authentication message and other local service messages according to the message characteristics of the shunted message.

[0062] In the above step S301, in the received shunted message, by identifying the message characteristics of the shunted message, the user login authentication message or other local service messages are identified; it can be understood that whether it is the user login authentication message or other local service messages, they all belong to the local messages; and during the process of receiving messages, non-local messages may often be received; therefore, it is necessary to distinguish and identify the shunted messages.

[0063] It should be noted that each service board may also receive non-local messages. The destination IP of the non-local message is not the device IP. After the service board is responsible for the service processing, it forwards the message externally. When the service board receives a non-local message, the processing flow still follows the original processing logic, and the service board to which it is shunted will process it according to the original logic.

[0064] Through Figure 3 it can be seen that in the embodiments of the present application, the service board will identify and distinguish the obtained shunted messages; further distinguish the local messages and non-local messages, as well as the user login authentication messages and other local service messages in the local messages. Thus, the SSLVPN user login authentication message can be accurately distinguished from the local messages, which is beneficial to the subsequent processing of the SSLVPN user login authentication message.

[0065] Please refer to Figure 4 , Figure 4Flowchart of other local service message processing provided by the embodiments of the present application; in the embodiments of the present application, the service board further includes a main control service board. In an alternative embodiment of the present application, in the target service board, after determining the user login authentication message and / or other local service messages from the shunt messages, the SSLVPN login and data synchronization method further includes the following steps:

[0066] Step S400: If other local service messages are determined, determine whether the target service board is the main control service board.

[0067] In the above step S400, after the target service board obtains the shunt message, it distinguishes and determines the shunt message; when other local service messages are determined, further, it is necessary to determine whether the current target service board is the main control service board.

[0068] Step S401: If it is determined that the target service board is the main control service board, the target service board processes other local service messages.

[0069] In the above step S401, if it is determined that the target service board is the main control service board, then the target service board directly processes other local service messages.

[0070] Through Figure 4 It can be seen that when other local service messages are determined in the shunt message; further, determine whether the target service board is the main control service board. If it is the main control service board, then directly let the target service board process the above other local service messages. That is to say, whether it is the main control service board or other service boards, they can directly process the user login message, while other local service messages need to be processed by the main control service board, thereby dispersing the user login authentication message to each service board and avoiding the service congestion of the main control service board.

[0071] In an alternative embodiment, when other local service messages are determined in the shunt message; further, determine whether the target service board is the main control service board. If it is determined that the target service board is not the main control service board, forward the other local service messages from the target service board to the main control service board; the main control service board processes the other local service messages.

[0072] It can be seen from this that when other local service messages are determined in the shunt message; further, determine whether the target service board is the main control service board. If it is a non-main control service board, then forward the other local service messages from the target service board to the main control service board; the main control service board processes the other local service messages. That is to say, when there are other local service messages in the messages received by the non-main control service board, and the other local service messages need to be processed by the main control service board.

[0073] Since the client successfully logs in to the SSLVPN server, operations such as online user logout and account information modification generate real-time user information data based on the current service board. The network security device's multi-service boards simultaneously provide SSLVPN user login authentication services. If the user information on each service board is inconsistent, there may be problems such as the same user being online on different service boards simultaneously or the user account information being inconsistent. The SSLVPN login and data synchronization method provided by the embodiments of the present application can also achieve data synchronization. Please refer to Figure 5 , Figure 5 which is the flowchart of data synchronization provided by the embodiments of the present application; in an alternative embodiment of the embodiments of the present application, after the target service board processes the user login authentication message, the SSLVPN login and data synchronization method further includes:

[0074] Step S500: Monitor and obtain real-time user update data.

[0075] In the above step S500, after each service board processes the user login authentication message, the service board detects and obtains the real-time update data of the user. It should be noted that the real-time user update data generally refers to the data generated by changes such as the user modifying the password, mobile phone number, email, etc.

[0076] Step S501: Determine whether the target service board is the control service board.

[0077] Step S502: If the target service board is the control service board, the control service board synchronizes the real-time user update data to each service board.

[0078] In the above steps S501 - S502, if the real-time user update data is obtained, then it is determined whether the current target service board is the control service board; if the current target service board is the control service board, the control service board directly synchronizes the real-time user update data to each service board.

[0079] Through Figure 5 it can be seen that the online SSLVPN user generates real-time user information data based on the current service board. By adopting the method of board - to - board message synchronization, if the current service board is the control board, it is directly synchronized to other service boards; otherwise, it is first notified to the main control service board, and the main control service board synchronizes it to other service boards except the source board, ensuring the consistency of the SSLVPN online user information on each service board.

[0080] In an alternative embodiment, if the target service board is not the control service board, the target service board sends the real-time user update data to the main control service board; the main control service board synchronizes the real-time user update data to each service board.

[0081] It can be seen from this that after each service board processes the user login authentication message, the service board detects and obtains the real-time updated data of the user. If the target service board is not the control service board, the target service board sends the real-time updated data of the user to the main control service board; the main control service board synchronizes the real-time updated data of the user to each service board. That is to say, the SSLVPN login and data synchronization method provided by the embodiments of the present application can synchronize the SSLVPN online user information between boards, ensuring the consistency of the SSLVPN user information of each service board.

[0082] [[ID=X]]Please refer to Figure 6 , Figure 6 which is the flowchart of SSLVPN login and data synchronization provided by the embodiments of the present application; please refer to it in combination with Figure 7 , Figure 7 which is the schematic diagram of user login authentication processing in the SSLVPN usage scenario provided by the embodiments of the present application; the user logs in to the SSLVPN server through the client, and the client sends a user login authentication request message to the SSLVPN service. The source IP is the public IP of the client, and the destination IP is the entry IP of the network security device. The specific processing process is as follows:

[0083] Step S600: The user issues an operation to log in to the SSLVPN server, and the client assembles a user login authentication request message.

[0084] Step S601: The SSLVPN server switching board obtains the message and shunts the message.

[0085] In the above step S601, the client login authentication request message is sent to the SSLVPN server; the message first reaches the switching board, and the switching board shunts the message based on the source and destination IP hashing of the message and shunts the message to the corresponding service board for processing. For different source and destination IPs, the service boards reached after shunting are different.

[0086] Step S602: After the message is shunted, it reaches the non-control service board, and the non-control service board parses the user login authentication request message.

[0087] In the above step S602, if the message reaches service board N (non-control service board) after shunting, the service board identifies the message as a local message based on the message feature information, further identifies it as an SSLVPN user login authentication request message, and marks it with an SSLVPN message mark.

[0088] Step S603: The non-control service board processes the SSLVPN user login authentication request message, and the user logs in successfully.

[0089] In the above step S603, for the subsequent processing of the message, in the processing logic of forwarding the local message to the main control service board, since it is an SSLVPN message, it is not transferred to another board; based on the processing of the current service board, the service board sends a response message and establishes an SSLVPN tunnel with the client, and the user logs in successfully.

[0090] Step S604: The non-control service board obtains the real-time updated data of the user.

[0091] In the above step S604, after the user successfully logs in, operations such as password modification, email modification, and logout of the online user generate real-time user data on service board N and update the local user information database.

[0092] Step S605: The non-control service board sends the real-time updated data of the user to the main control service board, and the main control service board synchronizes the real-time updated data of the user to other service boards.

[0093] In the above step S605, since service board N is a non-control service board, service board N first synchronizes the user information to the main control service board, and the control service board updates the local user information database. Then, the control synchronizes the SSLVPN online user information to other service boards except service board N.

[0094] Step S606: After the message is shunted and reaches the main control service board, the main control service board processes the SSLVPN0 user login authentication request message, and the user logs in successfully.

[0095] In the above step S606, if the message is shunted and reaches the control service board, the main control service board itself has the function of processing user authentication login and directly processes it. The main control establishes an SSLVPN tunnel with the client, and the user logs in successfully.

[0096] Step S607: The control service board obtains the real-time updated data of the user and directly broadcasts and synchronizes it to other 5 service boards.

[0097] In the above step S607, the online user generates real-time user data on the main control service board. The control service board updates the local user information database, and then synchronizes the online user information to other service boards in the form of broadcast.

[0098] Please refer to Figure 8 , Figure 8 , which is a schematic diagram of the modules of the SSLVPN login and data synchronization system provided by the embodiment of the present application; the SSLVPN login and data synchronization system 100 includes: a message shunting module 110, a message parsing module 120, and a login message processing module 130.

[0099] The message splitting module 110 is used to receive the original message and split the original message to the target service board, so that the target service board obtains the split message; the message parsing module 120 is used to determine the user login authentication message and / or other local service messages from the split message on the target service board; and the login message processing module 130 is further used to process the user login authentication message by the target service board when the user login authentication message is determined.

[0100] In an optional embodiment, the service board includes a switching board; the message splitting module 110 receiving the original message and splitting the original message to the target service board so that the target service board obtains the split message includes: the switching board receives the original message, and the message splitting module 110 obtains the source IP and the destination IP from the original message; according to the source IP and the destination IP, the message splitting module 110 splits the original message to different target service boards, so that different target service boards obtain the split message.

[0101] In an optional embodiment, the message parsing module 120 further includes a message filtering module 121. The message parsing module 120 determining the user login authentication message and / or other local service messages from the split message on the target service board includes: the message parsing module 120 obtains the message characteristics of the split message; according to the message characteristics of the split message, identifies the user login authentication message, other local service messages and non-local messages; the message filtering module 121 filters the non-local messages to obtain the user login message and other local service messages.

[0102] In an optional embodiment, the SSLVPN login and data synchronization system 100 further includes a service board determination module 140; the service board further includes a main control service board; after the message parsing module 120 determines the user login authentication message and / or other local service messages from the split message on the target service board, if other local service messages are determined, the service board determination module 140 determines whether the target service board is the main control service board; if it is determined that the target service board is the main control service board, the target service board processes the other local service messages.

[0103] In an optional embodiment, if the service board determination module 140 determines that the target service board is not the main control service board, the other local service messages are forwarded from the target service board to the main control service board; the main control service board processes the other local service messages.

[0104] In an alternative embodiment, the SSLVPN login and data synchronization system 100 further includes an information synchronization module 150; after the target service board processes the user login authentication message, it monitors and obtains the user's real-time updated data; the service board judgment module 140 judges whether the target service board is a control service board; if the target service board is the main control service board, the information synchronization module 150 controls the main control service board to synchronize the user's real-time updated data to each other service board.

[0105] In an alternative embodiment, if the service board judgment module 140 determines that the target service board is not a control service board, the target service board sends the user's real-time updated data to the main control service board; the information synchronization module 150 controls the main control service board to synchronize the user's real-time updated data to each service board.

[0106] Please refer to Figure 9 , Figure 9 which is a schematic structural diagram of the electronic device provided by the embodiment of the present application. An electronic device 300 provided by the embodiment of the present application includes: a processor 301 and a memory 302, and the memory 302 stores machine-readable instructions executable by the processor 301. When the machine-readable instructions are executed by the processor 301, the above method is executed.

[0107] Based on the same inventive concept, the embodiment of the present application further provides a computer-readable storage medium. The computer-readable storage medium stores computer program instructions. When the computer program instructions are read and run by a processor, the steps in any of the above implementation manners are executed.

[0108] The computer-readable storage medium may be a random access memory (RAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or other various media that can store program codes. Among them, the storage medium is used to store the program. After receiving the execution instruction, the processor executes the program. The method executed by the electronic terminal defined by the process disclosed in any embodiment of the present invention can be applied to the processor or implemented by the processor.

[0109] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For another example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed couplings or direct couplings or communication connections to each other can be through some communication interfaces. The indirect coupling or communication connection of the devices or units can be in electrical, mechanical or other forms.

[0110] In addition, the units described as separate components may or may not be physically separated. The components displayed as units may or may not be physical units, that is, they can be located in one place or distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0111] Furthermore, in each embodiment of the present application, the various functional modules can be integrated together to form an independent part, or each module can exist alone, or two or more modules can be integrated to form an independent part.

[0112] Alternatively, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the processes or functions described in the embodiments of the present invention are generated in whole or in part.

[0113] The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the

[0114] computer instructions can be transmitted from a website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave

[0115] etc.) means to another website, computer, server or data center.

[0116] In this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply these entities or

[0117] There is no such actual relationship or order between operations. Moreover, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, such that a process, method, article or apparatus that comprises a series of elements

[0118] not only includes those elements, but also includes other elements not expressly listed, or also includes elements inherent to such process, method, article or apparatus. Without further limitation, an element defined by the statement "comprising..." does not exclude

[0119] the presence of additional identical elements in the process, method, article or apparatus that includes the said element. The above is only an embodiment of the present application and is not used to limit the protection scope of the present application,

[0120] For those skilled in the art, various changes and modifications can be made to the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included within the protection scope of the present application.

Claims

1. An SSLVPN login and data synchronization method, characterized in that, The method is applied to an SSLVPN server with multiple service boards; the method includes: Receiving an original message and splitting the original message to a target service board so that the target service board obtains a split message; On the target service board, determining a user login authentication message and / or other local service messages from the split message; If the user login authentication message is determined, processing the user login authentication message by the target service board; Wherein, the service board includes a main control service board; If the other local service messages are determined, determining whether the target service board is the main control service board; if it is determined that the target service board is the main control service board, processing the other local service messages by the target service board; If it is determined that the target service board is not the main control service board, forwarding the other local service messages from the target service board to the main control service board; and processing the other local service messages by the main control service board.

2. The method according to claim 1, wherein Wherein, The service board further includes a switching board; the receiving of the original message and splitting the original message to a target service board so that the target service board obtains a split message includes: Receiving the original message by the switching board and obtaining a source IP and a destination IP from the original message; According to the source IP and the destination IP, splitting the original message to different target service boards so that different target service boards obtain the split message.

3. The method according to claim 1, characterized in that, The determining, on the target service board, a user login authentication message and / or other local service messages from the split message includes: Obtaining a message feature of the split message; Identifying the user login authentication message and other local service messages according to the message feature of the split message.

4. The method according to claim 1, wherein After the target service board processes the user login authentication message, the method further includes: Monitoring and obtaining real-time updated user data; Determining whether the target service board is a control service board; If the target service board is a control service board, synchronizing the real-time updated user data by the control service board to each service board.

5. The method according to claim 4, wherein The method further includes: if the target service board is not the control service board, sending the real-time updated user data by the target service board to the main control service board; Synchronizing the real-time updated user data by the main control service board to each service board.

6. An SSLVPN login and data synchronization system, characterized in that The system includes: a message splitting module, a message parsing module, and a login message processing module; The message splitting module is configured to receive an original message and split the original message to a target service board so that the target service board obtains a split message; The message parsing module is configured to determine, on the target service board, a user login authentication message and / or other local service messages from the split message; and The login message processing module is further configured to, when the user login authentication message is determined, process the user login authentication message by the target service board; wherein, the service board includes a main control service board; The message parsing module is further configured to, when determining the other local service messages, determine whether the target service board is the master service board; The login message processing module is further configured to, when the target service board is the master service board, process the other local service messages by the target service board; The login message processing module is further configured to, when the target service board is not the master service board, forward the other local service messages from the target service board to the master service board; and the master service board processes the other local service messages.

7. An electronic device, characterized in that, The electronic device includes a memory and a processor. Program instructions are stored in the memory. When the processor runs the program instructions, the steps in the method according to any one of claims 1-5 are executed.

8. A computer-readable storage medium, characterized in that, Computer program instructions are stored in the computer-readable storage medium. When the computer program instructions are run by a processor, the steps in the method according to any one of claims 1-5 are executed.

Images